@trops/dash-core 0.1.610 → 0.1.612

package/dist/electron/index.js

@@ -19,20 +19,20 @@ var require$$6 = require('csv-parser');
 var require$$0$6 = require('quickjs-emscripten');
 var require$$11 = require('https');
 var require$$0$8 = require('@modelcontextprotocol/sdk/client/index.js');
-var require$$1$5 = require('@modelcontextprotocol/sdk/client/stdio.js');
+var require$$1$6 = require('@modelcontextprotocol/sdk/client/stdio.js');
 var require$$0$7 = require('pkce-challenge');
 var require$$12 = require('child_process');
+var require$$1$5 = require('http');
 var require$$2$2 = require('algoliasearch');
 var require$$3$2 = require('node:path');
 var require$$0$9 = require('openai');
-var require$$0$c = require('@anthropic-ai/sdk');
+var require$$0$a = require('@anthropic-ai/sdk');
 var require$$2$3 = require('zod-to-json-schema');
 var require$$8$1 = require('zod');
-var require$$0$a = require('http');
-var require$$1$6 = require('http2');
+var require$$1$7 = require('http2');
 var require$$2$4 = require('node-forge');
 var require$$0$b = require('css');
-var require$$1$7 = require('node-vibrant/node');
+var require$$1$8 = require('node-vibrant/node');
 var require$$3$3 = require('ws');
 
 var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
@@ -411,6 +411,10 @@ const MCP_RUN_AUTH$1 = "mcp-run-auth";
 const MCP_RUN_AUTH_COMPLETE = "mcp-run-auth-complete";
 const MCP_RUN_AUTH_ERROR = "mcp-run-auth-error";
 
+const MCP_AUTHORIZE$1 = "mcp-authorize";
+const MCP_AUTHORIZE_COMPLETE = "mcp-authorize-complete";
+const MCP_AUTHORIZE_ERROR = "mcp-authorize-error";
+
 var mcpEvents$1 = {
   MCP_START_SERVER: MCP_START_SERVER$1,
   MCP_START_SERVER_COMPLETE,
@@ -442,6 +446,9 @@ var mcpEvents$1 = {
   MCP_RUN_AUTH: MCP_RUN_AUTH$1,
   MCP_RUN_AUTH_COMPLETE,
   MCP_RUN_AUTH_ERROR,
+  MCP_AUTHORIZE: MCP_AUTHORIZE$1,
+  MCP_AUTHORIZE_COMPLETE,
+  MCP_AUTHORIZE_ERROR,
 };
 
 /**
@@ -582,6 +589,7 @@ const LLM_CHECK_CLI_AVAILABLE$1 = "llm-check-cli-available";
 const LLM_CLEAR_CLI_SESSION$1 = "llm-clear-cli-session";
 const LLM_CLI_SESSION_STATUS$1 = "llm-cli-session-status";
 const LLM_CLI_END_SESSION$1 = "llm-cli-end-session";
+const LLM_LIST_MODELS$1 = "llm-list-models";
 
 // --- Main → Renderer (send) ---
 const LLM_STREAM_DELTA$3 = "llm-stream-delta";
@@ -603,6 +611,7 @@ var llmEvents$1 = {
   LLM_STREAM_ERROR: LLM_STREAM_ERROR$3,
   LLM_CLI_SESSION_STATUS: LLM_CLI_SESSION_STATUS$1,
   LLM_CLI_END_SESSION: LLM_CLI_END_SESSION$1,
+  LLM_LIST_MODELS: LLM_LIST_MODELS$1,
 };
 
 /**
@@ -18748,6 +18757,14 @@ function requireProviderController () {
 	        providerEntry.isDefaultForType = true;
 	      }
 
+	      // Preserve any OAuth state (tokens / DCR client info / PKCE verifier)
+	      // written out-of-band by saveOAuthState. A fresh providerEntry would
+	      // otherwise drop it, wiping tokens whenever the user edits/re-saves an
+	      // OAuth MCP provider.
+	      if (prev.oauth) {
+	        providerEntry.oauth = prev.oauth;
+	      }
+
 	      // Single-winner invariant: when flipping this provider's flag to
 	      // true, clear it on every other provider with the same type. Run
 	      // this BEFORE we set `providers[providerName] = providerEntry` so
@@ -19025,6 +19042,86 @@ function requireProviderController () {
 	      };
 	    }
 	  },
+
+	  /**
+	   * saveOAuthState
+	   * Persist an MCP OAuth session blob (tokens, DCR client info, PKCE
+	   * verifier) encrypted alongside the provider entry. Used by the SDK
+	   * OAuthClientProvider (mcpOAuthProvider.js). Creates a minimal MCP
+	   * provider entry if one doesn't exist yet, so "Authorize" can run
+	   * before the provider is formally saved (the later saveProvider
+	   * preserves this blob).
+	   *
+	   * @param {BrowserWindow} win the main window (unused; signature parity)
+	   * @param {string} appId the application id
+	   * @param {string} providerName the provider/server name
+	   * @param {object} oauthState { tokens?, clientInformation?, codeVerifier? }
+	   */
+	  saveOAuthState: (win, appId, providerName, oauthState) => {
+	    try {
+	      const filename = path.join(
+	        app.getPath("userData"),
+	        appName,
+	        appId,
+	        configFilename,
+	      );
+	      ensureDirectoryExistence(filename);
+
+	      const providers = getFileContents(filename, {});
+	      const encrypted = safeStorage
+	        .encryptString(JSON.stringify(oauthState || {}))
+	        .toString("base64");
+
+	      const prev = providers[providerName] || {};
+	      providers[providerName] = {
+	        ...prev,
+	        providerClass: prev.providerClass || "mcp",
+	        oauth: encrypted,
+	        dateCreated: prev.dateCreated || new Date().toISOString(),
+	        dateUpdated: new Date().toISOString(),
+	      };
+
+	      writeFileSync(filename, JSON.stringify(providers, null, 2), {
+	        mode: 0o600,
+	      });
+
+	      return { success: true };
+	    } catch (error) {
+	      console.error("[providerController] Error saving OAuth state:", error);
+	      return { error: true, message: error.message };
+	    }
+	  },
+
+	  /**
+	   * getOAuthState
+	   * Read and decrypt the OAuth session blob for a provider, or `{}` if
+	   * none exists. Main-process only — never surfaced to the renderer.
+	   *
+	   * @param {BrowserWindow} win the main window (unused; signature parity)
+	   * @param {string} appId the application id
+	   * @param {string} providerName the provider/server name
+	   * @returns {{ oauth?: object }}
+	   */
+	  getOAuthState: (win, appId, providerName) => {
+	    try {
+	      const filename = path.join(
+	        app.getPath("userData"),
+	        appName,
+	        appId,
+	        configFilename,
+	      );
+	      const providers = getFileContents(filename, {});
+	      const entry = providers[providerName];
+	      if (!entry || !entry.oauth) return {};
+
+	      const buffer = Buffer.from(entry.oauth, "base64");
+	      const decrypted = safeStorage.decryptString(buffer);
+	      return { oauth: JSON.parse(decrypted) };
+	    } catch (error) {
+	      console.error("[providerController] Error reading OAuth state:", error);
+	      return {};
+	    }
+	  },
 	};
 
 	providerController_1 = providerController;
@@ -30734,11 +30831,11 @@ var __importStar$4 = (commonjsGlobal && commonjsGlobal.__importStar) || function
 Object.defineProperty(parse$2, "__esModule", { value: true });
 parse$2.safeParseAsync = parse$2.safeParse = parse$2.parseAsync = parse$2.parse = void 0;
 const core$5 = __importStar$4(core$8);
-const errors_js_1$2 = errors$3;
-parse$2.parse = core$5._parse(errors_js_1$2.ZodRealError);
-parse$2.parseAsync = core$5._parseAsync(errors_js_1$2.ZodRealError);
-parse$2.safeParse = core$5._safeParse(errors_js_1$2.ZodRealError);
-parse$2.safeParseAsync = core$5._safeParseAsync(errors_js_1$2.ZodRealError);
+const errors_js_1$1 = errors$3;
+parse$2.parse = core$5._parse(errors_js_1$1.ZodRealError);
+parse$2.parseAsync = core$5._parseAsync(errors_js_1$1.ZodRealError);
+parse$2.safeParse = core$5._safeParse(errors_js_1$1.ZodRealError);
+parse$2.safeParseAsync = core$5._safeParseAsync(errors_js_1$1.ZodRealError);
 
 var hasRequiredSchemas;
 
@@ -34204,1426 +34301,1457 @@ function date$1(params) {
 	
 } (types$2));
 
-var auth$2 = {};
-
 var auth$1 = {};
 
