@xrkseek/harness 0.3.11 → 0.4.0-rc.2

package/node_modules/@xrkseek/mcp/dist/list-tools.js

@@ -1,13 +1,24 @@
+/**
+ * Hard cap on `tools/list` pages per discovery (cycle detection alone is not
+ * enough when every cursor is unique). Matches a conservative MCP client bound.
+ */
+export const MAX_TOOLS_LIST_PAGES = 100;
 /**
  * Drain paginated `tools/list` into one generation.
  * A repeated `nextCursor` rejects without returning a partial list — callers
  * that already registered tools keep the previous generation (register watch).
+ * Exceeding {@link MAX_TOOLS_LIST_PAGES} also rejects (non-terminating pagination).
  */
 export async function drainToolsListPages(serverName, fetchPage) {
     const seenCursors = new Set();
     const byName = new Map();
     let cursor;
+    let pages = 0;
     do {
+        pages += 1;
+        if (pages > MAX_TOOLS_LIST_PAGES) {
+            throw new Error(`mcp-client(${serverName}): tools/list exceeded ${MAX_TOOLS_LIST_PAGES} pages — invalid tool list`);
+        }
         const page = await fetchPage(cursor);
         for (const tool of page.tools) {
             if (byName.has(tool.name)) {
@@ -28,4 +39,33 @@ export async function drainToolsListPages(serverName, fetchPage) {
     } while (cursor !== undefined);
     return [...byName.values()];
 }
+/**
+ * True when `tools/list` is unsupported (no tools capability, or MethodNotFound).
+ * Empty tool lists from capable servers are not treated as unsupported.
+ */
+export function isToolsListUnsupported(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const err = error;
+    if (err.code === -32601)
+        return true;
+    const message = String(err.message ?? "");
+    return (/MethodNotFound/i.test(message) ||
+        /does not support tools/i.test(message) ||
+        /method not found/i.test(message));
+}
+/**
+ * True when a resources/* method is unsupported (MethodNotFound / capability).
+ */
+export function isResourcesUnsupported(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const err = error;
+    if (err.code === -32601)
+        return true;
+    const message = String(err.message ?? "");
+    return (/MethodNotFound/i.test(message) ||
+        /does not support resources/i.test(message) ||
+        /method not found/i.test(message));
+}
 //# sourceMappingURL=list-tools.js.map

package/node_modules/@xrkseek/mcp/dist/list-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-tools.js","sourceRoot":"","sources":["../src/list-tools.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,SAAyD;IAEzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,cAAc,UAAU,0BAA0B,IAAI,CAAC,IAAI,sCAAsC,CAClG,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,cAAc,UAAU,yEAAyE,CAClG,CAAC;YACJ,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"list-tools.js","sourceRoot":"","sources":["../src/list-tools.ts"],"names":[],"mappings":"AASA;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,SAAyD;IAEzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,GAAG,CAAC;QACF,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,cAAc,UAAU,0BAA0B,oBAAoB,4BAA4B,CACnG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,cAAc,UAAU,0BAA0B,IAAI,CAAC,IAAI,sCAAsC,CAClG,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,cAAc,UAAU,yEAAyE,CAClG,CAAC;YACJ,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,KAA8C,CAAC;IAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC;QACvC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,KAA8C,CAAC;IAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;QAC/B,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAClC,CAAC;AACJ,CAAC"}

package/node_modules/@xrkseek/mcp/dist/oauth-device.d.ts

@@ -0,0 +1,104 @@
+/** Endpoints + client identity for one authorization server. */
+export interface McpDeviceCodeEndpoints {
+    /** RFC 8628 device authorization endpoint. */
+    readonly deviceAuthorizationUrl: string;
+    /** RFC 6749 token endpoint (also used for refresh). */
+    readonly tokenUrl: string;
+    readonly clientId: string;
+    readonly scopes?: readonly string[];
