@xopcai/xopc 0.0.224 → 0.0.227

package/dist/src/agent/mcp/bundle-mcp-config.js

@@ -1,26 +1,22 @@
 import { normalizeConfiguredMcpServers } from "../../config/mcp-config-normalize.js";
-import { loadEnabledBundleMcpConfig } from "../../extensions/bundle-mcp.js";
+import { inspectExtensionConnectorDependencies } from "../../extensions/connector-dependencies.js";
 //#region src/agent/mcp/bundle-mcp-config.ts
 function listConfiguredMcpServers(params) {
 	const configuredMcp = normalizeConfiguredMcpServers(params.cfg?.mcp?.servers);
-	return Object.fromEntries(Object.entries(configuredMcp).map(([name, server]) => [name, params.mapConfiguredServer(server, name)]));
+	return Object.fromEntries(Object.entries(configuredMcp).filter(([, server]) => {
+		const marker = server.xopcConnector;
+		return !marker || typeof marker !== "object" || Array.isArray(marker) || marker.enabled !== false;
+	}).map(([name, server]) => [name, params.mapConfiguredServer(server, name)]));
 }
 function loadMergedBundleMcpConfig(params) {
 	const mapConfiguredServer = params.mapConfiguredServer ?? ((server) => server);
-	const bundled = loadEnabledBundleMcpConfig({
-		workspaceDir: params.workspaceDir,
-		cfg: params.cfg
-	});
-	const configured = listConfiguredMcpServers({
-		cfg: params.cfg,
-		mapConfiguredServer
-	});
+	params.workspaceDir;
 	return {
-		config: { mcpServers: {
-			...bundled.config.mcpServers,
-			...configured
-		} },
-		diagnostics: bundled.diagnostics
+		config: { mcpServers: { ...listConfiguredMcpServers({
+			cfg: params.cfg,
+			mapConfiguredServer
+		}) } },
+		diagnostics: inspectExtensionConnectorDependencies({ cfg: params.cfg })
 	};
 }
 //#endregion

package/dist/src/agent/mcp/embedded-mcp.d.ts

@@ -1,5 +1,5 @@
 import type { Config } from "../../config/schema.js";
-import type { BundleMcpDiagnostic, BundleMcpServerConfig } from "../../extensions/bundle-mcp.js";
+import { type BundleMcpDiagnostic, type BundleMcpServerConfig } from "./bundle-mcp-config.js";
 export type EmbeddedMcpConfig = {
     mcpServers: Record<string, BundleMcpServerConfig>;
     diagnostics: BundleMcpDiagnostic[];

package/dist/src/agent/mcp/index.d.ts

@@ -2,3 +2,4 @@ export * from './bundle-mcp-tools.js';
 export * from './bundle-mcp-policy.js';
 export * from './bundle-mcp-config.js';
 export * from './embedded-mcp.js';
+export * from './oauth/index.js';

package/dist/src/agent/mcp/index.js

@@ -1,6 +1,12 @@
 import { isMcpCatalogToolDenied, mcpToolPolicyId, resolveMcpToolPolicy } from "./bundle-mcp-policy.js";
 import { loadMergedBundleMcpConfig } from "./bundle-mcp-config.js";
 import { loadEmbeddedMcpConfig } from "./embedded-mcp.js";
+import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./oauth/mcp-oauth-errors.js";
+import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./oauth/mcp-oauth-store.js";
+import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
 import { __testing, createSessionMcpRuntime, disposeAllSessionMcpRuntimes, disposeSessionMcpRuntime, getOrCreateSessionMcpRuntime, getSessionMcpRuntimeManager, retireSessionMcpRuntime, retireSessionMcpRuntimeForSessionKey } from "./bundle-mcp-runtime.js";
 import "./bundle-mcp-tools.js";
-export { __testing, createSessionMcpRuntime, disposeAllSessionMcpRuntimes, disposeSessionMcpRuntime, getOrCreateSessionMcpRuntime, getSessionMcpRuntimeManager, isMcpCatalogToolDenied, loadEmbeddedMcpConfig, loadMergedBundleMcpConfig, mcpToolPolicyId, resolveMcpToolPolicy, retireSessionMcpRuntime, retireSessionMcpRuntimeForSessionKey };
+import { McpOAuthSession } from "./oauth/mcp-oauth-session.js";
+import { McpOAuthManager, getMcpOAuthManager } from "./oauth/mcp-oauth-manager.js";
+import "./oauth/index.js";
+export { McpAuthorizationRequiredError, McpOAuthManager, McpOAuthSession, McpOAuthStore, XopcMcpOAuthClientProvider, __testing, canonicalMcpServerUrl, createSessionMcpRuntime, disposeAllSessionMcpRuntimes, disposeSessionMcpRuntime, getMcpOAuthManager, getOrCreateSessionMcpRuntime, getSessionMcpRuntimeManager, isMcpAuthorizationError, isMcpCatalogToolDenied, loadEmbeddedMcpConfig, loadMergedBundleMcpConfig, mcpOAuthServerKey, mcpToolPolicyId, resolveMcpToolPolicy, retireSessionMcpRuntime, retireSessionMcpRuntimeForSessionKey };