-(function (exports) {
-	var __createBinding = (commonjsGlobal && commonjsGlobal.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-	    if (k2 === undefined) k2 = k;
-	    var desc = Object.getOwnPropertyDescriptor(m, k);
-	    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-	      desc = { enumerable: true, get: function() { return m[k]; } };
+var auth = {};
+
+var hasRequiredAuth$1;
+
+function requireAuth$1 () {
+	if (hasRequiredAuth$1) return auth;
+	hasRequiredAuth$1 = 1;
+	(function (exports) {
+		var __createBinding = (commonjsGlobal && commonjsGlobal.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+		    if (k2 === undefined) k2 = k;
+		    var desc = Object.getOwnPropertyDescriptor(m, k);
+		    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+		      desc = { enumerable: true, get: function() { return m[k]; } };
+		    }
+		    Object.defineProperty(o, k2, desc);
+		}) : (function(o, m, k, k2) {
+		    if (k2 === undefined) k2 = k;
+		    o[k2] = m[k];
+		}));
+		var __setModuleDefault = (commonjsGlobal && commonjsGlobal.__setModuleDefault) || (Object.create ? (function(o, v) {
+		    Object.defineProperty(o, "default", { enumerable: true, value: v });
+		}) : function(o, v) {
+		    o["default"] = v;
+		});
+		var __importStar = (commonjsGlobal && commonjsGlobal.__importStar) || function (mod) {
+		    if (mod && mod.__esModule) return mod;
+		    var result = {};
+		    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+		    __setModuleDefault(result, mod);
+		    return result;
+		};
+		Object.defineProperty(exports, "__esModule", { value: true });
+		exports.OAuthTokenRevocationRequestSchema = exports.OAuthClientRegistrationErrorSchema = exports.OAuthClientInformationFullSchema = exports.OAuthClientInformationSchema = exports.OAuthClientMetadataSchema = exports.OptionalSafeUrlSchema = exports.OAuthErrorResponseSchema = exports.OAuthTokensSchema = exports.OpenIdProviderDiscoveryMetadataSchema = exports.OpenIdProviderMetadataSchema = exports.OAuthMetadataSchema = exports.OAuthProtectedResourceMetadataSchema = exports.SafeUrlSchema = void 0;
+		const z = __importStar(v4);
+		/**
+		 * Reusable URL validation that disallows javascript: scheme
+		 */
+		exports.SafeUrlSchema = z
+		    .url()
+		    .superRefine((val, ctx) => {
+		    if (!URL.canParse(val)) {
+		        ctx.addIssue({
+		            code: z.ZodIssueCode.custom,
+		            message: 'URL must be parseable',
+		            fatal: true
+		        });
+		        return z.NEVER;
+		    }
+		})
+		    .refine(url => {
+		    const u = new URL(url);
+		    return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';
+		}, { message: 'URL cannot use javascript:, data:, or vbscript: scheme' });
+		/**
+		 * RFC 9728 OAuth Protected Resource Metadata
+		 */
+		exports.OAuthProtectedResourceMetadataSchema = z.looseObject({
+		    resource: z.string().url(),
+		    authorization_servers: z.array(exports.SafeUrlSchema).optional(),
+		    jwks_uri: z.string().url().optional(),
+		    scopes_supported: z.array(z.string()).optional(),
+		    bearer_methods_supported: z.array(z.string()).optional(),
+		    resource_signing_alg_values_supported: z.array(z.string()).optional(),
+		    resource_name: z.string().optional(),
+		    resource_documentation: z.string().optional(),
+		    resource_policy_uri: z.string().url().optional(),
+		    resource_tos_uri: z.string().url().optional(),
+		    tls_client_certificate_bound_access_tokens: z.boolean().optional(),
+		    authorization_details_types_supported: z.array(z.string()).optional(),
+		    dpop_signing_alg_values_supported: z.array(z.string()).optional(),
+		    dpop_bound_access_tokens_required: z.boolean().optional()
+		});
+		/**
+		 * RFC 8414 OAuth 2.0 Authorization Server Metadata
+		 */
+		exports.OAuthMetadataSchema = z.looseObject({
+		    issuer: z.string(),
+		    authorization_endpoint: exports.SafeUrlSchema,
+		    token_endpoint: exports.SafeUrlSchema,
+		    registration_endpoint: exports.SafeUrlSchema.optional(),
+		    scopes_supported: z.array(z.string()).optional(),
+		    response_types_supported: z.array(z.string()),
+		    response_modes_supported: z.array(z.string()).optional(),
+		    grant_types_supported: z.array(z.string()).optional(),
+		    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+		    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+		    service_documentation: exports.SafeUrlSchema.optional(),
+		    revocation_endpoint: exports.SafeUrlSchema.optional(),
+		    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+		    revocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+		    introspection_endpoint: z.string().optional(),
+		    introspection_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+		    introspection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+		    code_challenge_methods_supported: z.array(z.string()).optional(),
+		    client_id_metadata_document_supported: z.boolean().optional()
+		});
+		/**
+		 * OpenID Connect Discovery 1.0 Provider Metadata
+		 * see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+		 */
+		exports.OpenIdProviderMetadataSchema = z.looseObject({
+		    issuer: z.string(),
+		    authorization_endpoint: exports.SafeUrlSchema,
+		    token_endpoint: exports.SafeUrlSchema,
+		    userinfo_endpoint: exports.SafeUrlSchema.optional(),
+		    jwks_uri: exports.SafeUrlSchema,
+		    registration_endpoint: exports.SafeUrlSchema.optional(),
+		    scopes_supported: z.array(z.string()).optional(),
+		    response_types_supported: z.array(z.string()),
+		    response_modes_supported: z.array(z.string()).optional(),
+		    grant_types_supported: z.array(z.string()).optional(),
+		    acr_values_supported: z.array(z.string()).optional(),
+		    subject_types_supported: z.array(z.string()),
+		    id_token_signing_alg_values_supported: z.array(z.string()),
+		    id_token_encryption_alg_values_supported: z.array(z.string()).optional(),
+		    id_token_encryption_enc_values_supported: z.array(z.string()).optional(),
+		    userinfo_signing_alg_values_supported: z.array(z.string()).optional(),
+		    userinfo_encryption_alg_values_supported: z.array(z.string()).optional(),
+		    userinfo_encryption_enc_values_supported: z.array(z.string()).optional(),
+		    request_object_signing_alg_values_supported: z.array(z.string()).optional(),
+		    request_object_encryption_alg_values_supported: z.array(z.string()).optional(),
+		    request_object_encryption_enc_values_supported: z.array(z.string()).optional(),
+		    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
+		    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
+		    display_values_supported: z.array(z.string()).optional(),
+		    claim_types_supported: z.array(z.string()).optional(),
+		    claims_supported: z.array(z.string()).optional(),
+		    service_documentation: z.string().optional(),
+		    claims_locales_supported: z.array(z.string()).optional(),
+		    ui_locales_supported: z.array(z.string()).optional(),
+		    claims_parameter_supported: z.boolean().optional(),
+		    request_parameter_supported: z.boolean().optional(),
+		    request_uri_parameter_supported: z.boolean().optional(),
+		    require_request_uri_registration: z.boolean().optional(),
+		    op_policy_uri: exports.SafeUrlSchema.optional(),
+		    op_tos_uri: exports.SafeUrlSchema.optional(),
+		    client_id_metadata_document_supported: z.boolean().optional()
+		});
+		/**
+		 * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
+		 * This schema represents the real-world scenario where OIDC providers
+		 * return a mix of OpenID Connect and OAuth 2.0 metadata fields
+		 */
+		exports.OpenIdProviderDiscoveryMetadataSchema = z.object({
+		    ...exports.OpenIdProviderMetadataSchema.shape,
+		    ...exports.OAuthMetadataSchema.pick({
+		        code_challenge_methods_supported: true
+		    }).shape
+		});
+		/**
+		 * OAuth 2.1 token response
+		 */
+		exports.OAuthTokensSchema = z
+		    .object({
+		    access_token: z.string(),
+		    id_token: z.string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect
+		    token_type: z.string(),
+		    expires_in: z.coerce.number().optional(),
+		    scope: z.string().optional(),
+		    refresh_token: z.string().optional()
+		})
+		    .strip();
+		/**
+		 * OAuth 2.1 error response
+		 */
+		exports.OAuthErrorResponseSchema = z.object({
+		    error: z.string(),
+		    error_description: z.string().optional(),
+		    error_uri: z.string().optional()
+		});
+		/**
+		 * Optional version of SafeUrlSchema that allows empty string for retrocompatibility on tos_uri and logo_uri
+		 */
+		exports.OptionalSafeUrlSchema = exports.SafeUrlSchema.optional().or(z.literal('').transform(() => undefined));
+		/**
+		 * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+		 */
+		exports.OAuthClientMetadataSchema = z
+		    .object({
+		    redirect_uris: z.array(exports.SafeUrlSchema),
+		    token_endpoint_auth_method: z.string().optional(),
+		    grant_types: z.array(z.string()).optional(),
+		    response_types: z.array(z.string()).optional(),
+		    client_name: z.string().optional(),
+		    client_uri: exports.SafeUrlSchema.optional(),
+		    logo_uri: exports.OptionalSafeUrlSchema,
+		    scope: z.string().optional(),
+		    contacts: z.array(z.string()).optional(),
+		    tos_uri: exports.OptionalSafeUrlSchema,
+		    policy_uri: z.string().optional(),
+		    jwks_uri: exports.SafeUrlSchema.optional(),
+		    jwks: z.any().optional(),
+		    software_id: z.string().optional(),
+		    software_version: z.string().optional(),
+		    software_statement: z.string().optional()
+		})
+		    .strip();
+		/**
+		 * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+		 */
+		exports.OAuthClientInformationSchema = z
+		    .object({
+		    client_id: z.string(),
+		    client_secret: z.string().optional(),
+		    client_id_issued_at: z.number().optional(),
+		    client_secret_expires_at: z.number().optional()
+		})
+		    .strip();
+		/**
+		 * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+		 */
+		exports.OAuthClientInformationFullSchema = exports.OAuthClientMetadataSchema.merge(exports.OAuthClientInformationSchema);
+		/**
+		 * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+		 */
+		exports.OAuthClientRegistrationErrorSchema = z
+		    .object({
+		    error: z.string(),
+		    error_description: z.string().optional()
+		})
+		    .strip();
+		/**
+		 * RFC 7009 OAuth 2.0 Token Revocation request
+		 */
+		exports.OAuthTokenRevocationRequestSchema = z
+		    .object({
+		    token: z.string(),
+		    token_type_hint: z.string().optional()
+		})
+		    .strip();
+		
+	} (auth));
+	return auth;
+}
+
+var authUtils = {};
+
+var hasRequiredAuthUtils;
+
+function requireAuthUtils () {
+	if (hasRequiredAuthUtils) return authUtils;
+	hasRequiredAuthUtils = 1;
+	/**
+	 * Utilities for handling OAuth resource URIs.
+	 */
+	Object.defineProperty(authUtils, "__esModule", { value: true });
+	authUtils.resourceUrlFromServerUrl = resourceUrlFromServerUrl;
+	authUtils.checkResourceAllowed = checkResourceAllowed;
+	/**
+	 * Converts a server URL to a resource URL by removing the fragment.
+	 * RFC 8707 section 2 states that resource URIs "MUST NOT include a fragment component".
+	 * Keeps everything else unchanged (scheme, domain, port, path, query).
+	 */
+	function resourceUrlFromServerUrl(url) {
+	    const resourceURL = typeof url === 'string' ? new URL(url) : new URL(url.href);
+	    resourceURL.hash = ''; // Remove fragment
+	    return resourceURL;
+	}
+	/**
+	 * Checks if a requested resource URL matches a configured resource URL.
+	 * A requested resource matches if it has the same scheme, domain, port,
+	 * and its path starts with the configured resource's path.
+	 *
+	 * @param requestedResource The resource URL being requested
+	 * @param configuredResource The resource URL that has been configured
+	 * @returns true if the requested resource matches the configured resource, false otherwise
+	 */
+	function checkResourceAllowed({ requestedResource, configuredResource }) {
+	    const requested = typeof requestedResource === 'string' ? new URL(requestedResource) : new URL(requestedResource.href);
+	    const configured = typeof configuredResource === 'string' ? new URL(configuredResource) : new URL(configuredResource.href);
+	    // Compare the origin (scheme, domain, and port)
+	    if (requested.origin !== configured.origin) {
+	        return false;
 	    }
-	    Object.defineProperty(o, k2, desc);
-	}) : (function(o, m, k, k2) {
-	    if (k2 === undefined) k2 = k;
-	    o[k2] = m[k];
-	}));
-	var __setModuleDefault = (commonjsGlobal && commonjsGlobal.__setModuleDefault) || (Object.create ? (function(o, v) {
-	    Object.defineProperty(o, "default", { enumerable: true, value: v });
-	}) : function(o, v) {
-	    o["default"] = v;
-	});
-	var __importStar = (commonjsGlobal && commonjsGlobal.__importStar) || function (mod) {
-	    if (mod && mod.__esModule) return mod;
-	    var result = {};
-	    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-	    __setModuleDefault(result, mod);
-	    return result;
-	};
-	Object.defineProperty(exports, "__esModule", { value: true });
-	exports.OAuthTokenRevocationRequestSchema = exports.OAuthClientRegistrationErrorSchema = exports.OAuthClientInformationFullSchema = exports.OAuthClientInformationSchema = exports.OAuthClientMetadataSchema = exports.OptionalSafeUrlSchema = exports.OAuthErrorResponseSchema = exports.OAuthTokensSchema = exports.OpenIdProviderDiscoveryMetadataSchema = exports.OpenIdProviderMetadataSchema = exports.OAuthMetadataSchema = exports.OAuthProtectedResourceMetadataSchema = exports.SafeUrlSchema = void 0;
-	const z = __importStar(v4);
+	    // Handle cases like requested=/foo and configured=/foo/
+	    if (requested.pathname.length < configured.pathname.length) {
+	        return false;
+	    }
+	    // Check if the requested path starts with the configured path
+	    // Ensure both paths end with / for proper comparison
+	    // This ensures that if we have paths like "/api" and "/api/users",
+	    // we properly detect that "/api/users" is a subpath of "/api"
+	    // By adding a trailing slash if missing, we avoid false positives
+	    // where paths like "/api123" would incorrectly match "/api"
+	    const requestedPath = requested.pathname.endsWith('/') ? requested.pathname : requested.pathname + '/';
+	    const configuredPath = configured.pathname.endsWith('/') ? configured.pathname : configured.pathname + '/';
+	    return requestedPath.startsWith(configuredPath);
+	}
+	
+	return authUtils;
+}
+
+var errors$2 = {};
+
+var hasRequiredErrors$1;
+
+function requireErrors$1 () {
+	if (hasRequiredErrors$1) return errors$2;
+	hasRequiredErrors$1 = 1;
+	Object.defineProperty(errors$2, "__esModule", { value: true });
+	errors$2.OAUTH_ERRORS = errors$2.CustomOAuthError = errors$2.InvalidTargetError = errors$2.InsufficientScopeError = errors$2.InvalidClientMetadataError = errors$2.TooManyRequestsError = errors$2.MethodNotAllowedError = errors$2.InvalidTokenError = errors$2.UnsupportedTokenTypeError = errors$2.UnsupportedResponseTypeError = errors$2.TemporarilyUnavailableError = errors$2.ServerError = errors$2.AccessDeniedError = errors$2.InvalidScopeError = errors$2.UnsupportedGrantTypeError = errors$2.UnauthorizedClientError = errors$2.InvalidGrantError = errors$2.InvalidClientError = errors$2.InvalidRequestError = errors$2.OAuthError = void 0;
 	/**
-	 * Reusable URL validation that disallows javascript: scheme
+	 * Base class for all OAuth errors
 	 */
-	exports.SafeUrlSchema = z
-	    .url()
-	    .superRefine((val, ctx) => {
-	    if (!URL.canParse(val)) {
-	        ctx.addIssue({
-	            code: z.ZodIssueCode.custom,
-	            message: 'URL must be parseable',
-	            fatal: true
-	        });
-	        return z.NEVER;
+	class OAuthError extends Error {
+	    constructor(message, errorUri) {
+	        super(message);
+	        this.errorUri = errorUri;
+	        this.name = this.constructor.name;
 	    }
-	})
-	    .refine(url => {
-	    const u = new URL(url);
-	    return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';
-	}, { message: 'URL cannot use javascript:, data:, or vbscript: scheme' });
+	    /**
+	     * Converts the error to a standard OAuth error response object
+	     */
+	    toResponseObject() {
+	        const response = {
+	            error: this.errorCode,
+	            error_description: this.message
+	        };
+	        if (this.errorUri) {
+	            response.error_uri = this.errorUri;
+	        }
+	        return response;
+	    }
+	    get errorCode() {
+	        return this.constructor.errorCode;
+	    }
+	}
+	errors$2.OAuthError = OAuthError;
 	/**
-	 * RFC 9728 OAuth Protected Resource Metadata
+	 * Invalid request error - The request is missing a required parameter,
+	 * includes an invalid parameter value, includes a parameter more than once,
+	 * or is otherwise malformed.
 	 */
-	exports.OAuthProtectedResourceMetadataSchema = z.looseObject({
-	    resource: z.string().url(),
-	    authorization_servers: z.array(exports.SafeUrlSchema).optional(),
-	    jwks_uri: z.string().url().optional(),
-	    scopes_supported: z.array(z.string()).optional(),
-	    bearer_methods_supported: z.array(z.string()).optional(),
-	    resource_signing_alg_values_supported: z.array(z.string()).optional(),
-	    resource_name: z.string().optional(),
-	    resource_documentation: z.string().optional(),
-	    resource_policy_uri: z.string().url().optional(),
-	    resource_tos_uri: z.string().url().optional(),
-	    tls_client_certificate_bound_access_tokens: z.boolean().optional(),
-	    authorization_details_types_supported: z.array(z.string()).optional(),
-	    dpop_signing_alg_values_supported: z.array(z.string()).optional(),
-	    dpop_bound_access_tokens_required: z.boolean().optional()
-	});
+	class InvalidRequestError extends OAuthError {
+	}
+	errors$2.InvalidRequestError = InvalidRequestError;
+	InvalidRequestError.errorCode = 'invalid_request';
 	/**
-	 * RFC 8414 OAuth 2.0 Authorization Server Metadata
+	 * Invalid client error - Client authentication failed (e.g., unknown client, no client
+	 * authentication included, or unsupported authentication method).
 	 */
-	exports.OAuthMetadataSchema = z.looseObject({
-	    issuer: z.string(),
-	    authorization_endpoint: exports.SafeUrlSchema,
-	    token_endpoint: exports.SafeUrlSchema,
-	    registration_endpoint: exports.SafeUrlSchema.optional(),
-	    scopes_supported: z.array(z.string()).optional(),
-	    response_types_supported: z.array(z.string()),
-	    response_modes_supported: z.array(z.string()).optional(),
-	    grant_types_supported: z.array(z.string()).optional(),
-	    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-	    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
-	    service_documentation: exports.SafeUrlSchema.optional(),
-	    revocation_endpoint: exports.SafeUrlSchema.optional(),
-	    revocation_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-	    revocation_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
-	    introspection_endpoint: z.string().optional(),
-	    introspection_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-	    introspection_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
-	    code_challenge_methods_supported: z.array(z.string()).optional(),
-	    client_id_metadata_document_supported: z.boolean().optional()
-	});
+	class InvalidClientError extends OAuthError {
+	}
+	errors$2.InvalidClientError = InvalidClientError;
+	InvalidClientError.errorCode = 'invalid_client';
 	/**
-	 * OpenID Connect Discovery 1.0 Provider Metadata
-	 * see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
+	 * Invalid grant error - The provided authorization grant or refresh token is
+	 * invalid, expired, revoked, does not match the redirection URI used in the
+	 * authorization request, or was issued to another client.
 	 */
-	exports.OpenIdProviderMetadataSchema = z.looseObject({
-	    issuer: z.string(),
-	    authorization_endpoint: exports.SafeUrlSchema,
-	    token_endpoint: exports.SafeUrlSchema,
-	    userinfo_endpoint: exports.SafeUrlSchema.optional(),
-	    jwks_uri: exports.SafeUrlSchema,
-	    registration_endpoint: exports.SafeUrlSchema.optional(),
-	    scopes_supported: z.array(z.string()).optional(),
-	    response_types_supported: z.array(z.string()),
-	    response_modes_supported: z.array(z.string()).optional(),
-	    grant_types_supported: z.array(z.string()).optional(),
-	    acr_values_supported: z.array(z.string()).optional(),
-	    subject_types_supported: z.array(z.string()),
-	    id_token_signing_alg_values_supported: z.array(z.string()),
-	    id_token_encryption_alg_values_supported: z.array(z.string()).optional(),
-	    id_token_encryption_enc_values_supported: z.array(z.string()).optional(),
-	    userinfo_signing_alg_values_supported: z.array(z.string()).optional(),
-	    userinfo_encryption_alg_values_supported: z.array(z.string()).optional(),
-	    userinfo_encryption_enc_values_supported: z.array(z.string()).optional(),
-	    request_object_signing_alg_values_supported: z.array(z.string()).optional(),
-	    request_object_encryption_alg_values_supported: z.array(z.string()).optional(),
-	    request_object_encryption_enc_values_supported: z.array(z.string()).optional(),
-	    token_endpoint_auth_methods_supported: z.array(z.string()).optional(),
-	    token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
-	    display_values_supported: z.array(z.string()).optional(),
-	    claim_types_supported: z.array(z.string()).optional(),
-	    claims_supported: z.array(z.string()).optional(),
-	    service_documentation: z.string().optional(),
-	    claims_locales_supported: z.array(z.string()).optional(),
-	    ui_locales_supported: z.array(z.string()).optional(),
-	    claims_parameter_supported: z.boolean().optional(),
-	    request_parameter_supported: z.boolean().optional(),
-	    request_uri_parameter_supported: z.boolean().optional(),
-	    require_request_uri_registration: z.boolean().optional(),
-	    op_policy_uri: exports.SafeUrlSchema.optional(),
-	    op_tos_uri: exports.SafeUrlSchema.optional(),
-	    client_id_metadata_document_supported: z.boolean().optional()
-	});
+	class InvalidGrantError extends OAuthError {
+	}
+	errors$2.InvalidGrantError = InvalidGrantError;
+	InvalidGrantError.errorCode = 'invalid_grant';
 	/**
-	 * OpenID Connect Discovery metadata that may include OAuth 2.0 fields
-	 * This schema represents the real-world scenario where OIDC providers
-	 * return a mix of OpenID Connect and OAuth 2.0 metadata fields
+	 * Unauthorized client error - The authenticated client is not authorized to use
+	 * this authorization grant type.
 	 */
-	exports.OpenIdProviderDiscoveryMetadataSchema = z.object({
-	    ...exports.OpenIdProviderMetadataSchema.shape,
-	    ...exports.OAuthMetadataSchema.pick({
-	        code_challenge_methods_supported: true
-	    }).shape
-	});
+	class UnauthorizedClientError extends OAuthError {
+	}
+	errors$2.UnauthorizedClientError = UnauthorizedClientError;
+	UnauthorizedClientError.errorCode = 'unauthorized_client';
 	/**
-	 * OAuth 2.1 token response
+	 * Unsupported grant type error - The authorization grant type is not supported
+	 * by the authorization server.
 	 */
-	exports.OAuthTokensSchema = z
-	    .object({
-	    access_token: z.string(),
-	    id_token: z.string().optional(), // Optional for OAuth 2.1, but necessary in OpenID Connect
-	    token_type: z.string(),
-	    expires_in: z.coerce.number().optional(),
-	    scope: z.string().optional(),
-	    refresh_token: z.string().optional()
-	})
-	    .strip();
+	class UnsupportedGrantTypeError extends OAuthError {
+	}
+	errors$2.UnsupportedGrantTypeError = UnsupportedGrantTypeError;
+	UnsupportedGrantTypeError.errorCode = 'unsupported_grant_type';
 	/**
-	 * OAuth 2.1 error response
+	 * Invalid scope error - The requested scope is invalid, unknown, malformed, or
+	 * exceeds the scope granted by the resource owner.
 	 */
-	exports.OAuthErrorResponseSchema = z.object({
-	    error: z.string(),
-	    error_description: z.string().optional(),
-	    error_uri: z.string().optional()
-	});
+	class InvalidScopeError extends OAuthError {
+	}
+	errors$2.InvalidScopeError = InvalidScopeError;
+	InvalidScopeError.errorCode = 'invalid_scope';
 	/**
-	 * Optional version of SafeUrlSchema that allows empty string for retrocompatibility on tos_uri and logo_uri
+	 * Access denied error - The resource owner or authorization server denied the request.
 	 */
-	exports.OptionalSafeUrlSchema = exports.SafeUrlSchema.optional().or(z.literal('').transform(() => undefined));
+	class AccessDeniedError extends OAuthError {
+	}
+	errors$2.AccessDeniedError = AccessDeniedError;
+	AccessDeniedError.errorCode = 'access_denied';
 	/**
-	 * RFC 7591 OAuth 2.0 Dynamic Client Registration metadata
+	 * Server error - The authorization server encountered an unexpected condition
+	 * that prevented it from fulfilling the request.
 	 */
-	exports.OAuthClientMetadataSchema = z
-	    .object({
-	    redirect_uris: z.array(exports.SafeUrlSchema),
-	    token_endpoint_auth_method: z.string().optional(),
-	    grant_types: z.array(z.string()).optional(),
-	    response_types: z.array(z.string()).optional(),
-	    client_name: z.string().optional(),
-	    client_uri: exports.SafeUrlSchema.optional(),
-	    logo_uri: exports.OptionalSafeUrlSchema,
-	    scope: z.string().optional(),
-	    contacts: z.array(z.string()).optional(),
-	    tos_uri: exports.OptionalSafeUrlSchema,
-	    policy_uri: z.string().optional(),
-	    jwks_uri: exports.SafeUrlSchema.optional(),
-	    jwks: z.any().optional(),
-	    software_id: z.string().optional(),
-	    software_version: z.string().optional(),
-	    software_statement: z.string().optional()
-	})
-	    .strip();
+	class ServerError extends OAuthError {
+	}
+	errors$2.ServerError = ServerError;
+	ServerError.errorCode = 'server_error';
 	/**
-	 * RFC 7591 OAuth 2.0 Dynamic Client Registration client information
+	 * Temporarily unavailable error - The authorization server is currently unable to
+	 * handle the request due to a temporary overloading or maintenance of the server.
 	 */
-	exports.OAuthClientInformationSchema = z
-	    .object({
-	    client_id: z.string(),
-	    client_secret: z.string().optional(),
-	    client_id_issued_at: z.number().optional(),
-	    client_secret_expires_at: z.number().optional()
-	})
-	    .strip();
+	class TemporarilyUnavailableError extends OAuthError {
+	}
+	errors$2.TemporarilyUnavailableError = TemporarilyUnavailableError;
+	TemporarilyUnavailableError.errorCode = 'temporarily_unavailable';
 	/**
-	 * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
+	 * Unsupported response type error - The authorization server does not support
+	 * obtaining an authorization code using this method.
 	 */
-	exports.OAuthClientInformationFullSchema = exports.OAuthClientMetadataSchema.merge(exports.OAuthClientInformationSchema);
+	class UnsupportedResponseTypeError extends OAuthError {
+	}
+	errors$2.UnsupportedResponseTypeError = UnsupportedResponseTypeError;
+	UnsupportedResponseTypeError.errorCode = 'unsupported_response_type';
 	/**
-	 * RFC 7591 OAuth 2.0 Dynamic Client Registration error response
+	 * Unsupported token type error - The authorization server does not support
+	 * the requested token type.
 	 */
-	exports.OAuthClientRegistrationErrorSchema = z
-	    .object({
-	    error: z.string(),
-	    error_description: z.string().optional()
-	})
-	    .strip();
+	class UnsupportedTokenTypeError extends OAuthError {
+	}
+	errors$2.UnsupportedTokenTypeError = UnsupportedTokenTypeError;
+	UnsupportedTokenTypeError.errorCode = 'unsupported_token_type';
 	/**
-	 * RFC 7009 OAuth 2.0 Token Revocation request
+	 * Invalid token error - The access token provided is expired, revoked, malformed,
+	 * or invalid for other reasons.
 	 */
-	exports.OAuthTokenRevocationRequestSchema = z
-	    .object({
-	    token: z.string(),
-	    token_type_hint: z.string().optional()
-	})
-	    .strip();
-	
-} (auth$1));
-
-var authUtils = {};
-
-/**
- * Utilities for handling OAuth resource URIs.
- */
-Object.defineProperty(authUtils, "__esModule", { value: true });
-authUtils.resourceUrlFromServerUrl = resourceUrlFromServerUrl;
-authUtils.checkResourceAllowed = checkResourceAllowed;
-/**
- * Converts a server URL to a resource URL by removing the fragment.
- * RFC 8707 section 2 states that resource URIs "MUST NOT include a fragment component".
- * Keeps everything else unchanged (scheme, domain, port, path, query).
- */
-function resourceUrlFromServerUrl(url) {
-    const resourceURL = typeof url === 'string' ? new URL(url) : new URL(url.href);
-    resourceURL.hash = ''; // Remove fragment
-    return resourceURL;
-}
-/**
- * Checks if a requested resource URL matches a configured resource URL.
- * A requested resource matches if it has the same scheme, domain, port,
- * and its path starts with the configured resource's path.
- *
- * @param requestedResource The resource URL being requested
- * @param configuredResource The resource URL that has been configured
- * @returns true if the requested resource matches the configured resource, false otherwise
- */
-function checkResourceAllowed({ requestedResource, configuredResource }) {
-    const requested = typeof requestedResource === 'string' ? new URL(requestedResource) : new URL(requestedResource.href);
-    const configured = typeof configuredResource === 'string' ? new URL(configuredResource) : new URL(configuredResource.href);
-    // Compare the origin (scheme, domain, and port)
-    if (requested.origin !== configured.origin) {
-        return false;
-    }
-    // Handle cases like requested=/foo and configured=/foo/
-    if (requested.pathname.length < configured.pathname.length) {
-        return false;
-    }
-    // Check if the requested path starts with the configured path
-    // Ensure both paths end with / for proper comparison
-    // This ensures that if we have paths like "/api" and "/api/users",
-    // we properly detect that "/api/users" is a subpath of "/api"
-    // By adding a trailing slash if missing, we avoid false positives
-    // where paths like "/api123" would incorrectly match "/api"
-    const requestedPath = requested.pathname.endsWith('/') ? requested.pathname : requested.pathname + '/';
-    const configuredPath = configured.pathname.endsWith('/') ? configured.pathname : configured.pathname + '/';
-    return requestedPath.startsWith(configuredPath);
-}
-
-var errors$2 = {};
-
-Object.defineProperty(errors$2, "__esModule", { value: true });
-errors$2.OAUTH_ERRORS = errors$2.CustomOAuthError = errors$2.InvalidTargetError = errors$2.InsufficientScopeError = errors$2.InvalidClientMetadataError = errors$2.TooManyRequestsError = errors$2.MethodNotAllowedError = errors$2.InvalidTokenError = errors$2.UnsupportedTokenTypeError = errors$2.UnsupportedResponseTypeError = errors$2.TemporarilyUnavailableError = errors$2.ServerError = errors$2.AccessDeniedError = errors$2.InvalidScopeError = errors$2.UnsupportedGrantTypeError = errors$2.UnauthorizedClientError = errors$2.InvalidGrantError = errors$2.InvalidClientError = errors$2.InvalidRequestError = errors$2.OAuthError = void 0;
-/**
- * Base class for all OAuth errors
- */
-class OAuthError extends Error {
-    constructor(message, errorUri) {
-        super(message);
-        this.errorUri = errorUri;
-        this.name = this.constructor.name;
-    }
-    /**
-     * Converts the error to a standard OAuth error response object
-     */
-    toResponseObject() {
-        const response = {
-            error: this.errorCode,
-            error_description: this.message
-        };
-        if (this.errorUri) {
-            response.error_uri = this.errorUri;
-        }
-        return response;
-    }
-    get errorCode() {
-        return this.constructor.errorCode;
-    }
-}
-errors$2.OAuthError = OAuthError;
-/**
- * Invalid request error - The request is missing a required parameter,
- * includes an invalid parameter value, includes a parameter more than once,
- * or is otherwise malformed.
- */
-class InvalidRequestError extends OAuthError {
-}
-errors$2.InvalidRequestError = InvalidRequestError;
-InvalidRequestError.errorCode = 'invalid_request';
-/**
- * Invalid client error - Client authentication failed (e.g., unknown client, no client
- * authentication included, or unsupported authentication method).
- */
-class InvalidClientError extends OAuthError {
-}
-errors$2.InvalidClientError = InvalidClientError;
-InvalidClientError.errorCode = 'invalid_client';
-/**
- * Invalid grant error - The provided authorization grant or refresh token is
- * invalid, expired, revoked, does not match the redirection URI used in the
- * authorization request, or was issued to another client.
- */
-class InvalidGrantError extends OAuthError {
-}
-errors$2.InvalidGrantError = InvalidGrantError;
-InvalidGrantError.errorCode = 'invalid_grant';
-/**
- * Unauthorized client error - The authenticated client is not authorized to use
- * this authorization grant type.
- */
-class UnauthorizedClientError extends OAuthError {
-}
-errors$2.UnauthorizedClientError = UnauthorizedClientError;
-UnauthorizedClientError.errorCode = 'unauthorized_client';
-/**
- * Unsupported grant type error - The authorization grant type is not supported
- * by the authorization server.
- */
-class UnsupportedGrantTypeError extends OAuthError {
-}
-errors$2.UnsupportedGrantTypeError = UnsupportedGrantTypeError;
-UnsupportedGrantTypeError.errorCode = 'unsupported_grant_type';
-/**
- * Invalid scope error - The requested scope is invalid, unknown, malformed, or
- * exceeds the scope granted by the resource owner.
- */
-class InvalidScopeError extends OAuthError {
-}
-errors$2.InvalidScopeError = InvalidScopeError;
-InvalidScopeError.errorCode = 'invalid_scope';
-/**
- * Access denied error - The resource owner or authorization server denied the request.
- */
-class AccessDeniedError extends OAuthError {
-}
-errors$2.AccessDeniedError = AccessDeniedError;
-AccessDeniedError.errorCode = 'access_denied';
-/**
- * Server error - The authorization server encountered an unexpected condition
- * that prevented it from fulfilling the request.
- */
-class ServerError extends OAuthError {
-}
-errors$2.ServerError = ServerError;
-ServerError.errorCode = 'server_error';
-/**
- * Temporarily unavailable error - The authorization server is currently unable to
- * handle the request due to a temporary overloading or maintenance of the server.
- */
-class TemporarilyUnavailableError extends OAuthError {
-}
-errors$2.TemporarilyUnavailableError = TemporarilyUnavailableError;
-TemporarilyUnavailableError.errorCode = 'temporarily_unavailable';
-/**
- * Unsupported response type error - The authorization server does not support
- * obtaining an authorization code using this method.
- */
-class UnsupportedResponseTypeError extends OAuthError {
-}
-errors$2.UnsupportedResponseTypeError = UnsupportedResponseTypeError;
-UnsupportedResponseTypeError.errorCode = 'unsupported_response_type';
-/**
- * Unsupported token type error - The authorization server does not support
- * the requested token type.
- */
-class UnsupportedTokenTypeError extends OAuthError {
-}
-errors$2.UnsupportedTokenTypeError = UnsupportedTokenTypeError;
-UnsupportedTokenTypeError.errorCode = 'unsupported_token_type';
-/**
- * Invalid token error - The access token provided is expired, revoked, malformed,
- * or invalid for other reasons.
- */
-class InvalidTokenError extends OAuthError {
-}
-errors$2.InvalidTokenError = InvalidTokenError;
-InvalidTokenError.errorCode = 'invalid_token';
-/**
- * Method not allowed error - The HTTP method used is not allowed for this endpoint.
- * (Custom, non-standard error)
- */
-class MethodNotAllowedError extends OAuthError {
-}
-errors$2.MethodNotAllowedError = MethodNotAllowedError;
-MethodNotAllowedError.errorCode = 'method_not_allowed';
-/**
- * Too many requests error - Rate limit exceeded.
- * (Custom, non-standard error based on RFC 6585)
- */
-class TooManyRequestsError extends OAuthError {
-}
-errors$2.TooManyRequestsError = TooManyRequestsError;
-TooManyRequestsError.errorCode = 'too_many_requests';
-/**
- * Invalid client metadata error - The client metadata is invalid.
- * (Custom error for dynamic client registration - RFC 7591)
- */
-class InvalidClientMetadataError extends OAuthError {
-}
-errors$2.InvalidClientMetadataError = InvalidClientMetadataError;
-InvalidClientMetadataError.errorCode = 'invalid_client_metadata';
-/**
- * Insufficient scope error - The request requires higher privileges than provided by the access token.
- */
-class InsufficientScopeError extends OAuthError {
-}
-errors$2.InsufficientScopeError = InsufficientScopeError;
-InsufficientScopeError.errorCode = 'insufficient_scope';
-/**
- * Invalid target error - The requested resource is invalid, missing, unknown, or malformed.
- * (Custom error for resource indicators - RFC 8707)
- */
-class InvalidTargetError extends OAuthError {
-}
-errors$2.InvalidTargetError = InvalidTargetError;
-InvalidTargetError.errorCode = 'invalid_target';
-/**
- * A utility class for defining one-off error codes
- */
-class CustomOAuthError extends OAuthError {
-    constructor(customErrorCode, message, errorUri) {
-        super(message, errorUri);
-        this.customErrorCode = customErrorCode;
-    }
-    get errorCode() {
-        return this.customErrorCode;
-    }
-}
-errors$2.CustomOAuthError = CustomOAuthError;
-/**
- * A full list of all OAuthErrors, enabling parsing from error responses
- */
-errors$2.OAUTH_ERRORS = {
-    [InvalidRequestError.errorCode]: InvalidRequestError,
-    [InvalidClientError.errorCode]: InvalidClientError,
-    [InvalidGrantError.errorCode]: InvalidGrantError,
-    [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
-    [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
-    [InvalidScopeError.errorCode]: InvalidScopeError,
-    [AccessDeniedError.errorCode]: AccessDeniedError,
-    [ServerError.errorCode]: ServerError,
-    [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
-    [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
-    [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
-    [InvalidTokenError.errorCode]: InvalidTokenError,
-    [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
-    [TooManyRequestsError.errorCode]: TooManyRequestsError,
-    [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
-    [InsufficientScopeError.errorCode]: InsufficientScopeError,
-    [InvalidTargetError.errorCode]: InvalidTargetError
-};
-
-var __importDefault$2 = (commonjsGlobal && commonjsGlobal.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(auth$2, "__esModule", { value: true });
-auth$2.UnauthorizedError = void 0;
-auth$2.selectClientAuthMethod = selectClientAuthMethod;
-auth$2.parseErrorResponse = parseErrorResponse;
-auth$2.auth = auth;
-auth$2.isHttpsUrl = isHttpsUrl;
-auth$2.selectResourceURL = selectResourceURL;
-auth$2.extractWWWAuthenticateParams = extractWWWAuthenticateParams;
-auth$2.extractResourceMetadataUrl = extractResourceMetadataUrl;
-auth$2.discoverOAuthProtectedResourceMetadata = discoverOAuthProtectedResourceMetadata;
-auth$2.discoverOAuthMetadata = discoverOAuthMetadata;
-auth$2.buildDiscoveryUrls = buildDiscoveryUrls;
-auth$2.discoverAuthorizationServerMetadata = discoverAuthorizationServerMetadata;
-auth$2.discoverOAuthServerInfo = discoverOAuthServerInfo;
-auth$2.startAuthorization = startAuthorization;
-auth$2.prepareAuthorizationCodeRequest = prepareAuthorizationCodeRequest;
-auth$2.exchangeAuthorization = exchangeAuthorization;
-auth$2.refreshAuthorization = refreshAuthorization;
-auth$2.fetchToken = fetchToken;
-auth$2.registerClient = registerClient;
-const pkce_challenge_1 = __importDefault$2(require$$0$7);
-const types_js_1$5 = types$2;
-const auth_js_1$1 = auth$1;
-const auth_js_2 = auth$1;
-const auth_utils_js_1 = authUtils;
-const errors_js_1$1 = errors$2;
-class UnauthorizedError extends Error {
-    constructor(message) {
-        super(message ?? 'Unauthorized');
-    }
-}
-auth$2.UnauthorizedError = UnauthorizedError;
-function isClientAuthMethod(method) {
-    return ['client_secret_basic', 'client_secret_post', 'none'].includes(method);
-}
-const AUTHORIZATION_CODE_RESPONSE_TYPE = 'code';
-const AUTHORIZATION_CODE_CHALLENGE_METHOD = 'S256';
-/**