+    /** OAuth `resource` / `audience` param when the server expects it. */
+    readonly audience?: string;
+}
+/** What the human is shown while the flow is pending. */
+export interface McpDeviceCodeStart {
+    readonly deviceCode: string;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    /** Prefilled URL when the server returns `verification_uri_complete`. */
+    readonly verificationUriComplete?: string;
+    /** Seconds until the device code expires. */
+    readonly expiresIn: number;
+    /** Minimum seconds between polls. */
+    readonly interval: number;
+}
+/** A token set as persisted in the token store. */
+export interface McpDeviceTokenSet {
+    readonly accessToken: string;
+    readonly tokenType: string;
+    readonly refreshToken?: string;
+    readonly scope?: string;
+    /** Epoch ms; absent when the server returned no `expires_in`. */
+    readonly expiresAt?: number;
+}
+export type McpDeviceCodeErrorCode = "device-authorization-failed" | "access-denied" | "expired-token" | "invalid-response" | "refresh-failed" | "aborted";
+/** Failure with the OAuth error code preserved for callers / tests. */
+export declare class McpDeviceCodeError extends Error {
+    readonly code: McpDeviceCodeErrorCode;
+    /** Raw OAuth `error` string when the failure came from the server. */
+    readonly oauthError?: string;
+    constructor(code: McpDeviceCodeErrorCode, message: string, oauthError?: string);
+}
+/** Injected side effects; all optional so prod callers pass nothing. */
+export interface McpDeviceCodeDeps {
+    readonly fetch?: typeof fetch;
+    /** Epoch-ms clock (tests advance it with the fake sleep). */
+    readonly now?: () => number;
+    readonly sleep?: (ms: number) => Promise<void>;
+    /** Called once with the user code the human must approve. */
+    readonly onPrompt?: (start: McpDeviceCodeStart) => void;
+    /** Called before each poll after the first (progress / backoff logging). */
+    readonly onPending?: (attempt: number, intervalMs: number) => void;
+    readonly signal?: AbortSignal;
+}
+/** `device_authorization` response → validated start record. */
+export declare function parseDeviceCodeResponse(raw: unknown): McpDeviceCodeStart;
+/** Token endpoint JSON → validated token set (`expiresAt` from the clock). */
+export declare function parseTokenResponse(raw: unknown, now: () => number): McpDeviceTokenSet;
+/** Throwing form of {@link parseDeviceCodeResponse}. */
+export declare function assertDeviceCodeResponse(raw: unknown): McpDeviceCodeStart;
+/** Step 1: ask the authorization server for a user code. */
+export declare function startDeviceAuthorization(endpoints: McpDeviceCodeEndpoints, deps?: McpDeviceCodeDeps): Promise<McpDeviceCodeStart>;
+/**
+ * Step 2: poll the token endpoint until the human approves, honoring
+ * `authorization_pending` / `slow_down` per RFC 8628 and the device-code
+ * deadline. `sleep` advances the injected clock in tests.
+ */
+export declare function pollDeviceToken(endpoints: McpDeviceCodeEndpoints, start: McpDeviceCodeStart, deps?: McpDeviceCodeDeps): Promise<McpDeviceTokenSet>;
+/** Full login: start, announce the user code, then poll to completion. */
+export declare function loginWithDeviceCode(endpoints: McpDeviceCodeEndpoints, deps?: McpDeviceCodeDeps): Promise<{
+    start: McpDeviceCodeStart;
+    tokens: McpDeviceTokenSet;
+}>;
+/** Exchange a refresh token (no device code involved). */
+export declare function refreshDeviceToken(endpoints: McpDeviceCodeEndpoints, refreshToken: string, deps?: McpDeviceCodeDeps): Promise<McpDeviceTokenSet>;
+/** True when the token is absent an expiry or is inside the skew window. */
+export declare function isTokenExpired(tokens: McpDeviceTokenSet | undefined, now?: () => number, skewMs?: number): boolean;
+/** Request headers for the MCP HTTP transport. */
+export declare function deviceAuthorizationHeaders(tokens: McpDeviceTokenSet): Record<string, string>;
+/**
+ * Merge auth headers onto a transport `requestInit` without dropping any
+ * caller-supplied headers (case-insensitive, via `Headers`).