package/dist/src/agent/mcp/mcp-http.d.ts

@@ -3,6 +3,10 @@ export type HttpMcpServerLaunchConfig = {
     transportType: HttpMcpTransportType;
     url: string;
     headers?: Record<string, string>;
+    auth?: {
+        type: "oauth";
+        clientId?: string;
+    };
 };
 export type HttpMcpServerLaunchResult = {
     ok: true;

package/dist/src/agent/mcp/mcp-http.js

@@ -27,12 +27,36 @@ function resolveHttpMcpServerLaunchConfig(raw, options) {
 	let headers;
 	if (raw.headers !== void 0 && raw.headers !== null) if (!isMcpConfigRecord(raw.headers)) options?.onMalformedHeaders?.(raw.headers);
 	else headers = toMcpStringRecord(raw.headers, { onDroppedEntry: options?.onDroppedHeader });
+	let auth;
+	if (raw.auth !== void 0) {
+		if (!isMcpConfigRecord(raw.auth) || raw.auth.type !== "oauth") return {
+			ok: false,
+			reason: "its auth must be { \"type\": \"oauth\" }"
+		};
+		if (raw.auth.clientId !== void 0 && (typeof raw.auth.clientId !== "string" || !raw.auth.clientId.trim())) return {
+			ok: false,
+			reason: "its OAuth clientId must be a non-empty string"
+		};
+		if ((options?.transportType ?? "streamable-http") !== "streamable-http") return {
+			ok: false,
+			reason: "OAuth supports streamable HTTP only"
+		};
+		if (headers && Object.keys(headers).some((key) => key.toLowerCase() === "authorization")) return {
+			ok: false,
+			reason: "OAuth cannot be combined with a static Authorization header"
+		};
+		auth = {
+			type: "oauth",
+			...typeof raw.auth.clientId === "string" ? { clientId: raw.auth.clientId.trim() } : {}
+		};
+	}
 	return {
 		ok: true,
 		config: {
 			transportType: options?.transportType ?? "streamable-http",
 			url,
-			headers
+			headers,
+			auth
 		}
 	};
 }

package/dist/src/agent/mcp/mcp-transport-config.d.ts

@@ -17,6 +17,10 @@ export type ResolvedHttpMcpTransportConfig = ResolvedBaseMcpTransportConfig & {
     transportType: HttpMcpTransportType;
     url: string;
     headers?: Record<string, string>;
+    auth?: {
+        type: "oauth";
+        clientId?: string;
+    };
 };
 export type ResolvedMcpTransportConfig = ResolvedStdioMcpTransportConfig | ResolvedHttpMcpTransportConfig;
 export declare const DEFAULT_MCP_REQUEST_TIMEOUT_MS = 60000;

package/dist/src/agent/mcp/mcp-transport-config.js

@@ -50,6 +50,7 @@ function resolveHttpTransportConfig(serverName, rawServer, transportType) {
 		transportType: launch.config.transportType,
 		url: launch.config.url,
 		headers: launch.config.headers,
+		auth: launch.config.auth,
 		description: describeHttpMcpServerLaunchConfig(launch.config),
 		connectionTimeoutMs: getConnectionTimeoutMs(rawServer),
 		requestTimeoutMs: getRequestTimeoutMs(rawServer)