- * Determines the best client authentication method to use based on server support and client configuration.
- *
- * Priority order (highest to lowest):
- * 1. client_secret_basic (if client secret is available)
- * 2. client_secret_post (if client secret is available)
- * 3. none (for public clients)
- *
- * @param clientInformation - OAuth client information containing credentials
- * @param supportedMethods - Authentication methods supported by the authorization server
- * @returns The selected authentication method
- */
-function selectClientAuthMethod(clientInformation, supportedMethods) {
-    const hasClientSecret = clientInformation.client_secret !== undefined;
-    // Prefer the method returned by the server during client registration, if valid.
-    // When server metadata is present we also require the method to be listed as supported;
-    // when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
-    if ('token_endpoint_auth_method' in clientInformation &&
-        clientInformation.token_endpoint_auth_method &&
-        isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
-        (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
-        return clientInformation.token_endpoint_auth_method;
-    }
-    // If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
-    // default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
-    // Basic authentication for clients with a secret, making it the safest default.
-    if (supportedMethods.length === 0) {
-        return hasClientSecret ? 'client_secret_basic' : 'none';
-    }
-    // Try methods in priority order (most secure first)
-    if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
-        return 'client_secret_basic';
-    }
-    if (hasClientSecret && supportedMethods.includes('client_secret_post')) {
-        return 'client_secret_post';
-    }
-    if (supportedMethods.includes('none')) {
-        return 'none';
-    }
-    // Fallback: use what we have
-    return hasClientSecret ? 'client_secret_post' : 'none';
-}
-/**
- * Applies client authentication to the request based on the specified method.
- *
- * Implements OAuth 2.1 client authentication methods:
- * - client_secret_basic: HTTP Basic authentication (RFC 6749 Section 2.3.1)
- * - client_secret_post: Credentials in request body (RFC 6749 Section 2.3.1)
- * - none: Public client authentication (RFC 6749 Section 2.1)
- *
- * @param method - The authentication method to use
- * @param clientInformation - OAuth client information containing credentials
- * @param headers - HTTP headers object to modify
- * @param params - URL search parameters to modify
- * @throws {Error} When required credentials are missing
- */
-function applyClientAuthentication(method, clientInformation, headers, params) {
-    const { client_id, client_secret } = clientInformation;
-    switch (method) {
-        case 'client_secret_basic':
-            applyBasicAuth(client_id, client_secret, headers);
-            return;
-        case 'client_secret_post':
-            applyPostAuth(client_id, client_secret, params);
-            return;
-        case 'none':
-            applyPublicAuth(client_id, params);
-            return;
-        default:
-            throw new Error(`Unsupported client authentication method: ${method}`);
-    }
-}
-/**
- * Applies HTTP Basic authentication (RFC 6749 Section 2.3.1)
- */
-function applyBasicAuth(clientId, clientSecret, headers) {
-    if (!clientSecret) {
-        throw new Error('client_secret_basic authentication requires a client_secret');
-    }
-    const credentials = btoa(`${clientId}:${clientSecret}`);
-    headers.set('Authorization', `Basic ${credentials}`);
-}
-/**
- * Applies POST body authentication (RFC 6749 Section 2.3.1)
- */
-function applyPostAuth(clientId, clientSecret, params) {
-    params.set('client_id', clientId);
-    if (clientSecret) {
-        params.set('client_secret', clientSecret);
-    }
-}
-/**
- * Applies public client authentication (RFC 6749 Section 2.1)
- */
-function applyPublicAuth(clientId, params) {
-    params.set('client_id', clientId);
-}
-/**
- * Parses an OAuth error response from a string or Response object.
- *
- * If the input is a standard OAuth2.0 error response, it will be parsed according to the spec
- * and an instance of the appropriate OAuthError subclass will be returned.
- * If parsing fails, it falls back to a generic ServerError that includes
- * the response status (if available) and original content.
- *
- * @param input - A Response object or string containing the error response
- * @returns A Promise that resolves to an OAuthError instance
- */
-async function parseErrorResponse(input) {
-    const statusCode = input instanceof Response ? input.status : undefined;
-    const body = input instanceof Response ? await input.text() : input;
-    try {
-        const result = auth_js_1$1.OAuthErrorResponseSchema.parse(JSON.parse(body));
-        const { error, error_description, error_uri } = result;
-        const errorClass = errors_js_1$1.OAUTH_ERRORS[error] || errors_js_1$1.ServerError;
-        return new errorClass(error_description || '', error_uri);
-    }
-    catch (error) {
-        // Not a valid OAuth error response, but try to inform the user of the raw data anyway
-        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}Invalid OAuth error response: ${error}. Raw body: ${body}`;
-        return new errors_js_1$1.ServerError(errorMessage);
-    }
-}
-/**
- * Orchestrates the full auth flow with a server.
- *
- * This can be used as a single entry point for all authorization functionality,
- * instead of linking together the other lower-level functions in this module.
- */
-async function auth(provider, options) {
-    try {
-        return await authInternal(provider, options);
-    }
-    catch (error) {
-        // Handle recoverable error types by invalidating credentials and retrying
-        if (error instanceof errors_js_1$1.InvalidClientError || error instanceof errors_js_1$1.UnauthorizedClientError) {
-            await provider.invalidateCredentials?.('all');
-            return await authInternal(provider, options);
-        }
-        else if (error instanceof errors_js_1$1.InvalidGrantError) {
-            await provider.invalidateCredentials?.('tokens');
-            return await authInternal(provider, options);
-        }
-        // Throw otherwise
-        throw error;
-    }
-}
-async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
-    // Check if the provider has cached discovery state to skip discovery
-    const cachedState = await provider.discoveryState?.();
-    let resourceMetadata;
-    let authorizationServerUrl;
-    let metadata;
-    // If resourceMetadataUrl is not provided, try to load it from cached state
-    // This handles browser redirects where the URL was saved before navigation
-    let effectiveResourceMetadataUrl = resourceMetadataUrl;
-    if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
-        effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
-    }
-    if (cachedState?.authorizationServerUrl) {
-        // Restore discovery state from cache
-        authorizationServerUrl = cachedState.authorizationServerUrl;
-        resourceMetadata = cachedState.resourceMetadata;
-        metadata =
-            cachedState.authorizationServerMetadata ?? (await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }));
-        // If resource metadata wasn't cached, try to fetch it for selectResourceURL
-        if (!resourceMetadata) {
-            try {
-                resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
-            }
-            catch {
-                // RFC 9728 not available — selectResourceURL will handle undefined
-            }
-        }
-        // Re-save if we enriched the cached state with missing metadata
-        if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
-            await provider.saveDiscoveryState?.({
-                authorizationServerUrl: String(authorizationServerUrl),
-                resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-                resourceMetadata,
-                authorizationServerMetadata: metadata
-            });
-        }
-    }
-    else {
-        // Full discovery via RFC 9728
-        const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
-        authorizationServerUrl = serverInfo.authorizationServerUrl;
-        metadata = serverInfo.authorizationServerMetadata;
-        resourceMetadata = serverInfo.resourceMetadata;
-        // Persist discovery state for future use
-        // TODO: resourceMetadataUrl is only populated when explicitly provided via options
-        // or loaded from cached state. The URL derived internally by
-        // discoverOAuthProtectedResourceMetadata() is not captured back here.
-        await provider.saveDiscoveryState?.({
-            authorizationServerUrl: String(authorizationServerUrl),
-            resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-            resourceMetadata,
-            authorizationServerMetadata: metadata
-        });
-    }
-    const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-    // Apply scope selection strategy (SEP-835):
-    // 1. WWW-Authenticate scope (passed via `scope` param)
-    // 2. PRM scopes_supported
-    // 3. Client metadata scope (user-configured fallback)
-    // The resolved scope is used consistently for both DCR and the authorization request.
-    const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
-    // Handle client registration if needed
-    let clientInformation = await Promise.resolve(provider.clientInformation());
-    if (!clientInformation) {
-        if (authorizationCode !== undefined) {
-            throw new Error('Existing OAuth client information is required when exchanging an authorization code');
-        }
-        const supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === true;
-        const clientMetadataUrl = provider.clientMetadataUrl;
-        if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) {
-            throw new errors_js_1$1.InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
-        }
-        const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
-        if (shouldUseUrlBasedClientId) {
-            // SEP-991: URL-based Client IDs
-            clientInformation = {
-                client_id: clientMetadataUrl
-            };
-            await provider.saveClientInformation?.(clientInformation);
-        }
-        else {
-            // Fallback to dynamic registration
-            if (!provider.saveClientInformation) {
-                throw new Error('OAuth client information must be saveable for dynamic registration');
-            }
-            const fullInformation = await registerClient(authorizationServerUrl, {
-                metadata,
-                clientMetadata: provider.clientMetadata,
-                scope: resolvedScope,
-                fetchFn
-            });
-            await provider.saveClientInformation(fullInformation);
-            clientInformation = fullInformation;
-        }
-    }
-    // Non-interactive flows (e.g., client_credentials, jwt-bearer) don't need a redirect URL
-    const nonInteractiveFlow = !provider.redirectUrl;
-    // Exchange authorization code for tokens, or fetch tokens directly for non-interactive flows
-    if (authorizationCode !== undefined || nonInteractiveFlow) {
-        const tokens = await fetchToken(provider, authorizationServerUrl, {
-            metadata,
-            resource,
-            authorizationCode,
-            fetchFn
-        });
-        await provider.saveTokens(tokens);
-        return 'AUTHORIZED';
-    }
-    const tokens = await provider.tokens();
-    // Handle token refresh or new authorization
-    if (tokens?.refresh_token) {
-        try {
-            // Attempt to refresh the token
-            const newTokens = await refreshAuthorization(authorizationServerUrl, {
-                metadata,
-                clientInformation,
-                refreshToken: tokens.refresh_token,
-                resource,
-                addClientAuthentication: provider.addClientAuthentication,
-                fetchFn
-            });
-            await provider.saveTokens(newTokens);
-            return 'AUTHORIZED';
-        }
-        catch (error) {
-            // If this is a ServerError, or an unknown type, log it out and try to continue. Otherwise, escalate so we can fix things and retry.
-            if (!(error instanceof errors_js_1$1.OAuthError) || error instanceof errors_js_1$1.ServerError) ;
-            else {
-                // Refresh failed for another reason, re-throw
-                throw error;
-            }
-        }
-    }
-    const state = provider.state ? await provider.state() : undefined;
-    // Start new authorization flow
-    const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
-        metadata,
-        clientInformation,
-        state,
-        redirectUrl: provider.redirectUrl,
-        scope: resolvedScope,
-        resource
-    });
-    await provider.saveCodeVerifier(codeVerifier);
-    await provider.redirectToAuthorization(authorizationUrl);
-    return 'REDIRECT';
-}
-/**
- * SEP-991: URL-based Client IDs
- * Validate that the client_id is a valid URL with https scheme
- */
-function isHttpsUrl(value) {
-    if (!value)
-        return false;
-    try {
-        const url = new URL(value);
-        return url.protocol === 'https:' && url.pathname !== '/';
-    }
-    catch {
-        return false;
-    }
-}
-async function selectResourceURL(serverUrl, provider, resourceMetadata) {
-    const defaultResource = (0, auth_utils_js_1.resourceUrlFromServerUrl)(serverUrl);
-    // If provider has custom validation, delegate to it
-    if (provider.validateResourceURL) {
-        return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
-    }
-    // Only include resource parameter when Protected Resource Metadata is present
-    if (!resourceMetadata) {
-        return undefined;
-    }
-    // Validate that the metadata's resource is compatible with our request
-    if (!(0, auth_utils_js_1.checkResourceAllowed)({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource })) {
-        throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
-    }
-    // Prefer the resource from metadata since it's what the server is telling us to request
-    return new URL(resourceMetadata.resource);
-}
-/**
- * Extract resource_metadata, scope, and error from WWW-Authenticate header.
- */
-function extractWWWAuthenticateParams(res) {
-    const authenticateHeader = res.headers.get('WWW-Authenticate');
-    if (!authenticateHeader) {
-        return {};
-    }
-    const [type, scheme] = authenticateHeader.split(' ');
-    if (type.toLowerCase() !== 'bearer' || !scheme) {
-        return {};
-    }
-    const resourceMetadataMatch = extractFieldFromWwwAuth(res, 'resource_metadata') || undefined;
-    let resourceMetadataUrl;
-    if (resourceMetadataMatch) {
-        try {
-            resourceMetadataUrl = new URL(resourceMetadataMatch);
-        }
-        catch {
-            // Ignore invalid URL
-        }
-    }
-    const scope = extractFieldFromWwwAuth(res, 'scope') || undefined;
-    const error = extractFieldFromWwwAuth(res, 'error') || undefined;
-    return {
-        resourceMetadataUrl,
-        scope,
-        error
-    };
-}
-/**
- * Extracts a specific field's value from the WWW-Authenticate header string.
- *
- * @param response The HTTP response object containing the headers.
- * @param fieldName The name of the field to extract (e.g., "realm", "nonce").
- * @returns The field value
- */
-function extractFieldFromWwwAuth(response, fieldName) {
-    const wwwAuthHeader = response.headers.get('WWW-Authenticate');
-    if (!wwwAuthHeader) {
-        return null;
-    }
-    const pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`);
-    const match = wwwAuthHeader.match(pattern);
-    if (match) {
-        // Pattern matches: field_name="value" or field_name=value (unquoted)
-        return match[1] || match[2];
-    }
-    return null;
-}
-/**
- * Extract resource_metadata from response header.
- * @deprecated Use `extractWWWAuthenticateParams` instead.
- */
-function extractResourceMetadataUrl(res) {
-    const authenticateHeader = res.headers.get('WWW-Authenticate');
-    if (!authenticateHeader) {
-        return undefined;
-    }
-    const [type, scheme] = authenticateHeader.split(' ');
-    if (type.toLowerCase() !== 'bearer' || !scheme) {
-        return undefined;
-    }
-    const regex = /resource_metadata="([^"]*)"/;
-    const match = regex.exec(authenticateHeader);
-    if (!match) {
-        return undefined;
-    }
-    try {
-        return new URL(match[1]);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Looks up RFC 9728 OAuth 2.0 Protected Resource Metadata.
- *
- * If the server returns a 404 for the well-known endpoint, this function will
- * return `undefined`. Any other errors will be thrown as exceptions.
- */
-async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
-    const response = await discoverMetadataWithFallback(serverUrl, 'oauth-protected-resource', fetchFn, {
-        protocolVersion: opts?.protocolVersion,
-        metadataUrl: opts?.resourceMetadataUrl
-    });
-    if (!response || response.status === 404) {
-        await response?.body?.cancel();
-        throw new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`);
-    }
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
-    }
-    return auth_js_2.OAuthProtectedResourceMetadataSchema.parse(await response.json());
-}
-/**
- * Helper function to handle fetch with CORS retry logic
- */
-async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
-    try {
-        return await fetchFn(url, { headers });
-    }
-    catch (error) {
-        if (error instanceof TypeError) {
-            if (headers) {
-                // CORS errors come back as TypeError, retry without headers
-                return fetchWithCorsRetry(url, undefined, fetchFn);
-            }
-            else {
-                // We're getting CORS errors on retry too, return undefined
-                return undefined;
-            }
-        }
-        throw error;
-    }
-}
-/**
- * Constructs the well-known path for auth-related metadata discovery
- */
-function buildWellKnownPath(wellKnownPrefix, pathname = '', options = {}) {
-    // Strip trailing slash from pathname to avoid double slashes
-    if (pathname.endsWith('/')) {
-        pathname = pathname.slice(0, -1);
-    }
-    return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
-}
-/**
- * Tries to discover OAuth metadata at a specific URL
- */
-async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
-    const headers = {
-        'MCP-Protocol-Version': protocolVersion
-    };
-    return await fetchWithCorsRetry(url, headers, fetchFn);
-}
-/**
- * Determines if fallback to root discovery should be attempted
- */
-function shouldAttemptFallback(response, pathname) {
-    return !response || (response.status >= 400 && response.status < 500 && pathname !== '/');
-}
-/**
- * Generic function for discovering OAuth metadata with fallback support
- */
-async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
-    const issuer = new URL(serverUrl);
-    const protocolVersion = opts?.protocolVersion ?? types_js_1$5.LATEST_PROTOCOL_VERSION;
-    let url;
-    if (opts?.metadataUrl) {
-        url = new URL(opts.metadataUrl);
-    }
-    else {
-        // Try path-aware discovery first
-        const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
-        url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
-        url.search = issuer.search;
-    }
-    let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
-    // If path-aware discovery fails with 404 and we're not already at root, try fallback to root discovery
-    if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
-        const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
-        response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
-    }
-    return response;
-}
-/**
- * Looks up RFC 8414 OAuth 2.0 Authorization Server Metadata.
- *
- * If the server returns a 404 for the well-known endpoint, this function will
- * return `undefined`. Any other errors will be thrown as exceptions.
- *
- * @deprecated This function is deprecated in favor of `discoverAuthorizationServerMetadata`.
- */
-async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}, fetchFn = fetch) {
-    if (typeof issuer === 'string') {
-        issuer = new URL(issuer);
-    }
-    if (!authorizationServerUrl) {
-        authorizationServerUrl = issuer;
-    }
-    if (typeof authorizationServerUrl === 'string') {
-        authorizationServerUrl = new URL(authorizationServerUrl);
-    }
-    protocolVersion ?? (protocolVersion = types_js_1$5.LATEST_PROTOCOL_VERSION);
-    const response = await discoverMetadataWithFallback(authorizationServerUrl, 'oauth-authorization-server', fetchFn, {
-        protocolVersion,
-        metadataServerUrl: authorizationServerUrl
-    });
-    if (!response || response.status === 404) {
-        await response?.body?.cancel();
-        return undefined;
-    }
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new Error(`HTTP ${response.status} trying to load well-known OAuth metadata`);
-    }
-    return auth_js_2.OAuthMetadataSchema.parse(await response.json());
-}
-/**
- * Builds a list of discovery URLs to try for authorization server metadata.
- * URLs are returned in priority order:
- * 1. OAuth metadata at the given URL
- * 2. OIDC metadata endpoints at the given URL
- */
-function buildDiscoveryUrls(authorizationServerUrl) {
-    const url = typeof authorizationServerUrl === 'string' ? new URL(authorizationServerUrl) : authorizationServerUrl;
-    const hasPath = url.pathname !== '/';
-    const urlsToTry = [];
-    if (!hasPath) {
-        // Root path: https://example.com/.well-known/oauth-authorization-server
-        urlsToTry.push({
-            url: new URL('/.well-known/oauth-authorization-server', url.origin),
-            type: 'oauth'
-        });
-        // OIDC: https://example.com/.well-known/openid-configuration
-        urlsToTry.push({
-            url: new URL(`/.well-known/openid-configuration`, url.origin),
-            type: 'oidc'
-        });
-        return urlsToTry;
-    }
-    // Strip trailing slash from pathname to avoid double slashes
-    let pathname = url.pathname;
-    if (pathname.endsWith('/')) {
-        pathname = pathname.slice(0, -1);
-    }
-    // 1. OAuth metadata at the given URL
-    // Insert well-known before the path: https://example.com/.well-known/oauth-authorization-server/tenant1
-    urlsToTry.push({
-        url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url.origin),
-        type: 'oauth'
-    });
-    // 2. OIDC metadata endpoints
-    // RFC 8414 style: Insert /.well-known/openid-configuration before the path
-    urlsToTry.push({
-        url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
-        type: 'oidc'
-    });
-    // OIDC Discovery 1.0 style: Append /.well-known/openid-configuration after the path
-    urlsToTry.push({
-        url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
-        type: 'oidc'
-    });
-    return urlsToTry;
-}
-/**
- * Discovers authorization server metadata with support for RFC 8414 OAuth 2.0 Authorization Server Metadata
- * and OpenID Connect Discovery 1.0 specifications.
- *
- * This function implements a fallback strategy for authorization server discovery:
- * 1. Attempts RFC 8414 OAuth metadata discovery first
- * 2. If OAuth discovery fails, falls back to OpenID Connect Discovery
- *
- * @param authorizationServerUrl - The authorization server URL obtained from the MCP Server's
- *                                 protected resource metadata, or the MCP server's URL if the
- *                                 metadata was not found.
- * @param options - Configuration options
- * @param options.fetchFn - Optional fetch function for making HTTP requests, defaults to global fetch
- * @param options.protocolVersion - MCP protocol version to use, defaults to LATEST_PROTOCOL_VERSION
- * @returns Promise resolving to authorization server metadata, or undefined if discovery fails
- */
-async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = types_js_1$5.LATEST_PROTOCOL_VERSION } = {}) {
-    const headers = {
-        'MCP-Protocol-Version': protocolVersion,
-        Accept: 'application/json'
-    };
-    // Get the list of URLs to try
-    const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
-    // Try each URL in order
-    for (const { url: endpointUrl, type } of urlsToTry) {
-        const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
-        if (!response) {
-            /**
-             * CORS error occurred - don't throw as the endpoint may not allow CORS,
-             * continue trying other possible endpoints
-             */
-            continue;
-        }
-        if (!response.ok) {
-            await response.body?.cancel();
-            // Continue looking for any 4xx response code.
-            if (response.status >= 400 && response.status < 500) {
-                continue; // Try next URL
-            }
-            throw new Error(`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`);
-        }
-        // Parse and validate based on type
-        if (type === 'oauth') {
-            return auth_js_2.OAuthMetadataSchema.parse(await response.json());
-        }
-        else {
-            return auth_js_1$1.OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
-        }
-    }
-    return undefined;
-}
-/**
- * Discovers the authorization server for an MCP server following
- * {@link https://datatracker.ietf.org/doc/html/rfc9728 | RFC 9728} (OAuth 2.0 Protected
- * Resource Metadata), with fallback to treating the server URL as the
- * authorization server.
- *
- * This function combines two discovery steps into one call:
- * 1. Probes `/.well-known/oauth-protected-resource` on the MCP server to find the
- *    authorization server URL (RFC 9728).
- * 2. Fetches authorization server metadata from that URL (RFC 8414 / OpenID Connect Discovery).
- *
- * Use this when you need the authorization server metadata for operations outside the
- * {@linkcode auth} orchestrator, such as token refresh or token revocation.
- *
- * @param serverUrl - The MCP resource server URL
- * @param opts - Optional configuration
- * @param opts.resourceMetadataUrl - Override URL for the protected resource metadata endpoint
- * @param opts.fetchFn - Custom fetch function for HTTP requests
- * @returns Authorization server URL, metadata, and resource metadata (if available)
- */
-async function discoverOAuthServerInfo(serverUrl, opts) {
-    let resourceMetadata;
-    let authorizationServerUrl;
-    try {
-        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
-        if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
-            authorizationServerUrl = resourceMetadata.authorization_servers[0];
-        }
-    }
-    catch {
-        // RFC 9728 not supported -- fall back to treating the server URL as the authorization server
-    }
-    // If we don't get a valid authorization server from protected resource metadata,
-    // fall back to the legacy MCP spec behavior: MCP server base URL acts as the authorization server
-    if (!authorizationServerUrl) {
-        authorizationServerUrl = String(new URL('/', serverUrl));
-    }
-    const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
-    return {
-        authorizationServerUrl,
-        authorizationServerMetadata,
-        resourceMetadata
-    };
-}
-/**
- * Begins the authorization flow with the given server, by generating a PKCE challenge and constructing the authorization URL.
- */
-async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
-    let authorizationUrl;
-    if (metadata) {
-        authorizationUrl = new URL(metadata.authorization_endpoint);
-        if (!metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE)) {
-            throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
-        }
-        if (metadata.code_challenge_methods_supported &&
-            !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD)) {
-            throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
-        }
-    }
-    else {
-        authorizationUrl = new URL('/authorize', authorizationServerUrl);
-    }
-    // Generate PKCE challenge
-    const challenge = await (0, pkce_challenge_1.default)();
-    const codeVerifier = challenge.code_verifier;
-    const codeChallenge = challenge.code_challenge;
-    authorizationUrl.searchParams.set('response_type', AUTHORIZATION_CODE_RESPONSE_TYPE);
-    authorizationUrl.searchParams.set('client_id', clientInformation.client_id);
-    authorizationUrl.searchParams.set('code_challenge', codeChallenge);
-    authorizationUrl.searchParams.set('code_challenge_method', AUTHORIZATION_CODE_CHALLENGE_METHOD);
-    authorizationUrl.searchParams.set('redirect_uri', String(redirectUrl));
-    if (state) {
-        authorizationUrl.searchParams.set('state', state);
-    }
-    if (scope) {
-        authorizationUrl.searchParams.set('scope', scope);
-    }
-    if (scope?.includes('offline_access')) {
-        // if the request includes the OIDC-only "offline_access" scope,
-        // we need to set the prompt to "consent" to ensure the user is prompted to grant offline access
-        // https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
-        authorizationUrl.searchParams.append('prompt', 'consent');
-    }
-    if (resource) {
-        authorizationUrl.searchParams.set('resource', resource.href);
-    }
-    return { authorizationUrl, codeVerifier };
-}
-/**
- * Prepares token request parameters for an authorization code exchange.
- *
- * This is the default implementation used by fetchToken when the provider
- * doesn't implement prepareTokenRequest.
- *
- * @param authorizationCode - The authorization code received from the authorization endpoint
- * @param codeVerifier - The PKCE code verifier
- * @param redirectUri - The redirect URI used in the authorization request
- * @returns URLSearchParams for the authorization_code grant
- */
-function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
-    return new URLSearchParams({
-        grant_type: 'authorization_code',
-        code: authorizationCode,
-        code_verifier: codeVerifier,
-        redirect_uri: String(redirectUri)
-    });
-}
-/**
- * Internal helper to execute a token request with the given parameters.
- * Used by exchangeAuthorization, refreshAuthorization, and fetchToken.
- */
-async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
-    const tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL('/token', authorizationServerUrl);
-    const headers = new Headers({
-        'Content-Type': 'application/x-www-form-urlencoded',
-        Accept: 'application/json'
-    });
-    if (resource) {
-        tokenRequestParams.set('resource', resource.href);
-    }
-    if (addClientAuthentication) {
-        await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
-    }
-    else if (clientInformation) {
-        const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
-        const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
-        applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
-    }
-    const response = await (fetchFn ?? fetch)(tokenUrl, {
-        method: 'POST',
-        headers,
-        body: tokenRequestParams
-    });
-    if (!response.ok) {
-        throw await parseErrorResponse(response);
-    }
-    return auth_js_2.OAuthTokensSchema.parse(await response.json());
-}
-/**
- * Exchanges an authorization code for an access token with the given server.
- *
- * Supports multiple client authentication methods as specified in OAuth 2.1:
- * - Automatically selects the best authentication method based on server support
- * - Falls back to appropriate defaults when server metadata is unavailable
- *
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration object containing client info, auth code, etc.
- * @returns Promise resolving to OAuth tokens
- * @throws {Error} When token exchange fails or authentication is invalid
- */
-async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
-    const tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri);
-    return executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation,
-        addClientAuthentication,
-        resource,
-        fetchFn
-    });
-}
-/**
- * Exchange a refresh token for an updated access token.
- *
- * Supports multiple client authentication methods as specified in OAuth 2.1:
- * - Automatically selects the best authentication method based on server support
- * - Preserves the original refresh token if a new one is not returned
- *
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration object containing client info, refresh token, etc.
- * @returns Promise resolving to OAuth tokens (preserves original refresh_token if not replaced)
- * @throws {Error} When token refresh fails or authentication is invalid
- */
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
-    const tokenRequestParams = new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken
-    });
-    const tokens = await executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation,
-        addClientAuthentication,
-        resource,
-        fetchFn
-    });
-    // Preserve original refresh token if server didn't return a new one
-    return { refresh_token: refreshToken, ...tokens };
-}
-/**
- * Unified token fetching that works with any grant type via provider.prepareTokenRequest().
- *
- * This function provides a single entry point for obtaining tokens regardless of the
- * OAuth grant type. The provider's prepareTokenRequest() method determines which grant
- * to use and supplies the grant-specific parameters.
- *
- * @param provider - OAuth client provider that implements prepareTokenRequest()
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration for the token request
- * @returns Promise resolving to OAuth tokens
- * @throws {Error} When provider doesn't implement prepareTokenRequest or token fetch fails
- *
- * @example
- * // Provider for client_credentials:
- * class MyProvider implements OAuthClientProvider {
- *   prepareTokenRequest(scope) {
- *     const params = new URLSearchParams({ grant_type: 'client_credentials' });
- *     if (scope) params.set('scope', scope);
- *     return params;
- *   }
- *   // ... other methods
- * }
- *
- * const tokens = await fetchToken(provider, authServerUrl, { metadata });
- */
-async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
-    const scope = provider.clientMetadata.scope;
-    // Use provider's prepareTokenRequest if available, otherwise fall back to authorization_code
-    let tokenRequestParams;
-    if (provider.prepareTokenRequest) {
-        tokenRequestParams = await provider.prepareTokenRequest(scope);
-    }
-    // Default to authorization_code grant if no custom prepareTokenRequest
-    if (!tokenRequestParams) {
-        if (!authorizationCode) {
-            throw new Error('Either provider.prepareTokenRequest() or authorizationCode is required');
-        }
-        if (!provider.redirectUrl) {
-            throw new Error('redirectUrl is required for authorization_code flow');
-        }
-        const codeVerifier = await provider.codeVerifier();
-        tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
-    }
-    const clientInformation = await provider.clientInformation();
-    return executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation: clientInformation ?? undefined,
-        addClientAuthentication: provider.addClientAuthentication,
-        resource,
-        fetchFn
-    });
+	class InvalidTokenError extends OAuthError {
+	}
+	errors$2.InvalidTokenError = InvalidTokenError;
+	InvalidTokenError.errorCode = 'invalid_token';
+	/**
+	 * Method not allowed error - The HTTP method used is not allowed for this endpoint.
+	 * (Custom, non-standard error)
+	 */
+	class MethodNotAllowedError extends OAuthError {
+	}
+	errors$2.MethodNotAllowedError = MethodNotAllowedError;
+	MethodNotAllowedError.errorCode = 'method_not_allowed';
+	/**
+	 * Too many requests error - Rate limit exceeded.
+	 * (Custom, non-standard error based on RFC 6585)
+	 */
+	class TooManyRequestsError extends OAuthError {
+	}
+	errors$2.TooManyRequestsError = TooManyRequestsError;
+	TooManyRequestsError.errorCode = 'too_many_requests';
+	/**
+	 * Invalid client metadata error - The client metadata is invalid.
+	 * (Custom error for dynamic client registration - RFC 7591)
+	 */
+	class InvalidClientMetadataError extends OAuthError {
+	}
+	errors$2.InvalidClientMetadataError = InvalidClientMetadataError;
+	InvalidClientMetadataError.errorCode = 'invalid_client_metadata';
+	/**
+	 * Insufficient scope error - The request requires higher privileges than provided by the access token.
+	 */
+	class InsufficientScopeError extends OAuthError {
+	}
+	errors$2.InsufficientScopeError = InsufficientScopeError;
+	InsufficientScopeError.errorCode = 'insufficient_scope';
+	/**
+	 * Invalid target error - The requested resource is invalid, missing, unknown, or malformed.
+	 * (Custom error for resource indicators - RFC 8707)
+	 */
+	class InvalidTargetError extends OAuthError {
+	}
+	errors$2.InvalidTargetError = InvalidTargetError;
+	InvalidTargetError.errorCode = 'invalid_target';
+	/**
+	 * A utility class for defining one-off error codes
+	 */
+	class CustomOAuthError extends OAuthError {
+	    constructor(customErrorCode, message, errorUri) {
+	        super(message, errorUri);
+	        this.customErrorCode = customErrorCode;
+	    }
+	    get errorCode() {
+	        return this.customErrorCode;
+	    }
+	}
+	errors$2.CustomOAuthError = CustomOAuthError;
+	/**
+	 * A full list of all OAuthErrors, enabling parsing from error responses
+	 */
+	errors$2.OAUTH_ERRORS = {
+	    [InvalidRequestError.errorCode]: InvalidRequestError,
+	    [InvalidClientError.errorCode]: InvalidClientError,
+	    [InvalidGrantError.errorCode]: InvalidGrantError,
+	    [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+	    [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+	    [InvalidScopeError.errorCode]: InvalidScopeError,
+	    [AccessDeniedError.errorCode]: AccessDeniedError,
+	    [ServerError.errorCode]: ServerError,
+	    [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+	    [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+	    [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+	    [InvalidTokenError.errorCode]: InvalidTokenError,
+	    [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+	    [TooManyRequestsError.errorCode]: TooManyRequestsError,
+	    [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+	    [InsufficientScopeError.errorCode]: InsufficientScopeError,
+	    [InvalidTargetError.errorCode]: InvalidTargetError
+	};
+	
+	return errors$2;
 }
-/**
- * Performs OAuth 2.0 Dynamic Client Registration according to RFC 7591.
- *
- * If `scope` is provided, it overrides `clientMetadata.scope` in the registration
- * request body. This allows callers to apply the Scope Selection Strategy (SEP-835)
- * consistently across both DCR and the subsequent authorization request.
- */
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
-    let registrationUrl;
-    if (metadata) {
-        if (!metadata.registration_endpoint) {
-            throw new Error('Incompatible auth server: does not support dynamic client registration');
-        }
-        registrationUrl = new URL(metadata.registration_endpoint);
-    }
-    else {
-        registrationUrl = new URL('/register', authorizationServerUrl);
-    }
-    const response = await (fetchFn ?? fetch)(registrationUrl, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json'
-        },
-        body: JSON.stringify({
-            ...clientMetadata,
-            ...(scope !== undefined ? { scope } : {})
-        })
-    });
-    if (!response.ok) {
-        throw await parseErrorResponse(response);
-    }
-    return auth_js_2.OAuthClientInformationFullSchema.parse(await response.json());
+
+var hasRequiredAuth;
+
+function requireAuth () {
+	if (hasRequiredAuth) return auth$1;
+	hasRequiredAuth = 1;