+ * Returns `undefined` when there is nothing to send.
+ */
+export declare function mergeAuthHeaders(requestInit: RequestInit | undefined, headers: Readonly<Record<string, string>> | undefined): RequestInit | undefined;
+/**
+ * Token store for one MCP server: JSON sidecar beside the session dir.
+ * `headers()` refreshes through the injected fetch when the access token is
+ * expired and a refresh token is available.
+ */
+export declare class McpDeviceTokenStore {
+    private readonly persistPath?;
+    private tokens;
+    constructor(persistPath?: string | undefined);
+    get(): McpDeviceTokenSet | undefined;
+    set(tokens: McpDeviceTokenSet | undefined): void;
+    clear(): void;
+    /**
+     * Headers to attach to the transport `requestInit`.
+     * Refreshes first when expired and a refresh token + endpoints are given.
+     */
+    headers(endpoints?: McpDeviceCodeEndpoints, deps?: McpDeviceCodeDeps): Promise<Record<string, string>>;
+    private load;
+    private save;
+}
+//# sourceMappingURL=oauth-device.d.ts.map

package/node_modules/@xrkseek/mcp/dist/oauth-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device.d.ts","sourceRoot":"","sources":["../src/oauth-device.ts"],"names":[],"mappings":"AAcA,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,uDAAuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,sBAAsB,GAC9B,6BAA6B,GAC7B,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,gBAAgB,GAChB,SAAS,CAAC;AAEd,uEAAuE;AACvE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;gBAEjB,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAM/E;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AA4BD,gEAAgE;AAChE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CA6BxE;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,GAAG,iBAAiB,CAsBrF;AAsCD,wDAAwD;AACxD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAEzE;AAED,4DAA4D;AAC5D,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,sBAAsB,EACjC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,kBAAkB,EACzB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAuE5B;AAED,0EAA0E;AAC1E,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,sBAAsB,EACjC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAKnE;AAED,0DAA0D;AAC1D,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,sBAAsB,EACjC,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAuB5B;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAC5B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,GAAG,GAAE,MAAM,MAAyB,EACpC,MAAM,GAAE,MAAuB,GAC9B,OAAO,CAIT;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,iBAAiB,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGxB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACpD,WAAW,GAAG,SAAS,CAMzB;AA0BD;;;;GAIG;AACH,qBAAa,mBAAmB;IAGlB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAFzC,OAAO,CAAC,MAAM,CAAgC;gBAEjB,WAAW,CAAC,EAAE,MAAM,YAAA;IAIjD,GAAG,IAAI,iBAAiB,GAAG,SAAS;IAIpC,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI;IAKhD,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACG,OAAO,CACX,SAAS,CAAC,EAAE,sBAAsB,EAClC,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAalC,OAAO,CAAC,IAAI;IAcZ,OAAO,CAAC,IAAI;CAOb"}

package/node_modules/@xrkseek/mcp/dist/oauth-device.js

@@ -0,0 +1,338 @@
+/**
+ * MCP HTTP OAuth 2.0 device authorization grant (RFC 8628).
+ *
+ * Remote MCP servers behind an IdP cannot open a browser on the Host box, so
+ * the login runs as a device-code flow: the Host prints a short user code, the
+ * human approves it on any device, and the Host polls for a bearer token.
+ *
+ * Everything the flow touches is injected (`fetch` · `sleep` · `now` ·
+ * `onPrompt`), so the poll loop is deterministic under test and the module
+ * stays free of globals, timers, and console output.