package/dist/src/agent/mcp/mcp-transport.d.ts

@@ -1,5 +1,7 @@
+import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import type { Config } from "../../config/schema.js";
+import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
 export type ResolvedMcpTransport = {
     transport: Transport;
     description: string;
@@ -8,4 +10,8 @@ export type ResolvedMcpTransport = {
     requestTimeoutMs: number;
     detachStderr?: () => void;
 };
-export declare function resolveMcpTransport(serverName: string, rawServer: unknown, config?: Config): Promise<ResolvedMcpTransport | null>;
+export type ResolveMcpTransportOptions = {
+    oauthProvider?: OAuthClientProvider;
+    oauthStore?: McpOAuthStore;
+};
+export declare function resolveMcpTransport(serverName: string, rawServer: unknown, config?: Config, options?: ResolveMcpTransportOptions): Promise<ResolvedMcpTransport | null>;

package/dist/src/agent/mcp/mcp-transport.js

@@ -5,6 +5,8 @@ import { init_string_coerce, normalizeOptionalString } from "../../utils/string-
 import { buildRuntimeEnvironment, resolveRuntimeCommand } from "../../runtime-tools/environment.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
+import { McpOAuthStore } from "./oauth/mcp-oauth-store.js";
+import { XopcMcpOAuthClientProvider } from "./oauth/mcp-oauth-provider.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { getDefaultEnvironment } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -48,7 +50,18 @@ function buildSseEventSourceFetch(headers) {
 		});
 	};
 }
-async function resolveMcpTransport(serverName, rawServer, config) {
+function buildScopedHttpFetch(serverUrl, headers) {
+	return async (url, init) => {
+		const mergedHeaders = new Headers();
+		if (new URL(url).origin === serverUrl.origin) for (const [key, value] of Object.entries(headers)) mergedHeaders.set(key, value);
+		if (init?.headers) new Headers(init.headers).forEach((value, key) => mergedHeaders.set(key, value));
+		return fetchWithUndici(url, {
+			...init,
+			headers: mergedHeaders
+		});
+	};
+}
+async function resolveMcpTransport(serverName, rawServer, config, options = {}) {
 	const resolved = resolveMcpTransportConfig(serverName, rawServer);
 	if (!resolved) return null;
 	if (resolved.kind === "stdio") {
@@ -82,16 +95,30 @@ async function resolveMcpTransport(serverName, rawServer, config) {
 			detachStderr: attachStderrLogging(serverName, transport)
 		};
 	}
-	if (resolved.transportType === "streamable-http") return {
-		transport: new StreamableHTTPClientTransport(new URL(resolved.url), {
-			requestInit: resolved.headers ? { headers: resolved.headers } : void 0,
-			fetch: fetchWithUndici
-		}),
-		description: resolved.description,
-		transportType: "streamable-http",
-		connectionTimeoutMs: resolved.connectionTimeoutMs,
-		requestTimeoutMs: resolved.requestTimeoutMs
-	};
+	if (resolved.transportType === "streamable-http") {
+		const serverUrl = new URL(resolved.url);
+		const oauthEnabled = Boolean(resolved.auth);
+		let oauthProvider = options.oauthProvider;
+		if (resolved.auth && !oauthProvider) {
+			const store = options.oauthStore ?? new McpOAuthStore();
+			if ((await store.load(serverUrl))?.tokens) oauthProvider = new XopcMcpOAuthClientProvider({
+				serverUrl,
+				clientId: resolved.auth.clientId,
+				store
+			});
+		}
+		return {
+			transport: new StreamableHTTPClientTransport(serverUrl, {
+				authProvider: oauthProvider,
+				requestInit: !oauthEnabled && resolved.headers ? { headers: resolved.headers } : void 0,
+				fetch: oauthEnabled ? buildScopedHttpFetch(serverUrl, resolved.headers ?? {}) : fetchWithUndici
+			}),
+			description: resolved.description,
+			transportType: "streamable-http",
+			connectionTimeoutMs: resolved.connectionTimeoutMs,
+			requestTimeoutMs: resolved.requestTimeoutMs
+		};
+	}
 	const headers = { ...resolved.headers };
 	const hasHeaders = Object.keys(headers).length > 0;
 	return {