+	var __importDefault = (commonjsGlobal && commonjsGlobal.__importDefault) || function (mod) {
+	    return (mod && mod.__esModule) ? mod : { "default": mod };
+	};
+	Object.defineProperty(auth$1, "__esModule", { value: true });
+	auth$1.UnauthorizedError = void 0;
+	auth$1.selectClientAuthMethod = selectClientAuthMethod;
+	auth$1.parseErrorResponse = parseErrorResponse;
+	auth$1.auth = auth;
+	auth$1.isHttpsUrl = isHttpsUrl;
+	auth$1.selectResourceURL = selectResourceURL;
+	auth$1.extractWWWAuthenticateParams = extractWWWAuthenticateParams;
+	auth$1.extractResourceMetadataUrl = extractResourceMetadataUrl;
+	auth$1.discoverOAuthProtectedResourceMetadata = discoverOAuthProtectedResourceMetadata;
+	auth$1.discoverOAuthMetadata = discoverOAuthMetadata;
+	auth$1.buildDiscoveryUrls = buildDiscoveryUrls;
+	auth$1.discoverAuthorizationServerMetadata = discoverAuthorizationServerMetadata;
+	auth$1.discoverOAuthServerInfo = discoverOAuthServerInfo;
+	auth$1.startAuthorization = startAuthorization;
+	auth$1.prepareAuthorizationCodeRequest = prepareAuthorizationCodeRequest;
+	auth$1.exchangeAuthorization = exchangeAuthorization;
+	auth$1.refreshAuthorization = refreshAuthorization;
+	auth$1.fetchToken = fetchToken;
+	auth$1.registerClient = registerClient;
+	const pkce_challenge_1 = __importDefault(require$$0$7);
+	const types_js_1 = types$2;
+	const auth_js_1 = requireAuth$1();
+	const auth_js_2 = requireAuth$1();
+	const auth_utils_js_1 = requireAuthUtils();
+	const errors_js_1 = requireErrors$1();
+	class UnauthorizedError extends Error {
+	    constructor(message) {
+	        super(message ?? 'Unauthorized');
+	    }
+	}
+	auth$1.UnauthorizedError = UnauthorizedError;
+	function isClientAuthMethod(method) {
+	    return ['client_secret_basic', 'client_secret_post', 'none'].includes(method);
+	}
+	const AUTHORIZATION_CODE_RESPONSE_TYPE = 'code';
+	const AUTHORIZATION_CODE_CHALLENGE_METHOD = 'S256';
+	/**
+	 * Determines the best client authentication method to use based on server support and client configuration.
+	 *
+	 * Priority order (highest to lowest):
+	 * 1. client_secret_basic (if client secret is available)
+	 * 2. client_secret_post (if client secret is available)
+	 * 3. none (for public clients)
+	 *
+	 * @param clientInformation - OAuth client information containing credentials
+	 * @param supportedMethods - Authentication methods supported by the authorization server
+	 * @returns The selected authentication method
+	 */
+	function selectClientAuthMethod(clientInformation, supportedMethods) {
+	    const hasClientSecret = clientInformation.client_secret !== undefined;
+	    // Prefer the method returned by the server during client registration, if valid.
+	    // When server metadata is present we also require the method to be listed as supported;
+	    // when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
+	    if ('token_endpoint_auth_method' in clientInformation &&
+	        clientInformation.token_endpoint_auth_method &&
+	        isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
+	        (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
+	        return clientInformation.token_endpoint_auth_method;
+	    }
+	    // If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
+	    // default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
+	    // Basic authentication for clients with a secret, making it the safest default.
+	    if (supportedMethods.length === 0) {
+	        return hasClientSecret ? 'client_secret_basic' : 'none';
+	    }
+	    // Try methods in priority order (most secure first)
+	    if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
+	        return 'client_secret_basic';
+	    }
+	    if (hasClientSecret && supportedMethods.includes('client_secret_post')) {
+	        return 'client_secret_post';
+	    }
+	    if (supportedMethods.includes('none')) {
+	        return 'none';
+	    }
+	    // Fallback: use what we have
+	    return hasClientSecret ? 'client_secret_post' : 'none';
+	}
+	/**
+	 * Applies client authentication to the request based on the specified method.
+	 *
+	 * Implements OAuth 2.1 client authentication methods:
+	 * - client_secret_basic: HTTP Basic authentication (RFC 6749 Section 2.3.1)
+	 * - client_secret_post: Credentials in request body (RFC 6749 Section 2.3.1)
+	 * - none: Public client authentication (RFC 6749 Section 2.1)
+	 *
+	 * @param method - The authentication method to use
+	 * @param clientInformation - OAuth client information containing credentials
+	 * @param headers - HTTP headers object to modify
+	 * @param params - URL search parameters to modify
+	 * @throws {Error} When required credentials are missing
+	 */
+	function applyClientAuthentication(method, clientInformation, headers, params) {
+	    const { client_id, client_secret } = clientInformation;
+	    switch (method) {
+	        case 'client_secret_basic':
+	            applyBasicAuth(client_id, client_secret, headers);
+	            return;
+	        case 'client_secret_post':
+	            applyPostAuth(client_id, client_secret, params);
+	            return;
+	        case 'none':
+	            applyPublicAuth(client_id, params);
+	            return;
+	        default:
+	            throw new Error(`Unsupported client authentication method: ${method}`);
+	    }
+	}
+	/**
+	 * Applies HTTP Basic authentication (RFC 6749 Section 2.3.1)
+	 */
+	function applyBasicAuth(clientId, clientSecret, headers) {
+	    if (!clientSecret) {
+	        throw new Error('client_secret_basic authentication requires a client_secret');
+	    }
+	    const credentials = btoa(`${clientId}:${clientSecret}`);
+	    headers.set('Authorization', `Basic ${credentials}`);
+	}
+	/**
+	 * Applies POST body authentication (RFC 6749 Section 2.3.1)
+	 */
+	function applyPostAuth(clientId, clientSecret, params) {
+	    params.set('client_id', clientId);
+	    if (clientSecret) {
+	        params.set('client_secret', clientSecret);
+	    }
+	}
+	/**
+	 * Applies public client authentication (RFC 6749 Section 2.1)
+	 */
+	function applyPublicAuth(clientId, params) {
+	    params.set('client_id', clientId);
+	}
+	/**
+	 * Parses an OAuth error response from a string or Response object.
+	 *
+	 * If the input is a standard OAuth2.0 error response, it will be parsed according to the spec
+	 * and an instance of the appropriate OAuthError subclass will be returned.
+	 * If parsing fails, it falls back to a generic ServerError that includes
+	 * the response status (if available) and original content.
+	 *
+	 * @param input - A Response object or string containing the error response
+	 * @returns A Promise that resolves to an OAuthError instance
+	 */
+	async function parseErrorResponse(input) {
+	    const statusCode = input instanceof Response ? input.status : undefined;
+	    const body = input instanceof Response ? await input.text() : input;
+	    try {
+	        const result = auth_js_1.OAuthErrorResponseSchema.parse(JSON.parse(body));
+	        const { error, error_description, error_uri } = result;
+	        const errorClass = errors_js_1.OAUTH_ERRORS[error] || errors_js_1.ServerError;
+	        return new errorClass(error_description || '', error_uri);
+	    }
+	    catch (error) {
+	        // Not a valid OAuth error response, but try to inform the user of the raw data anyway
+	        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}Invalid OAuth error response: ${error}. Raw body: ${body}`;
+	        return new errors_js_1.ServerError(errorMessage);
+	    }
+	}
+	/**
+	 * Orchestrates the full auth flow with a server.
+	 *
+	 * This can be used as a single entry point for all authorization functionality,
+	 * instead of linking together the other lower-level functions in this module.
+	 */
+	async function auth(provider, options) {
+	    try {
+	        return await authInternal(provider, options);
+	    }
+	    catch (error) {
+	        // Handle recoverable error types by invalidating credentials and retrying
+	        if (error instanceof errors_js_1.InvalidClientError || error instanceof errors_js_1.UnauthorizedClientError) {
+	            await provider.invalidateCredentials?.('all');
+	            return await authInternal(provider, options);
+	        }
+	        else if (error instanceof errors_js_1.InvalidGrantError) {
+	            await provider.invalidateCredentials?.('tokens');
+	            return await authInternal(provider, options);
+	        }
+	        // Throw otherwise
+	        throw error;
+	    }
+	}
+	async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
+	    // Check if the provider has cached discovery state to skip discovery
+	    const cachedState = await provider.discoveryState?.();
+	    let resourceMetadata;
+	    let authorizationServerUrl;
+	    let metadata;
+	    // If resourceMetadataUrl is not provided, try to load it from cached state
+	    // This handles browser redirects where the URL was saved before navigation
+	    let effectiveResourceMetadataUrl = resourceMetadataUrl;
+	    if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
+	        effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
+	    }
+	    if (cachedState?.authorizationServerUrl) {
+	        // Restore discovery state from cache
+	        authorizationServerUrl = cachedState.authorizationServerUrl;
+	        resourceMetadata = cachedState.resourceMetadata;
+	        metadata =
+	            cachedState.authorizationServerMetadata ?? (await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }));
+	        // If resource metadata wasn't cached, try to fetch it for selectResourceURL
+	        if (!resourceMetadata) {
+	            try {
+	                resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
+	            }
+	            catch {
+	                // RFC 9728 not available — selectResourceURL will handle undefined
+	            }
+	        }
+	        // Re-save if we enriched the cached state with missing metadata
+	        if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
+	            await provider.saveDiscoveryState?.({
+	                authorizationServerUrl: String(authorizationServerUrl),
+	                resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+	                resourceMetadata,
+	                authorizationServerMetadata: metadata
+	            });
+	        }
+	    }
+	    else {
+	        // Full discovery via RFC 9728
+	        const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
+	        authorizationServerUrl = serverInfo.authorizationServerUrl;
+	        metadata = serverInfo.authorizationServerMetadata;
+	        resourceMetadata = serverInfo.resourceMetadata;
+	        // Persist discovery state for future use
+	        // TODO: resourceMetadataUrl is only populated when explicitly provided via options
+	        // or loaded from cached state. The URL derived internally by
+	        // discoverOAuthProtectedResourceMetadata() is not captured back here.
+	        await provider.saveDiscoveryState?.({
+	            authorizationServerUrl: String(authorizationServerUrl),
+	            resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
+	            resourceMetadata,
+	            authorizationServerMetadata: metadata
+	        });
+	    }
+	    const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+	    // Apply scope selection strategy (SEP-835):
+	    // 1. WWW-Authenticate scope (passed via `scope` param)
+	    // 2. PRM scopes_supported
+	    // 3. Client metadata scope (user-configured fallback)
+	    // The resolved scope is used consistently for both DCR and the authorization request.
+	    const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
+	    // Handle client registration if needed
+	    let clientInformation = await Promise.resolve(provider.clientInformation());
+	    if (!clientInformation) {
+	        if (authorizationCode !== undefined) {
+	            throw new Error('Existing OAuth client information is required when exchanging an authorization code');
+	        }
+	        const supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === true;
+	        const clientMetadataUrl = provider.clientMetadataUrl;
+	        if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) {
+	            throw new errors_js_1.InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
+	        }
+	        const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
+	        if (shouldUseUrlBasedClientId) {
+	            // SEP-991: URL-based Client IDs
+	            clientInformation = {
+	                client_id: clientMetadataUrl
+	            };
+	            await provider.saveClientInformation?.(clientInformation);
+	        }
+	        else {
+	            // Fallback to dynamic registration
+	            if (!provider.saveClientInformation) {
+	                throw new Error('OAuth client information must be saveable for dynamic registration');
+	            }
+	            const fullInformation = await registerClient(authorizationServerUrl, {
+	                metadata,
+	                clientMetadata: provider.clientMetadata,
+	                scope: resolvedScope,
+	                fetchFn
+	            });
+	            await provider.saveClientInformation(fullInformation);
+	            clientInformation = fullInformation;
+	        }
+	    }
+	    // Non-interactive flows (e.g., client_credentials, jwt-bearer) don't need a redirect URL
+	    const nonInteractiveFlow = !provider.redirectUrl;
+	    // Exchange authorization code for tokens, or fetch tokens directly for non-interactive flows
+	    if (authorizationCode !== undefined || nonInteractiveFlow) {
+	        const tokens = await fetchToken(provider, authorizationServerUrl, {
+	            metadata,
+	            resource,
+	            authorizationCode,
+	            fetchFn
+	        });
+	        await provider.saveTokens(tokens);
+	        return 'AUTHORIZED';
+	    }
+	    const tokens = await provider.tokens();
+	    // Handle token refresh or new authorization
+	    if (tokens?.refresh_token) {
+	        try {
+	            // Attempt to refresh the token
+	            const newTokens = await refreshAuthorization(authorizationServerUrl, {
+	                metadata,
+	                clientInformation,
+	                refreshToken: tokens.refresh_token,
+	                resource,
+	                addClientAuthentication: provider.addClientAuthentication,
+	                fetchFn
+	            });
+	            await provider.saveTokens(newTokens);
+	            return 'AUTHORIZED';
+	        }
+	        catch (error) {
+	            // If this is a ServerError, or an unknown type, log it out and try to continue. Otherwise, escalate so we can fix things and retry.
+	            if (!(error instanceof errors_js_1.OAuthError) || error instanceof errors_js_1.ServerError) ;
+	            else {
+	                // Refresh failed for another reason, re-throw
+	                throw error;
+	            }
+	        }
+	    }
+	    const state = provider.state ? await provider.state() : undefined;
+	    // Start new authorization flow
+	    const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
+	        metadata,
+	        clientInformation,
+	        state,
+	        redirectUrl: provider.redirectUrl,
+	        scope: resolvedScope,
+	        resource
+	    });
+	    await provider.saveCodeVerifier(codeVerifier);
+	    await provider.redirectToAuthorization(authorizationUrl);
+	    return 'REDIRECT';
+	}
+	/**
+	 * SEP-991: URL-based Client IDs
+	 * Validate that the client_id is a valid URL with https scheme
+	 */
+	function isHttpsUrl(value) {
+	    if (!value)
+	        return false;
+	    try {
+	        const url = new URL(value);
+	        return url.protocol === 'https:' && url.pathname !== '/';
+	    }
+	    catch {
+	        return false;
+	    }
+	}
+	async function selectResourceURL(serverUrl, provider, resourceMetadata) {
+	    const defaultResource = (0, auth_utils_js_1.resourceUrlFromServerUrl)(serverUrl);
+	    // If provider has custom validation, delegate to it
+	    if (provider.validateResourceURL) {
+	        return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
+	    }
+	    // Only include resource parameter when Protected Resource Metadata is present
+	    if (!resourceMetadata) {
+	        return undefined;
+	    }
+	    // Validate that the metadata's resource is compatible with our request
+	    if (!(0, auth_utils_js_1.checkResourceAllowed)({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource })) {
+	        throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
+	    }
+	    // Prefer the resource from metadata since it's what the server is telling us to request
+	    return new URL(resourceMetadata.resource);
+	}
+	/**
+	 * Extract resource_metadata, scope, and error from WWW-Authenticate header.
+	 */
+	function extractWWWAuthenticateParams(res) {
+	    const authenticateHeader = res.headers.get('WWW-Authenticate');
+	    if (!authenticateHeader) {
+	        return {};
+	    }
+	    const [type, scheme] = authenticateHeader.split(' ');
+	    if (type.toLowerCase() !== 'bearer' || !scheme) {
+	        return {};
+	    }
+	    const resourceMetadataMatch = extractFieldFromWwwAuth(res, 'resource_metadata') || undefined;
+	    let resourceMetadataUrl;
+	    if (resourceMetadataMatch) {
+	        try {
+	            resourceMetadataUrl = new URL(resourceMetadataMatch);
+	        }
+	        catch {
+	            // Ignore invalid URL
+	        }
+	    }
+	    const scope = extractFieldFromWwwAuth(res, 'scope') || undefined;
+	    const error = extractFieldFromWwwAuth(res, 'error') || undefined;
+	    return {
+	        resourceMetadataUrl,
+	        scope,
+	        error
+	    };
+	}
+	/**
+	 * Extracts a specific field's value from the WWW-Authenticate header string.
+	 *
+	 * @param response The HTTP response object containing the headers.
+	 * @param fieldName The name of the field to extract (e.g., "realm", "nonce").
+	 * @returns The field value
+	 */
+	function extractFieldFromWwwAuth(response, fieldName) {
+	    const wwwAuthHeader = response.headers.get('WWW-Authenticate');
+	    if (!wwwAuthHeader) {
+	        return null;
+	    }
+	    const pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`);
+	    const match = wwwAuthHeader.match(pattern);
+	    if (match) {
+	        // Pattern matches: field_name="value" or field_name=value (unquoted)
+	        return match[1] || match[2];
+	    }
+	    return null;
+	}
+	/**
+	 * Extract resource_metadata from response header.
+	 * @deprecated Use `extractWWWAuthenticateParams` instead.
+	 */
+	function extractResourceMetadataUrl(res) {
+	    const authenticateHeader = res.headers.get('WWW-Authenticate');
+	    if (!authenticateHeader) {
+	        return undefined;
+	    }
+	    const [type, scheme] = authenticateHeader.split(' ');
+	    if (type.toLowerCase() !== 'bearer' || !scheme) {
+	        return undefined;
+	    }
+	    const regex = /resource_metadata="([^"]*)"/;
+	    const match = regex.exec(authenticateHeader);
+	    if (!match) {
+	        return undefined;
+	    }
+	    try {
+	        return new URL(match[1]);
+	    }
+	    catch {
+	        return undefined;
+	    }
+	}
+	/**
+	 * Looks up RFC 9728 OAuth 2.0 Protected Resource Metadata.
+	 *
+	 * If the server returns a 404 for the well-known endpoint, this function will
+	 * return `undefined`. Any other errors will be thrown as exceptions.
+	 */
+	async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
+	    const response = await discoverMetadataWithFallback(serverUrl, 'oauth-protected-resource', fetchFn, {
+	        protocolVersion: opts?.protocolVersion,
+	        metadataUrl: opts?.resourceMetadataUrl
+	    });
+	    if (!response || response.status === 404) {
+	        await response?.body?.cancel();
+	        throw new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`);
+	    }
+	    if (!response.ok) {
+	        await response.body?.cancel();
+	        throw new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
+	    }
+	    return auth_js_2.OAuthProtectedResourceMetadataSchema.parse(await response.json());
+	}
+	/**
+	 * Helper function to handle fetch with CORS retry logic
+	 */
+	async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
+	    try {
+	        return await fetchFn(url, { headers });
+	    }
+	    catch (error) {
+	        if (error instanceof TypeError) {
+	            if (headers) {
+	                // CORS errors come back as TypeError, retry without headers
+	                return fetchWithCorsRetry(url, undefined, fetchFn);
+	            }
+	            else {
+	                // We're getting CORS errors on retry too, return undefined
+	                return undefined;
+	            }
+	        }
+	        throw error;
+	    }
+	}
+	/**
+	 * Constructs the well-known path for auth-related metadata discovery
+	 */
+	function buildWellKnownPath(wellKnownPrefix, pathname = '', options = {}) {
+	    // Strip trailing slash from pathname to avoid double slashes
+	    if (pathname.endsWith('/')) {
+	        pathname = pathname.slice(0, -1);
+	    }
+	    return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
+	}
+	/**
+	 * Tries to discover OAuth metadata at a specific URL
+	 */
+	async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
+	    const headers = {
+	        'MCP-Protocol-Version': protocolVersion
+	    };
+	    return await fetchWithCorsRetry(url, headers, fetchFn);
+	}
+	/**
+	 * Determines if fallback to root discovery should be attempted
+	 */
+	function shouldAttemptFallback(response, pathname) {
+	    return !response || (response.status >= 400 && response.status < 500 && pathname !== '/');
+	}
+	/**
+	 * Generic function for discovering OAuth metadata with fallback support
+	 */
+	async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
+	    const issuer = new URL(serverUrl);
+	    const protocolVersion = opts?.protocolVersion ?? types_js_1.LATEST_PROTOCOL_VERSION;
+	    let url;
+	    if (opts?.metadataUrl) {
+	        url = new URL(opts.metadataUrl);
+	    }
+	    else {
+	        // Try path-aware discovery first
+	        const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
+	        url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
+	        url.search = issuer.search;
+	    }
+	    let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
+	    // If path-aware discovery fails with 404 and we're not already at root, try fallback to root discovery
+	    if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
+	        const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
+	        response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
+	    }
+	    return response;
+	}
+	/**
+	 * Looks up RFC 8414 OAuth 2.0 Authorization Server Metadata.
+	 *
+	 * If the server returns a 404 for the well-known endpoint, this function will
+	 * return `undefined`. Any other errors will be thrown as exceptions.
+	 *
+	 * @deprecated This function is deprecated in favor of `discoverAuthorizationServerMetadata`.
+	 */
+	async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}, fetchFn = fetch) {
+	    if (typeof issuer === 'string') {
+	        issuer = new URL(issuer);
+	    }
+	    if (!authorizationServerUrl) {
+	        authorizationServerUrl = issuer;
+	    }
+	    if (typeof authorizationServerUrl === 'string') {
+	        authorizationServerUrl = new URL(authorizationServerUrl);
+	    }
+	    protocolVersion ?? (protocolVersion = types_js_1.LATEST_PROTOCOL_VERSION);
+	    const response = await discoverMetadataWithFallback(authorizationServerUrl, 'oauth-authorization-server', fetchFn, {
+	        protocolVersion,
+	        metadataServerUrl: authorizationServerUrl
+	    });
+	    if (!response || response.status === 404) {
+	        await response?.body?.cancel();
+	        return undefined;
+	    }
+	    if (!response.ok) {
+	        await response.body?.cancel();
+	        throw new Error(`HTTP ${response.status} trying to load well-known OAuth metadata`);
+	    }
+	    return auth_js_2.OAuthMetadataSchema.parse(await response.json());
+	}
+	/**
+	 * Builds a list of discovery URLs to try for authorization server metadata.
+	 * URLs are returned in priority order:
+	 * 1. OAuth metadata at the given URL
+	 * 2. OIDC metadata endpoints at the given URL
+	 */
+	function buildDiscoveryUrls(authorizationServerUrl) {
+	    const url = typeof authorizationServerUrl === 'string' ? new URL(authorizationServerUrl) : authorizationServerUrl;
+	    const hasPath = url.pathname !== '/';
+	    const urlsToTry = [];
+	    if (!hasPath) {
+	        // Root path: https://example.com/.well-known/oauth-authorization-server
+	        urlsToTry.push({
+	            url: new URL('/.well-known/oauth-authorization-server', url.origin),
+	            type: 'oauth'
+	        });
+	        // OIDC: https://example.com/.well-known/openid-configuration
+	        urlsToTry.push({
+	            url: new URL(`/.well-known/openid-configuration`, url.origin),
+	            type: 'oidc'
+	        });
+	        return urlsToTry;
+	    }
+	    // Strip trailing slash from pathname to avoid double slashes
+	    let pathname = url.pathname;
+	    if (pathname.endsWith('/')) {
+	        pathname = pathname.slice(0, -1);
+	    }
+	    // 1. OAuth metadata at the given URL
+	    // Insert well-known before the path: https://example.com/.well-known/oauth-authorization-server/tenant1
+	    urlsToTry.push({
+	        url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url.origin),
+	        type: 'oauth'
+	    });
+	    // 2. OIDC metadata endpoints
+	    // RFC 8414 style: Insert /.well-known/openid-configuration before the path
+	    urlsToTry.push({
+	        url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
+	        type: 'oidc'
+	    });
+	    // OIDC Discovery 1.0 style: Append /.well-known/openid-configuration after the path
+	    urlsToTry.push({
+	        url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
+	        type: 'oidc'
+	    });
+	    return urlsToTry;
+	}
+	/**
+	 * Discovers authorization server metadata with support for RFC 8414 OAuth 2.0 Authorization Server Metadata
+	 * and OpenID Connect Discovery 1.0 specifications.
+	 *
+	 * This function implements a fallback strategy for authorization server discovery:
+	 * 1. Attempts RFC 8414 OAuth metadata discovery first
+	 * 2. If OAuth discovery fails, falls back to OpenID Connect Discovery
+	 *
+	 * @param authorizationServerUrl - The authorization server URL obtained from the MCP Server's
+	 *                                 protected resource metadata, or the MCP server's URL if the
+	 *                                 metadata was not found.
+	 * @param options - Configuration options
+	 * @param options.fetchFn - Optional fetch function for making HTTP requests, defaults to global fetch
+	 * @param options.protocolVersion - MCP protocol version to use, defaults to LATEST_PROTOCOL_VERSION
+	 * @returns Promise resolving to authorization server metadata, or undefined if discovery fails
+	 */
+	async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = types_js_1.LATEST_PROTOCOL_VERSION } = {}) {
+	    const headers = {
+	        'MCP-Protocol-Version': protocolVersion,
+	        Accept: 'application/json'
+	    };
+	    // Get the list of URLs to try
+	    const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+	    // Try each URL in order
+	    for (const { url: endpointUrl, type } of urlsToTry) {
+	        const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
+	        if (!response) {
+	            /**
+	             * CORS error occurred - don't throw as the endpoint may not allow CORS,
+	             * continue trying other possible endpoints
+	             */
+	            continue;
+	        }
+	        if (!response.ok) {
+	            await response.body?.cancel();
+	            // Continue looking for any 4xx response code.
+	            if (response.status >= 400 && response.status < 500) {
+	                continue; // Try next URL
+	            }
+	            throw new Error(`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`);
+	        }
+	        // Parse and validate based on type
+	        if (type === 'oauth') {
+	            return auth_js_2.OAuthMetadataSchema.parse(await response.json());
+	        }
+	        else {
+	            return auth_js_1.OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
+	        }
+	    }
+	    return undefined;
+	}
+	/**
+	 * Discovers the authorization server for an MCP server following
+	 * {@link https://datatracker.ietf.org/doc/html/rfc9728 | RFC 9728} (OAuth 2.0 Protected
+	 * Resource Metadata), with fallback to treating the server URL as the
+	 * authorization server.
+	 *
+	 * This function combines two discovery steps into one call:
+	 * 1. Probes `/.well-known/oauth-protected-resource` on the MCP server to find the
+	 *    authorization server URL (RFC 9728).
+	 * 2. Fetches authorization server metadata from that URL (RFC 8414 / OpenID Connect Discovery).
+	 *
+	 * Use this when you need the authorization server metadata for operations outside the
+	 * {@linkcode auth} orchestrator, such as token refresh or token revocation.
+	 *
+	 * @param serverUrl - The MCP resource server URL
+	 * @param opts - Optional configuration
+	 * @param opts.resourceMetadataUrl - Override URL for the protected resource metadata endpoint
+	 * @param opts.fetchFn - Custom fetch function for HTTP requests
+	 * @returns Authorization server URL, metadata, and resource metadata (if available)
+	 */
+	async function discoverOAuthServerInfo(serverUrl, opts) {
+	    let resourceMetadata;
+	    let authorizationServerUrl;
+	    try {
+	        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
+	        if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
+	            authorizationServerUrl = resourceMetadata.authorization_servers[0];
+	        }
+	    }
+	    catch {
+	        // RFC 9728 not supported -- fall back to treating the server URL as the authorization server
+	    }
+	    // If we don't get a valid authorization server from protected resource metadata,
+	    // fall back to the legacy MCP spec behavior: MCP server base URL acts as the authorization server
+	    if (!authorizationServerUrl) {
+	        authorizationServerUrl = String(new URL('/', serverUrl));
+	    }
+	    const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
+	    return {
+	        authorizationServerUrl,
+	        authorizationServerMetadata,
+	        resourceMetadata
+	    };
+	}
+	/**
+	 * Begins the authorization flow with the given server, by generating a PKCE challenge and constructing the authorization URL.
+	 */
+	async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
+	    let authorizationUrl;
+	    if (metadata) {
+	        authorizationUrl = new URL(metadata.authorization_endpoint);
+	        if (!metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE)) {
+	            throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
+	        }
+	        if (metadata.code_challenge_methods_supported &&
+	            !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD)) {
+	            throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
+	        }
+	    }
+	    else {
+	        authorizationUrl = new URL('/authorize', authorizationServerUrl);
+	    }
+	    // Generate PKCE challenge
+	    const challenge = await (0, pkce_challenge_1.default)();
+	    const codeVerifier = challenge.code_verifier;
+	    const codeChallenge = challenge.code_challenge;
+	    authorizationUrl.searchParams.set('response_type', AUTHORIZATION_CODE_RESPONSE_TYPE);
+	    authorizationUrl.searchParams.set('client_id', clientInformation.client_id);
+	    authorizationUrl.searchParams.set('code_challenge', codeChallenge);
+	    authorizationUrl.searchParams.set('code_challenge_method', AUTHORIZATION_CODE_CHALLENGE_METHOD);
+	    authorizationUrl.searchParams.set('redirect_uri', String(redirectUrl));
+	    if (state) {
+	        authorizationUrl.searchParams.set('state', state);
+	    }
+	    if (scope) {
+	        authorizationUrl.searchParams.set('scope', scope);
+	    }
+	    if (scope?.includes('offline_access')) {
+	        // if the request includes the OIDC-only "offline_access" scope,
+	        // we need to set the prompt to "consent" to ensure the user is prompted to grant offline access
+	        // https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
+	        authorizationUrl.searchParams.append('prompt', 'consent');
+	    }
+	    if (resource) {
+	        authorizationUrl.searchParams.set('resource', resource.href);
+	    }
+	    return { authorizationUrl, codeVerifier };
+	}
+	/**
+	 * Prepares token request parameters for an authorization code exchange.
+	 *
+	 * This is the default implementation used by fetchToken when the provider
+	 * doesn't implement prepareTokenRequest.
+	 *
+	 * @param authorizationCode - The authorization code received from the authorization endpoint
+	 * @param codeVerifier - The PKCE code verifier
+	 * @param redirectUri - The redirect URI used in the authorization request
+	 * @returns URLSearchParams for the authorization_code grant
+	 */
+	function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
+	    return new URLSearchParams({
+	        grant_type: 'authorization_code',
+	        code: authorizationCode,
+	        code_verifier: codeVerifier,
+	        redirect_uri: String(redirectUri)
+	    });
+	}
+	/**
+	 * Internal helper to execute a token request with the given parameters.
+	 * Used by exchangeAuthorization, refreshAuthorization, and fetchToken.
+	 */
+	async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+	    const tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL('/token', authorizationServerUrl);
+	    const headers = new Headers({
+	        'Content-Type': 'application/x-www-form-urlencoded',
+	        Accept: 'application/json'
+	    });
+	    if (resource) {
+	        tokenRequestParams.set('resource', resource.href);
+	    }
+	    if (addClientAuthentication) {
+	        await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
+	    }
+	    else if (clientInformation) {
+	        const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
+	        const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
+	        applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
+	    }
+	    const response = await (fetchFn ?? fetch)(tokenUrl, {
+	        method: 'POST',
+	        headers,
+	        body: tokenRequestParams
+	    });
+	    if (!response.ok) {
+	        throw await parseErrorResponse(response);
+	    }
+	    return auth_js_2.OAuthTokensSchema.parse(await response.json());
+	}
+	/**
+	 * Exchanges an authorization code for an access token with the given server.
+	 *
+	 * Supports multiple client authentication methods as specified in OAuth 2.1:
+	 * - Automatically selects the best authentication method based on server support
+	 * - Falls back to appropriate defaults when server metadata is unavailable
+	 *
+	 * @param authorizationServerUrl - The authorization server's base URL
+	 * @param options - Configuration object containing client info, auth code, etc.
+	 * @returns Promise resolving to OAuth tokens
+	 * @throws {Error} When token exchange fails or authentication is invalid
+	 */
+	async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
+	    const tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri);
+	    return executeTokenRequest(authorizationServerUrl, {
+	        metadata,
+	        tokenRequestParams,
+	        clientInformation,
+	        addClientAuthentication,
+	        resource,
+	        fetchFn
+	    });
+	}
+	/**
+	 * Exchange a refresh token for an updated access token.
+	 *
+	 * Supports multiple client authentication methods as specified in OAuth 2.1:
+	 * - Automatically selects the best authentication method based on server support
+	 * - Preserves the original refresh token if a new one is not returned
+	 *
+	 * @param authorizationServerUrl - The authorization server's base URL
+	 * @param options - Configuration object containing client info, refresh token, etc.
+	 * @returns Promise resolving to OAuth tokens (preserves original refresh_token if not replaced)
+	 * @throws {Error} When token refresh fails or authentication is invalid
+	 */
+	async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+	    const tokenRequestParams = new URLSearchParams({
+	        grant_type: 'refresh_token',
+	        refresh_token: refreshToken
+	    });
+	    const tokens = await executeTokenRequest(authorizationServerUrl, {
+	        metadata,
+	        tokenRequestParams,
+	        clientInformation,
+	        addClientAuthentication,
+	        resource,
+	        fetchFn
+	    });
+	    // Preserve original refresh token if server didn't return a new one
+	    return { refresh_token: refreshToken, ...tokens };
+	}
+	/**
+	 * Unified token fetching that works with any grant type via provider.prepareTokenRequest().
+	 *
+	 * This function provides a single entry point for obtaining tokens regardless of the
+	 * OAuth grant type. The provider's prepareTokenRequest() method determines which grant
+	 * to use and supplies the grant-specific parameters.
+	 *
+	 * @param provider - OAuth client provider that implements prepareTokenRequest()
+	 * @param authorizationServerUrl - The authorization server's base URL
+	 * @param options - Configuration for the token request
+	 * @returns Promise resolving to OAuth tokens
+	 * @throws {Error} When provider doesn't implement prepareTokenRequest or token fetch fails
+	 *
+	 * @example
+	 * // Provider for client_credentials:
+	 * class MyProvider implements OAuthClientProvider {
+	 *   prepareTokenRequest(scope) {
+	 *     const params = new URLSearchParams({ grant_type: 'client_credentials' });
+	 *     if (scope) params.set('scope', scope);
+	 *     return params;
+	 *   }
+	 *   // ... other methods
+	 * }
+	 *
+	 * const tokens = await fetchToken(provider, authServerUrl, { metadata });
+	 */
+	async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+	    const scope = provider.clientMetadata.scope;
+	    // Use provider's prepareTokenRequest if available, otherwise fall back to authorization_code
+	    let tokenRequestParams;
+	    if (provider.prepareTokenRequest) {
+	        tokenRequestParams = await provider.prepareTokenRequest(scope);
+	    }
+	    // Default to authorization_code grant if no custom prepareTokenRequest
+	    if (!tokenRequestParams) {
+	        if (!authorizationCode) {
+	            throw new Error('Either provider.prepareTokenRequest() or authorizationCode is required');
+	        }
+	        if (!provider.redirectUrl) {
+	            throw new Error('redirectUrl is required for authorization_code flow');
+	        }
+	        const codeVerifier = await provider.codeVerifier();
+	        tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
+	    }
+	    const clientInformation = await provider.clientInformation();
+	    return executeTokenRequest(authorizationServerUrl, {
+	        metadata,
+	        tokenRequestParams,
+	        clientInformation: clientInformation ?? undefined,
+	        addClientAuthentication: provider.addClientAuthentication,
+	        resource,
+	        fetchFn
+	    });
+	}
+	/**
+	 * Performs OAuth 2.0 Dynamic Client Registration according to RFC 7591.
+	 *
+	 * If `scope` is provided, it overrides `clientMetadata.scope` in the registration
+	 * request body. This allows callers to apply the Scope Selection Strategy (SEP-835)
+	 * consistently across both DCR and the subsequent authorization request.
+	 */
+	async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
+	    let registrationUrl;
+	    if (metadata) {
+	        if (!metadata.registration_endpoint) {
+	            throw new Error('Incompatible auth server: does not support dynamic client registration');
+	        }
+	        registrationUrl = new URL(metadata.registration_endpoint);
+	    }
+	    else {
+	        registrationUrl = new URL('/register', authorizationServerUrl);
+	    }
+	    const response = await (fetchFn ?? fetch)(registrationUrl, {
+	        method: 'POST',
+	        headers: {
+	            'Content-Type': 'application/json'
+	        },
+	        body: JSON.stringify({
+	            ...clientMetadata,
+	            ...(scope !== undefined ? { scope } : {})
+	        })
+	    });
+	    if (!response.ok) {
+	        throw await parseErrorResponse(response);
+	    }
+	    return auth_js_2.OAuthClientInformationFullSchema.parse(await response.json());
+	}
+	
+	return auth$1;
 }
 