+ */
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+/** Failure with the OAuth error code preserved for callers / tests. */
+export class McpDeviceCodeError extends Error {
+    code;
+    /** Raw OAuth `error` string when the failure came from the server. */
+    oauthError;
+    constructor(code, message, oauthError) {
+        super(message);
+        this.name = "McpDeviceCodeError";
+        this.code = code;
+        if (oauthError !== undefined)
+            this.oauthError = oauthError;
+    }
+}
+const DEFAULT_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_STEP_SECONDS = 5;
+const EXPIRY_SKEW_MS = 30_000;
+function asRecord(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    return raw;
+}
+function readString(source, key) {
+    const value = source[key];
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function readNumber(source, key) {
+    const value = source[key];
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value === "string" && value.trim()) {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+/** `device_authorization` response → validated start record. */
+export function parseDeviceCodeResponse(raw) {
+    const body = asRecord(raw);
+    if (!body) {
+        throw new McpDeviceCodeError("invalid-response", "device authorization returned a non-object body");
+    }
+    const deviceCode = readString(body, "device_code");
+    const userCode = readString(body, "user_code");
+    const verificationUri = readString(body, "verification_uri") ?? readString(body, "verification_url");
+    if (!deviceCode || !userCode || !verificationUri) {
+        throw new McpDeviceCodeError("invalid-response", "device authorization response missing device_code / user_code / verification_uri");
+    }
+    const complete = readString(body, "verification_uri_complete");
+    const expiresIn = readNumber(body, "expires_in") ?? 600;
+    const interval = readNumber(body, "interval") ?? DEFAULT_INTERVAL_SECONDS;
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        ...(complete ? { verificationUriComplete: complete } : {}),
+        expiresIn: expiresIn > 0 ? expiresIn : 600,
+        interval: interval > 0 ? interval : DEFAULT_INTERVAL_SECONDS,
+    };
+}
+/** Token endpoint JSON → validated token set (`expiresAt` from the clock). */
+export function parseTokenResponse(raw, now) {
+    const body = asRecord(raw);
+    const accessToken = body ? readString(body, "access_token") : undefined;
+    if (!body || !accessToken) {
+        throw new McpDeviceCodeError("invalid-response", "token response missing access_token");
+    }
+    const expiresIn = readNumber(body, "expires_in");
+    const refreshToken = readString(body, "refresh_token");
+    const scope = readString(body, "scope");
+    const tokenType = readString(body, "token_type") ?? "Bearer";
+    return {
+        accessToken,
+        tokenType,
+        ...(refreshToken ? { refreshToken } : {}),
+        ...(scope ? { scope } : {}),
+        ...(expiresIn !== undefined && expiresIn > 0
+            ? { expiresAt: now() + expiresIn * 1000 }
+            : {}),
+    };
+}
+function formBody(fields) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(fields))
+        params.set(key, value);
+    return params.toString();
+}
+async function postForm(url, fields, deps) {
+    const doFetch = deps.fetch ?? fetch;
+    const response = await doFetch(url, {
+        method: "POST",
+        headers: {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+        },
+        body: formBody(fields),
+        ...(deps.signal ? { signal: deps.signal } : {}),
+    });
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    return { status: response.status, body };
+}
+function throwIfAborted(deps) {
+    if (deps.signal?.aborted) {
+        throw new McpDeviceCodeError("aborted", "device code login aborted");
+    }
+}
+/** Throwing form of {@link parseDeviceCodeResponse}. */
+export function assertDeviceCodeResponse(raw) {
+    return parseDeviceCodeResponse(raw);
+}
+/** Step 1: ask the authorization server for a user code. */
+export async function startDeviceAuthorization(endpoints, deps = {}) {
+    throwIfAborted(deps);
+    const fields = { client_id: endpoints.clientId };
+    if (endpoints.scopes && endpoints.scopes.length > 0) {
+        fields.scope = endpoints.scopes.join(" ");
+    }
+    if (endpoints.audience)
+        fields.resource = endpoints.audience;
+    const { status, body } = await postForm(endpoints.deviceAuthorizationUrl, fields, deps);
+    if (status >= 400) {
+        const err = asRecord(body);
+        throw new McpDeviceCodeError("device-authorization-failed", `device authorization failed with HTTP ${status}`, err ? readString(err, "error") : undefined);
+    }
+    return parseDeviceCodeResponse(body);
+}
+/**
+ * Step 2: poll the token endpoint until the human approves, honoring
+ * `authorization_pending` / `slow_down` per RFC 8628 and the device-code
+ * deadline. `sleep` advances the injected clock in tests.