package/dist/src/agent/mcp/oauth/index.d.ts

@@ -0,0 +1,6 @@
+export * from './mcp-oauth-errors.js';
+export * from './mcp-oauth-manager.js';
+export * from './mcp-oauth-provider.js';
+export * from './mcp-oauth-session.js';
+export * from './mcp-oauth-store.js';
+export type * from './mcp-oauth-types.js';

package/dist/src/agent/mcp/oauth/index.js

@@ -0,0 +1,6 @@
+import { McpAuthorizationRequiredError, isMcpAuthorizationError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore, canonicalMcpServerUrl, mcpOAuthServerKey } from "./mcp-oauth-store.js";
+import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
+import { McpOAuthSession } from "./mcp-oauth-session.js";
+import { McpOAuthManager, getMcpOAuthManager } from "./mcp-oauth-manager.js";
+export { McpAuthorizationRequiredError, McpOAuthManager, McpOAuthSession, McpOAuthStore, XopcMcpOAuthClientProvider, canonicalMcpServerUrl, getMcpOAuthManager, isMcpAuthorizationError, mcpOAuthServerKey };

package/dist/src/agent/mcp/oauth/mcp-oauth-errors.d.ts

@@ -0,0 +1,5 @@
+export declare class McpAuthorizationRequiredError extends Error {
+    readonly code = "MCP_AUTHORIZATION_REQUIRED";
+    constructor(message?: string);
+}
+export declare function isMcpAuthorizationError(error: unknown): boolean;

package/dist/src/agent/mcp/oauth/mcp-oauth-errors.js

@@ -0,0 +1,14 @@
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+//#region src/agent/mcp/oauth/mcp-oauth-errors.ts
+var McpAuthorizationRequiredError = class extends Error {
+	code = "MCP_AUTHORIZATION_REQUIRED";
+	constructor(message = "MCP server authorization is required") {
+		super(message);
+		this.name = "McpAuthorizationRequiredError";
+	}
+};
+function isMcpAuthorizationError(error) {
+	return error instanceof UnauthorizedError || error instanceof McpAuthorizationRequiredError;
+}
+//#endregion
+export { McpAuthorizationRequiredError, isMcpAuthorizationError };

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.d.ts

@@ -0,0 +1,25 @@
+import type { Config } from '../../../config/schema.js';
+import { McpOAuthStore } from './mcp-oauth-store.js';
+import type { McpOAuthSessionSnapshot } from './mcp-oauth-types.js';
+export type McpOAuthConnectionStatus = 'not_configured' | 'disconnected' | 'authorizing' | 'connected' | 'error';
+export type McpOAuthStatus = {
+    configured: boolean;
+    status: McpOAuthConnectionStatus;
+    session?: McpOAuthSessionSnapshot;
+};
+type StartMcpOAuthParams = {
+    serverId: string;
+    rawServer: unknown;
+    cfg?: Config;
+};
+export declare class McpOAuthManager {
+    private readonly store;
+    private readonly sessionsByServerUrl;
+    constructor(store?: McpOAuthStore);
+    status(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
+    start(params: StartMcpOAuthParams): Promise<McpOAuthStatus>;
+    disconnect(serverId: string, rawServer: unknown): Promise<McpOAuthStatus>;
+    private finishAuthorization;
+}
+export declare function getMcpOAuthManager(): McpOAuthManager;
+export {};