 var stream = {};
@@ -35826,7 +35954,7 @@ Object.defineProperty(streamableHttp$1, "__esModule", { value: true });
 streamableHttp$1.StreamableHTTPClientTransport = streamableHttp$1.StreamableHTTPError = void 0;
 const transport_js_1 = transport$1;
 const types_js_1$4 = types$2;
-const auth_js_1 = auth$2;
+const auth_js_1 = requireAuth();
 const stream_1 = stream;
 // Default reconnection options for StreamableHTTP connections
 const DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
@@ -36950,6 +37078,244 @@ var mcpScopeResolver = {
   applyPathScopeToCredentials: applyPathScopeToCredentials$1,
 };
 
+/**
+ * mcpOAuthProvider.js
+ *
+ * Implements the MCP SDK's `OAuthClientProvider` interface for custom
+ * remote (streamable_http) MCP servers that authenticate with standard
+ * OAuth 2.0 (e.g. Granola, Linear). This is the generic, SDK-native
+ * alternative to the catalog-only subprocess auth model (`runAuth`)
+ * used by the bundled Google servers.
+ *
+ * Flow (driven by mcpController.connectStreamableHttpWithOAuth):
+ *   1. A loopback HTTP server is started on 127.0.0.1:<ephemeral> to
+ *      catch the OAuth redirect. `redirectUrl` reflects that port.
+ *   2. On first connect with no/expired tokens, the SDK calls
+ *      `redirectToAuthorization`, which opens the system browser.
+ *   3. The user consents; the authorization server redirects back to the
+ *      loopback `/callback?code=...`, which resolves `_waitForCode()`.
+ *   4. The controller calls `transport.finishAuth(code)` → `saveTokens`.
+ *
+ * Tokens, Dynamic Client Registration info, and the PKCE verifier are
+ * persisted encrypted in the SAME providers.json store as credentials
+ * (via providerController), keyed by (appId, serverName). They are never
+ * returned to the renderer.
+ */
+
+var mcpOAuthProvider;
+var hasRequiredMcpOAuthProvider;
+
+function requireMcpOAuthProvider () {
+	if (hasRequiredMcpOAuthProvider) return mcpOAuthProvider;
+	hasRequiredMcpOAuthProvider = 1;
+	const { shell } = require$$0$2;
+	const http = require$$1$5;
+	const providerController = requireProviderController();
+
+	/**
+	 * Start a loopback HTTP server bound to 127.0.0.1 on an OS-assigned port.
+	 * Resolves once listening with `{ server, port, codePromise }` where
+	 * `codePromise` resolves with the OAuth `code` (or rejects on `error`).
+	 */
+	function startLoopbackServer() {
+	  let resolveCode;
+	  let rejectCode;
+	  const codePromise = new Promise((resolve, reject) => {
+	    resolveCode = resolve;
+	    rejectCode = reject;
+	  });
+
+	  const server = http.createServer((req, res) => {
+	    try {
+	      const reqUrl = new URL(req.url, "http://127.0.0.1");
+	      if (reqUrl.pathname !== "/callback") {
+	        res.writeHead(404, { "Content-Type": "text/plain" });
+	        res.end("Not found");
+	        return;
+	      }
+	      const error = reqUrl.searchParams.get("error");
+	      const code = reqUrl.searchParams.get("code");
+	      const heading = error ? "Authorization failed" : "Authorization complete";
+	      const body = error
+	        ? "You can close this window and try again in Dash."
+	        : "You can close this window and return to Dash.";
+	      const html =
+	        "<!doctype html><html><head><meta charset='utf-8'>" +
+	        "<title>Dash</title></head>" +
+	        "<body style='font-family:system-ui,sans-serif;background:#111;color:#eee;" +
+	        "display:flex;align-items:center;justify-content:center;height:100vh;margin:0;'>" +
+	        `<div style='text-align:center;'><h2>${heading}</h2><p>${body}</p></div>` +
+	        "</body></html>";
+	      res.writeHead(error ? 400 : 200, { "Content-Type": "text/html" });
+	      res.end(html);
+
+	      if (error) {
+	        rejectCode(new Error(`OAuth authorization error: ${error}`));
+	      } else if (code) {
+	        resolveCode(code);
+	      } else {
+	        rejectCode(new Error("OAuth callback missing authorization code"));
+	      }
+	    } catch (e) {
+	      rejectCode(e);
+	    }
+	  });
+
+	  return new Promise((resolve, reject) => {
+	    server.once("error", reject);
+	    // Bind to loopback only (never 0.0.0.0) — port 0 = OS-assigned.
+	    server.listen(0, "127.0.0.1", () => {
+	      const addr = server.address();
+	      resolve({ server, port: addr.port, codePromise });
+	    });
+	  });
+	}
+
+	/**
+	 * Create an OAuthClientProvider for one (appId, serverName) pair.
+	 *
+	 * @param {object} args
+	 * @param {BrowserWindow|null} args.win unused today; reserved for future
+	 *   window-scoped flows.
+	 * @param {string} args.appId application id (providers.json namespace)
+	 * @param {string} args.serverName provider/server name (storage key)
+	 * @param {object} args.mcpConfig the server config; `mcpConfig.oauth` may
+	 *   carry `{ scopes, clientId?, clientSecret? }`.
+	 */
+	function createMcpOAuthProvider({ win, appId, serverName, mcpConfig }) {
+	  const oauth = (mcpConfig && mcpConfig.oauth) || {};
+
+	  // Lazy-hydrated cache of persisted { tokens, clientInformation, codeVerifier }.
+	  let state = null;
+	  const load = () => {
+	    if (state) return state;
+	    const res = providerController.getOAuthState(win, appId, serverName);
+	    state = (res && res.oauth) || {};
+	    return state;
+	  };
+	  const persist = (patch) => {
+	    state = { ...load(), ...patch };
+	    providerController.saveOAuthState(win, appId, serverName, state);
+	  };
+
+	  // Loopback server for the current flow (null when idle).
+	  let loopback = null;
+
+	  return {
+	    get redirectUrl() {
+	      return loopback
+	        ? `http://127.0.0.1:${loopback.port}/callback`
+	        : undefined;
+	    },
+
+	    get clientMetadata() {
+	      const redirectUrl = this.redirectUrl;
+	      return {
+	        client_name: `Dash – ${serverName}`,
+	        redirect_uris: redirectUrl ? [redirectUrl] : [],
+	        grant_types: ["authorization_code", "refresh_token"],
+	        response_types: ["code"],
+	        token_endpoint_auth_method: oauth.clientSecret
+	          ? "client_secret_post"
+	          : "none",
+	        ...(oauth.scopes ? { scope: oauth.scopes } : {}),
+	      };
+	    },
+
+	    clientInformation() {
+	      // Pre-registered (manual) client wins over Dynamic Client Registration.
+	      if (oauth.clientId) {
+	        return {
+	          client_id: oauth.clientId,
+	          ...(oauth.clientSecret ? { client_secret: oauth.clientSecret } : {}),
+	        };
+	      }
+	      return load().clientInformation;
+	    },
+
+	    saveClientInformation(clientInformation) {
+	      persist({ clientInformation });
+	    },
+
+	    tokens() {
+	      return load().tokens;
+	    },
+
+	    // Called by the SDK on initial authorization AND on every refresh.
+	    saveTokens(tokens) {
+	      persist({ tokens });
+	    },
+
+	    saveCodeVerifier(codeVerifier) {
+	      persist({ codeVerifier });
+	    },
+
+	    codeVerifier() {
+	      const v = load().codeVerifier;
+	      if (!v) throw new Error("No OAuth code verifier saved");
+	      return v;
+	    },
+
+	    async redirectToAuthorization(authorizationUrl) {
+	      await shell.openExternal(authorizationUrl.toString());
+	    },
+
+	    // Lets the SDK clear bad credentials so the next attempt re-auths
+	    // without manual intervention (e.g. refresh token revoked).
+	    invalidateCredentials(scope) {
+	      if (scope === "all" || scope === "tokens") persist({ tokens: undefined });
+	      if (scope === "all" || scope === "client")
+	        persist({ clientInformation: undefined });
+	      if (scope === "all" || scope === "verifier")
+	        persist({ codeVerifier: undefined });
+	    },
+
+	    // --- helpers used by the controller (not part of the SDK interface) ---
+
+	    async _startLoopback() {
+	      if (!loopback) {
+	        loopback = await startLoopbackServer();
+	      }
+	      return loopback;
+	    },
+
+	    _stopLoopback() {
+	      if (loopback) {
+	        try {
+	          loopback.server.close();
+	        } catch (_e) {
+	          /* already closing */
+	        }
+	        loopback = null;
+	      }
+	    },
+
+	    _waitForCode(timeoutMs = 120000) {
+	      if (!loopback) {
+	        return Promise.reject(new Error("OAuth loopback server not started"));
+	      }
+	      return Promise.race([
+	        loopback.codePromise,
+	        new Promise((_resolve, reject) =>
+	          setTimeout(
+	            () =>
+	              reject(
+	                new Error(
+	                  "OAuth authorization timed out. Close the browser tab and try again.",
+	                ),
+	              ),
+	            timeoutMs,
+	          ),
+	        ),
+	      ]);
+	    },
+	  };
+	}
+
+	mcpOAuthProvider = { createMcpOAuthProvider, startLoopbackServer };
+	return mcpOAuthProvider;
+}
+
 /**
  * mcpController.js
  *
@@ -36966,7 +37332,7 @@ var mcpScopeResolver = {
 const { Client } = require$$0$8;
 const {
   StdioClientTransport,
-} = require$$1$5;
+} = require$$1$6;
 const {
   StreamableHTTPClientTransport,
 } = streamableHttp$1;
@@ -37377,6 +37743,57 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
   console.log("[mcpController] Google OAuth token refreshed successfully");
 }
 