+ */
+export async function pollDeviceToken(endpoints, start, deps = {}) {
+    const now = deps.now ?? (() => Date.now());
+    const sleep = deps.sleep ??
+        ((ms) => new Promise((resolve) => {
+            setTimeout(resolve, ms);
+        }));
+    const deadline = now() + start.expiresIn * 1000;
+    let intervalSeconds = start.interval;
+    let attempt = 0;
+    for (;;) {
+        throwIfAborted(deps);
+        await sleep(intervalSeconds * 1000);
+        throwIfAborted(deps);
+        attempt += 1;
+        const { status, body } = await postForm(endpoints.tokenUrl, {
+            client_id: endpoints.clientId,
+            device_code: start.deviceCode,
+            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        }, deps);
+        if (status < 400)
+            return parseTokenResponse(body, now);
+        const err = asRecord(body);
+        const code = err ? readString(err, "error") : undefined;
+        if (code === "authorization_pending") {
+            deps.onPending?.(attempt, intervalSeconds * 1000);
+            if (now() >= deadline) {
+                throw new McpDeviceCodeError("expired-token", "device code expired before approval", code);
+            }
+            continue;
+        }
+        if (code === "slow_down") {
+            intervalSeconds += SLOW_DOWN_STEP_SECONDS;
+            deps.onPending?.(attempt, intervalSeconds * 1000);
+            if (now() >= deadline) {
+                throw new McpDeviceCodeError("expired-token", "device code expired before approval", code);
+            }
+            continue;
+        }
+        if (code === "access_denied") {
+            throw new McpDeviceCodeError("access-denied", "device code authorization was denied", code);
+        }
+        if (code === "expired_token") {
+            throw new McpDeviceCodeError("expired-token", "device code expired before approval", code);
+        }
+        throw new McpDeviceCodeError("device-authorization-failed", `token request failed with HTTP ${status}`, code);
+    }
+}
+/** Full login: start, announce the user code, then poll to completion. */
+export async function loginWithDeviceCode(endpoints, deps = {}) {
+    const start = await startDeviceAuthorization(endpoints, deps);
+    deps.onPrompt?.(start);
+    const tokens = await pollDeviceToken(endpoints, start, deps);
+    return { start, tokens };
+}
+/** Exchange a refresh token (no device code involved). */
+export async function refreshDeviceToken(endpoints, refreshToken, deps = {}) {
+    const now = deps.now ?? (() => Date.now());
+    throwIfAborted(deps);
+    const { status, body } = await postForm(endpoints.tokenUrl, {
+        client_id: endpoints.clientId,
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+    }, deps);
+    if (status >= 400) {
+        const err = asRecord(body);
+        throw new McpDeviceCodeError("refresh-failed", `token refresh failed with HTTP ${status}`, err ? readString(err, "error") : undefined);
+    }
+    const fresh = parseTokenResponse(body, now);
+    // A refresh response often omits refresh_token; keep the old one.
+    return fresh.refreshToken ? fresh : { ...fresh, refreshToken };
+}
+/** True when the token is absent an expiry or is inside the skew window. */
+export function isTokenExpired(tokens, now = () => Date.now(), skewMs = EXPIRY_SKEW_MS) {
+    if (!tokens?.accessToken)
+        return true;
+    if (tokens.expiresAt === undefined)
+        return false;
+    return now() >= tokens.expiresAt - skewMs;
+}
+/** Request headers for the MCP HTTP transport. */
+export function deviceAuthorizationHeaders(tokens) {
+    const scheme = tokens.tokenType?.trim() || "Bearer";
+    return { authorization: `${scheme} ${tokens.accessToken}` };
+}
+/**
+ * Merge auth headers onto a transport `requestInit` without dropping any
+ * caller-supplied headers (case-insensitive, via `Headers`).
+ * Returns `undefined` when there is nothing to send.