package/dist/src/agent/mcp/oauth/mcp-oauth-manager.js

@@ -0,0 +1,219 @@
+import { createLogger } from "../../../utils/logger/index.js";
+import { init_logger } from "../../../utils/logger.js";
+import { resolveGlobalSingleton } from "../../../utils/global-singleton.js";
+import { redactSensitiveUrlLikeString } from "../../../utils/redact-sensitive-url.js";
+import { resolveConnectorSecretReferences } from "../../../connectors/secret-store.js";
+import { resolveMcpTransportConfig } from "../mcp-transport-config.js";
+import { isMcpAuthorizationError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore, canonicalMcpServerUrl } from "./mcp-oauth-store.js";
+import { XopcMcpOAuthClientProvider } from "./mcp-oauth-provider.js";
+import { resolveMcpTransport } from "../mcp-transport.js";
+import { disposeAllSessionMcpRuntimes } from "../bundle-mcp-runtime.js";
+import { McpOAuthSession } from "./mcp-oauth-session.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+//#region src/agent/mcp/oauth/mcp-oauth-manager.ts
+init_logger();
+const log = createLogger("Mcp:OAuth");
+const MCP_OAUTH_MANAGER_KEY = Symbol.for("xopc.mcpOAuthManager");
+function createClient() {
+	return new Client({
+		name: "xopc-mcp-oauth",
+		version: "0.0.0"
+	});
+}
+async function connectClient(client, resolved) {
+	await new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`MCP server connection timed out after ${resolved.connectionTimeoutMs}ms`)), resolved.connectionTimeoutMs);
+		client.connect(resolved.transport).then(() => {
+			clearTimeout(timer);
+			resolve();
+		}, (error) => {
+			clearTimeout(timer);
+			reject(error);
+		});
+	});
+}
+async function closeConnection(client, resolved) {
+	await client.close().catch(() => {});
+	await resolved.transport.close().catch(() => {});
+	resolved.detachStderr?.();
+}
+function isAuthorizing(snapshot) {
+	return [
+		"starting",
+		"waiting_browser",
+		"exchanging_code"
+	].includes(snapshot.status);
+}
+var McpOAuthManager = class {
+	store;
+	sessionsByServerUrl = /* @__PURE__ */ new Map();
+	constructor(store = new McpOAuthStore()) {
+		this.store = store;
+	}
+	async status(serverId, rawServer) {
+		const resolved = resolveMcpTransportConfig(serverId, rawServer);
+		if (!resolved || resolved.kind !== "http" || !resolved.auth) return {
+			configured: false,
+			status: "not_configured"
+		};
+		const session = this.sessionsByServerUrl.get(canonicalMcpServerUrl(resolved.url))?.snapshot();
+		if (session) {
+			if (isAuthorizing(session)) return {
+				configured: true,
+				status: "authorizing",
+				session
+			};
+			if (session.status === "failed" || session.status === "expired") return {
+				configured: true,
+				status: "error",
+				session
+			};
+			if (session.status === "connected") return {
+				configured: true,
+				status: "connected",
+				session
+			};
+		}
+		return {
+			configured: true,
+			status: (await this.store.load(resolved.url))?.tokens ? "connected" : "disconnected",
+			session
+		};
+	}
+	async start(params) {
+		const rawServer = await resolveConnectorSecretReferences(params.rawServer);
+		const resolvedConfig = resolveMcpTransportConfig(params.serverId, rawServer);
+		if (!resolvedConfig || resolvedConfig.kind !== "http" || !resolvedConfig.auth) throw new Error(`MCP server "${params.serverId}" is not configured for OAuth`);
+		const serverUrl = new URL(resolvedConfig.url);
+		const sessionKey = canonicalMcpServerUrl(serverUrl);
+		const previous = this.sessionsByServerUrl.get(sessionKey);
+		if (previous && isAuthorizing(previous.snapshot())) return this.status(params.serverId, params.rawServer);
+		if (previous) await previous.close();
+		const session = new McpOAuthSession(params.serverId, serverUrl);
+		this.sessionsByServerUrl.set(sessionKey, session);
+		try {
+			await session.start();
+		} catch (error) {
+			this.sessionsByServerUrl.delete(sessionKey);
+			throw error;
+		}
+		try {
+			await this.store.update(serverUrl, (current) => current ? {
+				...current,
+				clientInformation: void 0,
+				tokens: void 0,
+				tokensSavedAt: void 0
+			} : void 0);
+		} catch (error) {
+			session.fail(error);
+			throw error;
+		}
+		let provider;
+		let resolved;
+		try {
+			provider = new XopcMcpOAuthClientProvider({
+				serverUrl,
+				clientId: resolvedConfig.auth.clientId,
+				store: this.store,
+				interaction: {
+					redirectUrl: session.redirectUrl,
+					state: session.state,
+					onRedirect: (authorizationUrl) => session.setAuthorizationUrl(authorizationUrl)
+				}
+			});
+			resolved = await resolveMcpTransport(params.serverId, rawServer, params.cfg, {
+				oauthProvider: provider,
+				oauthStore: this.store
+			});
+		} catch (error) {
+			session.fail(error);
+			return this.status(params.serverId, params.rawServer);
+		}
+		if (!resolved || resolved.transportType !== "streamable-http") {
+			session.fail(/* @__PURE__ */ new Error("MCP OAuth requires a streamable HTTP transport"));
+			await resolved?.transport.close().catch(() => {});
+			return this.status(params.serverId, params.rawServer);
+		}
+		const client = createClient();
+		try {
+			await connectClient(client, resolved);
+			session.complete();
+			await closeConnection(client, resolved);
+			await disposeAllSessionMcpRuntimes();
+		} catch (error) {
+			if (!isMcpAuthorizationError(error) || !session.snapshot().authorizationUrl) {
+				session.fail(error);
+				await closeConnection(client, resolved);
+			} else this.finishAuthorization({
+				session,
+				provider,
+				client,
+				resolved,
+				params: {
+					...params,
+					rawServer
+				}
+			});
+		}
+		return this.status(params.serverId, params.rawServer);
+	}
+	async disconnect(serverId, rawServer) {
+		const resolved = resolveMcpTransportConfig(serverId, rawServer);
+		if (!resolved || resolved.kind !== "http" || !resolved.auth) throw new Error(`MCP server "${serverId}" is not configured for OAuth`);
+		const sessionKey = canonicalMcpServerUrl(resolved.url);
+		const session = this.sessionsByServerUrl.get(sessionKey);
+		this.sessionsByServerUrl.delete(sessionKey);
+		if (session) await session.close();
+		await this.store.delete(resolved.url);
+		await disposeAllSessionMcpRuntimes();
+		return {
+			configured: true,
+			status: "disconnected"
+		};
+	}
+	async finishAuthorization(context) {
+		const { session, provider, client, resolved, params } = context;
+		try {
+			const code = await session.waitForCode();
+			await resolved.transport.finishAuth(code);
+			if (session.snapshot().status === "cancelled") {
+				await this.store.delete(session.serverUrl);
+				await closeConnection(client, resolved);
+				return;
+			}
+			await closeConnection(client, resolved);
+			const authenticated = await resolveMcpTransport(params.serverId, params.rawServer, params.cfg, {
+				oauthProvider: provider,
+				oauthStore: this.store
+			});
+			if (!authenticated) throw new Error("MCP transport could not be created after authorization");
+			const authenticatedClient = createClient();
+			try {
+				await connectClient(authenticatedClient, authenticated);
+			} finally {
+				await closeConnection(authenticatedClient, authenticated);
+			}
+			session.complete();
+			await disposeAllSessionMcpRuntimes();
+		} catch (error) {
+			if (session.snapshot().status === "cancelled") {
+				await this.store.delete(session.serverUrl);
+				await closeConnection(client, resolved);
+				return;
+			}
+			session.fail(error);
+			await closeConnection(client, resolved);
+			log.warn({
+				err: error,
+				phase: "mcp.oauth_finish",
+				serverId: params.serverId
+			}, `MCP OAuth failed for server "${params.serverId}": ${redactSensitiveUrlLikeString(error instanceof Error ? error.message : String(error))}`);
+		}
+	}
+};
+function getMcpOAuthManager() {
+	return resolveGlobalSingleton(MCP_OAUTH_MANAGER_KEY, () => new McpOAuthManager());
+}
+//#endregion
+export { McpOAuthManager, getMcpOAuthManager };