+/**
+ * Connect a streamable_http MCP server that authenticates via OAuth 2.0,
+ * using the SDK's native OAuthClientProvider.
+ *
+ * Drives the connect → UnauthorizedError → finishAuth → reconnect dance:
+ *   - With valid (or refreshable) tokens, the first connect succeeds and no
+ *     browser opens (fast path).
+ *   - Otherwise the SDK opens the system browser via
+ *     `redirectToAuthorization`, throws UnauthorizedError, and we wait for
+ *     the loopback callback, exchange the code, then reconnect.
+ *
+ * The authorized reconnect uses a FRESH transport because the first
+ * transport already called `start()` and cannot be restarted. `finishAuth`
+ * runs on the original transport so it reuses that attempt's discovery state.
+ *
+ * @returns {Promise<{ client, transport }>} a connected client + transport
+ */
+async function connectStreamableHttpWithOAuth(urlObj, oauthProvider) {
+  const {
+    UnauthorizedError,
+  } = requireAuth();
+
+  await oauthProvider._startLoopback();
+  try {
+    const client = new Client({ name: "dash", version: "1.0.0" });
+    const transport = new StreamableHTTPClientTransport(urlObj, {
+      authProvider: oauthProvider,
+    });
+    try {
+      await client.connect(transport);
+      return { client, transport };
+    } catch (err) {
+      if (!(err instanceof UnauthorizedError)) throw err;
+      console.log(
+        "[mcpController] OAuth required — waiting for browser authorization...",
+      );
+      const code = await oauthProvider._waitForCode();
+      await transport.finishAuth(code);
+
+      const client2 = new Client({ name: "dash", version: "1.0.0" });
+      const transport2 = new StreamableHTTPClientTransport(urlObj, {
+        authProvider: oauthProvider,
+      });
+      await client2.connect(transport2);
+      return { client: client2, transport: transport2 };
+    }
+  } finally {
+    oauthProvider._stopLoopback();
+  }
+}
+
 const mcpController$3 = {
   /**
    * startServer
@@ -37409,6 +37826,7 @@ const mcpController$3 = {
     credentials,
     workspaceId,
     pathScope = null,
+    appId = null,
   ) => {
     const key = serverKey(workspaceId, serverName);
     // Slice 3b: when the gate is enforced, override credentials with
@@ -37483,6 +37901,11 @@ const mcpController$3 = {
 
         // Create transport based on type
         let transport;
+        // OAuth state, populated below for OAuth streamable_http servers.
+        // When set, the connect step runs the interactive OAuth dance
+        // (which builds its own transport) instead of the generic connect.
+        let oauthProvider = null;
+        let oauthUrl = null;
         if (mcpConfig.transport === "streamable_http") {
           // Remote HTTP transport - connect to a hosted MCP server
           const url = interpolate$1(mcpConfig.url, credentials);
@@ -37490,21 +37913,37 @@ const mcpController$3 = {
             throw new Error("Streamable HTTP transport requires a URL");
           }
 
-          // Build request headers from headerTemplate
-          const headers = {};
-          if (mcpConfig.headerTemplate && credentials) {
-            Object.entries(mcpConfig.headerTemplate).forEach(
-              ([headerName, template]) => {
-                headers[headerName] = interpolate$1(template, credentials);
+          if (mcpConfig.auth === "oauth" || mcpConfig.oauth) {
+            // OAuth 2.0 server (e.g. Granola, Linear): authenticate via the
+            // SDK's native OAuthClientProvider + browser flow + token
+            // refresh. Transport is created during the connect dance below.
+            const {
+              createMcpOAuthProvider,
+            } = requireMcpOAuthProvider();
+            oauthProvider = createMcpOAuthProvider({
+              win,
+              appId,
+              serverName,
+              mcpConfig,
+            });
+            oauthUrl = new URL(url);
+          } else {
+            // Build request headers from headerTemplate
+            const headers = {};
+            if (mcpConfig.headerTemplate && credentials) {
+              Object.entries(mcpConfig.headerTemplate).forEach(
+                ([headerName, template]) => {
+                  headers[headerName] = interpolate$1(template, credentials);
+                },
+              );
+            }
+
+            transport = new StreamableHTTPClientTransport(new URL(url), {
+              requestInit: {
+                headers,
               },
-            );
+            });
           }
-
-          transport = new StreamableHTTPClientTransport(new URL(url), {
-            requestInit: {
-              headers,
-            },
-          });
         } else {
           // stdio transport (default) - spawn a local child process
           const env = cleanEnvForChildProcess();
@@ -37589,14 +38028,26 @@ const mcpController$3 = {
           serverName,
         });
 