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.d.ts

@@ -0,0 +1,33 @@
+import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { McpOAuthStore } from './mcp-oauth-store.js';
+export type McpOAuthInteraction = {
+    redirectUrl: URL;
+    state: string;
+    onRedirect: (authorizationUrl: URL) => void | Promise<void>;
+};
+export type McpOAuthClientProviderOptions = {
+    serverUrl: URL;
+    clientId?: string;
+    interaction?: McpOAuthInteraction;
+    store?: McpOAuthStore;
+};
+export declare class XopcMcpOAuthClientProvider implements OAuthClientProvider {
+    private readonly options;
+    private readonly store;
+    private codeVerifierValue?;
+    constructor(options: McpOAuthClientProviderOptions);
+    get redirectUrl(): URL;
+    get clientMetadata(): OAuthClientMetadata;
+    state(): string | undefined;
+    clientInformation(): Promise<OAuthClientInformationMixed | undefined>;
+    saveClientInformation(clientInformation: OAuthClientInformationMixed): Promise<void>;
+    tokens(): Promise<OAuthTokens | undefined>;
+    saveTokens(tokens: OAuthTokens): Promise<void>;
+    redirectToAuthorization(authorizationUrl: URL): Promise<void>;
+    saveCodeVerifier(codeVerifier: string): void;
+    codeVerifier(): string;
+    saveDiscoveryState(discoveryState: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+    invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
+}