-        // Create MCP client
-        const client = new Client({
-          name: "dash",
-          version: "1.0.0",
-        });
-
-        // Connect to the server
-        await client.connect(transport);
+        // Create / connect MCP client. OAuth servers run the interactive
+        // connect → authorize → reconnect dance, which yields its own
+        // client + transport (a fresh transport is required for the
+        // authorized reconnect).
+        let client;
+        if (oauthProvider) {
+          const oauthResult = await connectStreamableHttpWithOAuth(
+            oauthUrl,
+            oauthProvider,
+          );
+          client = oauthResult.client;
+          transport = oauthResult.transport;
+        } else {
+          client = new Client({
+            name: "dash",
+            version: "1.0.0",
+          });
+          // Connect to the server
+          await client.connect(transport);
+        }
 
         // List available tools
         let tools = [];
@@ -37682,6 +38133,83 @@ const mcpController$3 = {
     return startPromise;
   },
 
+  /**
+   * authorizeServer
+   * Run the interactive OAuth 2.0 authorization flow on demand for a
+   * custom streamable_http MCP server (the Settings "Authorize" button
+   * and the re-auth banner). Opens the system browser, completes the
+   * flow, and persists tokens encrypted. A subsequent startServer hits
+   * the valid-token fast path with no browser.
+   *
+   * @param {BrowserWindow} win the main window
+   * @param {string} serverName the provider/server name
+   * @param {object} mcpConfig must be streamable_http with auth: "oauth"
+   * @param {object} credentials decrypted credentials (for URL interpolation)
+   * @param {string} appId application id (token storage namespace)
+   * @returns {Promise<{ success, serverName, tools } | { error, message }>}
+   */
+  authorizeServer: async (win, serverName, mcpConfig, credentials, appId) => {
+    try {
+      if (
+        !mcpConfig ||
+        mcpConfig.transport !== "streamable_http" ||
+        !(mcpConfig.auth === "oauth" || mcpConfig.oauth)
+      ) {
+        return {
+          error: true,
+          message: "Server is not configured for OAuth authorization",
+        };
+      }
+
+      const url = interpolate$1(mcpConfig.url, credentials);
+      if (!url) {
+        return {
+          error: true,
+          message: "Streamable HTTP transport requires a URL",
+        };
+      }
+
+      const { createMcpOAuthProvider } = requireMcpOAuthProvider();
+      const oauthProvider = createMcpOAuthProvider({
+        win,
+        appId,
+        serverName,
+        mcpConfig,
+      });
+
+      const { client } = await connectStreamableHttpWithOAuth(
+        new URL(url),
+        oauthProvider,
+      );
+
+      // Verify the connection by listing tools, then close — startServer
+      // will reconnect later using the freshly stored tokens.
+      let tools = [];
+      try {
+        const toolsResult = await client.listTools();
+        tools = toolsResult.tools || [];
+      } catch (_e) {
+        // Tools optional for the auth check
+      }
+      try {
+        await client.close();
+      } catch (_e) {
+        /* ignore close errors */
+      }
+
+      console.log(
+        `[mcpController] OAuth authorization succeeded for ${serverName} (${tools.length} tools)`,
+      );
+      return { success: true, serverName, tools };
+    } catch (error) {
+      console.error(
+        `[mcpController] OAuth authorization failed for ${serverName}:`,
+        error,
+      );
+      return { error: true, message: error.message };
+    }
+  },
+
   /**
    * stopServer
    * Stop a running MCP server
@@ -39941,6 +40469,130 @@ var menuItemsController_1 = menuItemsController$1;
 
 var cliController$3 = {exports: {}};
 
+/**
+ * modelProviders.js
+ *
+ * Provider-pluggable registry for discovering and validating LLM models.
+ *
+ * Each provider knows how to:
+ *   - list its currently-available models (live, when credentials allow)
+ *   - fall back to a curated list (offline / no key / no live API)
+ *   - migrate retired model IDs to a current replacement
+ *   - name its default model
+ *
+ * Today only `anthropic` is implemented. Adding a vendor (OpenAI, Google, …)
+ * is a single new entry in PROVIDERS — the dispatchers below, the
+ * LLM_LIST_MODELS IPC, and the Settings UI need no changes.
+ *
+ * NOTE: the renderer mirrors the retired map + default for the auto-migrate
+ * notice (src/utils/modelMigration.js). Keep the two in sync.
+ */
+
+const Anthropic$1 = require$$0$a;
+
+const PROVIDERS = {
+  anthropic: {
+    id: "anthropic",
+    label: "Anthropic",
+    defaultModel: "claude-opus-4-8",
+    // Curated fallback — current, non-deprecated IDs. Used for the Claude
+    // Code CLI backend (which has no Models API) and whenever a live fetch
+    // can't run (no API key, offline, error).
+    curatedModels: [
+      { value: "claude-opus-4-8", label: "Claude Opus 4.8" },
+      { value: "claude-opus-4-7", label: "Claude Opus 4.7" },
+      { value: "claude-sonnet-4-6", label: "Claude Sonnet 4.6" },
+      { value: "claude-haiku-4-5", label: "Claude Haiku 4.5" },
+      { value: "claude-fable-5", label: "Claude Fable 5" },
+    ],
+    // Retired/deprecated IDs → current replacement. Lets a stale saved
+    // selection self-heal instead of 404-ing at call time.
+    retiredMap: {
+      "claude-sonnet-4-20250514": "claude-sonnet-4-6",
+      "claude-opus-4-20250514": "claude-opus-4-8",
+      "claude-opus-4-1-20250805": "claude-opus-4-8",
+      "claude-3-7-sonnet-20250219": "claude-sonnet-4-6",
+      "claude-3-5-sonnet-20241022": "claude-sonnet-4-6",
+      "claude-3-5-sonnet-20240620": "claude-sonnet-4-6",
+      "claude-3-5-haiku-20241022": "claude-haiku-4-5",
+      "claude-3-opus-20240229": "claude-opus-4-8",
+    },
+    async listModels({ apiKey } = {}) {
+      const client = new Anthropic$1({ apiKey });
+      const res = await client.models.list();
+      return (res.data || []).map((m) => ({
+        value: m.id,
+        label: m.display_name || m.id,
+      }));
+    },
+  },
+};
+
+const DEFAULT_PROVIDER = "anthropic";
+
+function getProvider$1(providerId) {
+  return PROVIDERS[providerId] || PROVIDERS[DEFAULT_PROVIDER];
+}
+
+function getCuratedModels(providerId) {
+  return getProvider$1(providerId).curatedModels.slice();
+}
+
+function getDefaultModel(providerId) {
+  return getProvider$1(providerId).defaultModel;
+}
+
+/**
+ * Map a retired/deprecated model id to its current replacement. Returns the
+ * provider default for a falsy id, and passes through anything not in the
+ * retired map (live/curated ids are returned unchanged).
+ */
+function migrateModelId$2(providerId, id) {
+  if (!id) return getDefaultModel(providerId);
+  const map = getProvider$1(providerId).retiredMap || {};
+  return map[id] || id;
+}
+
+function isKnownRetired(providerId, id) {
+  const map = getProvider$1(providerId).retiredMap || {};
+  return !!map[id];
+}
+
+/**
+ * List models for a provider. Attempts a live fetch when the provider
+ * supports it and credentials are present; otherwise returns the curated
+ * fallback. Never throws — always resolves to a usable list.
+ *
+ * @returns {Promise<{ models: Array<{value,label}>, source: "live"|"curated" }>}
+ */
+async function listModels(providerId, creds = {}) {
+  const provider = getProvider$1(providerId);
+  if (provider.listModels && creds && creds.apiKey) {
+    try {
+      const models = await provider.listModels(creds);
+      if (Array.isArray(models) && models.length > 0) {
+        return { models, source: "live" };
+      }
+    } catch (e) {
+      console.warn(
+        `[modelProviders] live model fetch failed for ${provider.id}: ${e.message}`,
+      );
+    }
+  }
+  return { models: provider.curatedModels.slice(), source: "curated" };
+}
+
+var modelProviders = {
+  PROVIDERS,
+  DEFAULT_PROVIDER,
+  getProvider: getProvider$1,
+  getCuratedModels,
+  getDefaultModel,
+  migrateModelId: migrateModelId$2,
+  isKnownRetired,
+  listModels,
+};
+
 var mcp = {};
 
 var server$1 = {};
@@ -56494,13 +57146,13 @@ __export(src_exports, {
 var dist = __toCommonJS(src_exports);
 
 // src/server.ts
-var import_node_http = require$$0$a;
+var import_node_http = require$$1$5;
 
 // src/listener.ts
-var import_node_http22 = require$$1$6;
+var import_node_http22 = require$$1$7;
 
 // src/request.ts
-var import_node_http2 = require$$1$6;
+var import_node_http2 = require$$1$7;
 var import_node_stream = require$$5$1;
 var RequestError = class extends Error {
   constructor(message, options) {
@@ -58792,6 +59444,7 @@ const {
   LLM_STREAM_COMPLETE: LLM_STREAM_COMPLETE$2,
   LLM_STREAM_ERROR: LLM_STREAM_ERROR$2,
 } = llmEvents$1;
+const { migrateModelId: migrateModelId$1 } = modelProviders;
 
 const IS_WINDOWS = process.platform === "win32";
 
@@ -59047,8 +59700,11 @@ const cliController$2 = {
     // buildClaudeCliArgs; below we only add args that depend on
     // runtime state (MCP config file paths) the helper can't know.
     const sessionIdForResume = widgetUuid ? sessions.get(widgetUuid) : null;
+    // Heal a retired/stale saved model id before passing --model. Leave an
+    // unset model alone so the CLI keeps its own default when none was chosen.
+    const resolvedModel = model ? migrateModelId$1("anthropic", model) : model;
     const args = buildClaudeCliArgs({
-      model,
+      model: resolvedModel,
       systemPrompt,
       sessionId: sessionIdForResume,
       replaceSystemPrompt,
@@ -60155,9 +60811,9 @@ var themeFromUrlErrors$1 = {
  */
 
 const css = require$$0$b;
-const { Vibrant } = require$$1$7;
+const { Vibrant } = require$$1$8;
 const https = require$$11;
-const http = require$$0$a;
+const http = require$$1$5;
 const { URL: URL$1 } = require$$4;
 const {
   UrlUnreachableError,
@@ -65005,9 +65661,13 @@ var toolHandlers$1 = {
  * per-request, receiving the full messages array each time.
  */
 
-const Anthropic = require$$0$c;
+const Anthropic = require$$0$a;
 const mcpController$2 = mcpControllerExports;
 const cliController$1 = cliControllerExports;
+const {
+  listModels: listProviderModels,
+  migrateModelId,
+} = modelProviders;
 const toolDefinitions = toolDefinitions$1;
 const toolHandlers = toolHandlers$1;
 const {
@@ -65148,7 +65808,6 @@ const llmController$1 = {
 
     const {
       apiKey,
-      model = "claude-sonnet-4-20250514",
       messages,
       tools = [],
       toolServerMap = {},
@@ -65156,6 +65815,10 @@ const llmController$1 = {
       maxToolRounds = DEFAULT_MAX_TOOL_ROUNDS,
     } = params;
 
+    // Heal a retired/stale saved model id (and fill the provider default when
+    // none was supplied) so a stored selection can't 404 the request.
+    const model = migrateModelId("anthropic", params.model);
+
     // Set up abort controller
     const abortController = new AbortController();
     activeRequests.set(requestId, abortController);
@@ -65405,6 +66068,22 @@ const llmController$1 = {
     // Fallback to CLI controller
     return cliController$1.abortRequest(requestId);
   },
+
+  /**
+   * listModels
+   * Discover selectable models for a provider. Attempts a live fetch via the
+   * provider's API (e.g. Anthropic Models API) when an apiKey is supplied;
+   * otherwise returns the provider's curated fallback list. Provider-pluggable
+   * — adding OpenAI/Google later is a new entry in modelProviders.js.
+   *
+   * @param {BrowserWindow} win - unused (API consistency)
+   * @param {string} providerId - vendor id, e.g. "anthropic"
+   * @param {string|null} apiKey - decrypted key for the live fetch (optional)
+   * @returns {Promise<{ models, source }>}
+   */
+  listModels: async (win, providerId, apiKey) => {
+    return listProviderModels(providerId || "anthropic", { apiKey });
+  },
 };
 
 var llmController_1 = llmController$1;
@@ -74947,6 +75626,7 @@ const {
   MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM: MCP_INSTALL_KNOWN_EXTERNAL_CONFIRM$1,
   MCP_INSTALL_KNOWN_EXTERNAL_RESULT: MCP_INSTALL_KNOWN_EXTERNAL_RESULT$1,
   MCP_RUN_AUTH,
+  MCP_AUTHORIZE,
 } = events$8;
 
 const mcpApi$2 = {
@@ -74971,6 +75651,7 @@ const mcpApi$2 = {
     credentials,
     workspaceId = null,
     pathScope = null,
+    appId = null,
   ) =>
     ipcRenderer$j.invoke(MCP_START_SERVER, {
       serverName,
@@ -74978,6 +75659,7 @@ const mcpApi$2 = {
       credentials,
       workspaceId,
       pathScope,
+      appId,
     }),
 
   /**
@@ -75131,6 +75813,27 @@ const mcpApi$2 = {
    */
   runAuth: (mcpConfig, credentials, authCommand) =>
     ipcRenderer$j.invoke(MCP_RUN_AUTH, { mcpConfig, credentials, authCommand }),
+
+  /**
+   * authorize
+   * Run the interactive OAuth 2.0 authorization flow for a custom
+   * streamable_http MCP server (opens the system browser). Tokens are
+   * persisted encrypted in the main process; a later startServer reuses
+   * them with no browser.
+   *
+   * @param {string} serverName the provider/server name (token storage key)
+   * @param {object} mcpConfig { transport: "streamable_http", auth: "oauth", url, oauth }
+   * @param {object} credentials decrypted credentials (URL interpolation)
+   * @param {string} appId application id (token storage namespace)
+   * @returns {Promise<{ success, serverName, tools } | { error, message }>}
+   */
+  authorize: (serverName, mcpConfig, credentials, appId = null) =>
+    ipcRenderer$j.invoke(MCP_AUTHORIZE, {
+      serverName,
+      mcpConfig,
+      credentials,
+      appId,
+    }),
 };
 
 var mcpApi_1 = mcpApi$2;
@@ -75538,6 +76241,7 @@ const {
   LLM_CLEAR_CLI_SESSION,
   LLM_CLI_SESSION_STATUS,
   LLM_CLI_END_SESSION,
+  LLM_LIST_MODELS,
   LLM_STREAM_DELTA,
   LLM_STREAM_TOOL_CALL,
   LLM_STREAM_TOOL_RESULT,
@@ -75594,6 +76298,19 @@ const llmApi$2 = {
    */
   checkCliAvailable: () => ipcRenderer$d.invoke(LLM_CHECK_CLI_AVAILABLE),
 
+  /**
+   * listModels
+   * Discover selectable models for a provider. With an apiKey, the main
+   * process attempts a live fetch (e.g. Anthropic Models API); otherwise it
+   * returns the provider's curated fallback list.
+   *
+   * @param {string} providerId - vendor id, e.g. "anthropic"
+   * @param {string|null} apiKey - decrypted key for the live fetch (optional)
+   * @returns {Promise<{ models, source }>}
+   */
+  listModels: (providerId, apiKey = null) =>
+    ipcRenderer$d.invoke(LLM_LIST_MODELS, { providerId, apiKey }),
+
   /**
    * clearCliSession
    * Clear the CLI conversation session for a widget (for "New Chat").