package/dist/src/agent/mcp/oauth/mcp-oauth-provider.js

@@ -0,0 +1,103 @@
+import { McpAuthorizationRequiredError } from "./mcp-oauth-errors.js";
+import { McpOAuthStore } from "./mcp-oauth-store.js";
+//#region src/agent/mcp/oauth/mcp-oauth-provider.ts
+var XopcMcpOAuthClientProvider = class {
+	store;
+	codeVerifierValue;
+	constructor(options) {
+		this.options = options;
+		this.store = options.store ?? new McpOAuthStore();
+	}
+	get redirectUrl() {
+		return this.options.interaction?.redirectUrl ?? new URL("http://127.0.0.1/oauth/callback");
+	}
+	get clientMetadata() {
+		return {
+			client_name: "XOPC",
+			client_uri: "https://xopc.ai",
+			redirect_uris: [this.redirectUrl.toString()],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none"
+		};
+	}
+	state() {
+		return this.options.interaction?.state;
+	}
+	async clientInformation() {
+		if (this.options.clientId) return { client_id: this.options.clientId };
+		return (await this.store.load(this.options.serverUrl))?.clientInformation;
+	}
+	async saveClientInformation(clientInformation) {
+		await this.store.update(this.options.serverUrl, (current) => ({
+			...current,
+			version: 1,
+			serverUrl: this.options.serverUrl.toString(),
+			clientInformation,
+			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+		}));
+	}
+	async tokens() {
+		return (await this.store.load(this.options.serverUrl))?.tokens;
+	}
+	async saveTokens(tokens) {
+		await this.store.update(this.options.serverUrl, (current) => ({
+			...current,
+			version: 1,
+			serverUrl: this.options.serverUrl.toString(),
+			tokens,
+			tokensSavedAt: Date.now(),
+			updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+		}));
+	}
+	async redirectToAuthorization(authorizationUrl) {
+		if (!this.options.interaction) throw new McpAuthorizationRequiredError();
+		await this.options.interaction.onRedirect(authorizationUrl);
+	}
+	saveCodeVerifier(codeVerifier) {
+		this.codeVerifierValue = codeVerifier;
+	}
+	codeVerifier() {
+		if (!this.codeVerifierValue) throw new Error("MCP OAuth code verifier is unavailable");
+		return this.codeVerifierValue;
+	}
+	async saveDiscoveryState(discoveryState) {
+		await this.store.update(this.options.serverUrl, (current) => {
+			const authorizationServerChanged = Boolean(current?.discoveryState?.authorizationServerUrl && current.discoveryState.authorizationServerUrl !== discoveryState.authorizationServerUrl);
+			return {
+				...current,
+				version: 1,
+				serverUrl: this.options.serverUrl.toString(),
+				discoveryState,
+				clientInformation: authorizationServerChanged ? void 0 : current?.clientInformation,
+				tokens: authorizationServerChanged ? void 0 : current?.tokens,
+				tokensSavedAt: authorizationServerChanged ? void 0 : current?.tokensSavedAt,
+				updatedAt: current?.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+			};
+		});
+	}
+	async discoveryState() {
+		return (await this.store.load(this.options.serverUrl))?.discoveryState;
+	}
+	async invalidateCredentials(scope) {
+		if (scope === "verifier") {
+			this.codeVerifierValue = void 0;
+			return;
+		}
+		await this.store.update(this.options.serverUrl, (current) => {
+			if (!current) return void 0;
+			if (scope === "all") return void 0;
+			return {
+				...current,
+				...scope === "client" ? { clientInformation: void 0 } : {},
+				...scope === "tokens" ? {
+					tokens: void 0,
+					tokensSavedAt: void 0
+				} : {},
+				...scope === "discovery" ? { discoveryState: void 0 } : {}
+			};
+		});
+	}
+};
+//#endregion
+export { XopcMcpOAuthClientProvider };