+ */
+export function mergeAuthHeaders(requestInit, headers) {
+    const entries = headers ? Object.entries(headers) : [];
+    if (entries.length === 0)
+        return requestInit;
+    const merged = new Headers(requestInit?.headers);
+    for (const [key, value] of entries)
+        merged.set(key, value);
+    return { ...requestInit, headers: merged };
+}
+/**
+ * Best-effort atomic JSON write (tmp + rename) so a crash cannot leave a
+ * truncated token file. Persisting tokens is never session truth: failures
+ * are swallowed and the caller stays logged in for this process.
+ */
+function writeJsonAtomic(file, payload) {
+    try {
+        mkdirSync(dirname(file), { recursive: true });
+        const tmp = `${file}.tmp-${process.pid}`;
+        writeFileSync(tmp, `${JSON.stringify(payload, null, 2)}\n`, "utf8");
+        renameSync(tmp, file);
+    }
+    catch {
+        try {
+            rmSync(`${file}.tmp-${process.pid}`, { force: true });
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+/**
+ * Token store for one MCP server: JSON sidecar beside the session dir.
+ * `headers()` refreshes through the injected fetch when the access token is
+ * expired and a refresh token is available.
+ */
+export class McpDeviceTokenStore {
+    persistPath;
+    tokens;
+    constructor(persistPath) {
+        this.persistPath = persistPath;
+        if (persistPath)
+            this.load();
+    }
+    get() {
+        return this.tokens;
+    }
+    set(tokens) {
+        this.tokens = tokens;
+        this.save();
+    }
+    clear() {
+        this.set(undefined);
+    }
+    /**
+     * Headers to attach to the transport `requestInit`.
+     * Refreshes first when expired and a refresh token + endpoints are given.
+     */
+    async headers(endpoints, deps = {}) {
+        const current = this.tokens;
+        if (!current)
+            return {};
+        const now = deps.now ?? (() => Date.now());
+        if (!isTokenExpired(current, now))
+            return deviceAuthorizationHeaders(current);
+        if (!endpoints || !current.refreshToken) {
+            return deviceAuthorizationHeaders(current);
+        }
+        const refreshed = await refreshDeviceToken(endpoints, current.refreshToken, deps);
+        this.set(refreshed);
+        return deviceAuthorizationHeaders(refreshed);
+    }
+    load() {
+        const file = this.persistPath;
+        if (!file)
+            return;
+        try {
+            const raw = JSON.parse(readFileSync(file, "utf8"));
+            const tokens = raw.tokens;
+            if (tokens && typeof tokens.accessToken === "string" && tokens.accessToken) {
+                this.tokens = tokens;
+            }
+        }
+        catch {
+            /* missing / corrupt sidecar → logged out */
+        }
+    }
+    save() {
+        const file = this.persistPath;
+        if (!file)
+            return;
+        writeJsonAtomic(file, {
+            ...(this.tokens ? { tokens: this.tokens } : {}),
+        });
+    }
+}
+//# sourceMappingURL=oauth-device.js.map

package/node_modules/@xrkseek/mcp/dist/oauth-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device.js","sourceRoot":"","sources":["../src/oauth-device.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6CpC,uEAAuE;AACvE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IACtC,sEAAsE;IAC7D,UAAU,CAAU;IAE7B,YAAY,IAA4B,EAAE,OAAe,EAAE,UAAmB;QAC5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC7D,CAAC;CACF;AAeD,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,GAA8B,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,MAA+B,EAAE,GAAW;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,eAAe,GACnB,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,kFAAkF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,wBAAwB,CAAC;IAC1E,OAAO;QACL,UAAU;QACV,QAAQ;QACR,eAAe;QACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;QAC1C,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB;KAC7D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAiB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1B,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,CAAC;IAC7D,OAAO;QACL,WAAW;QACX,SAAS;QACT,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,CAAC;YAC1C,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAwC;IACxD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,MAAwC,EACxC,IAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;QAClC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC3B;QACD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC,CAAC;IACH,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAAuB;IAC7C,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiC,EACjC,OAA0B,EAAE;IAE5B,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;IACzE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACrC,SAAS,CAAC,sBAAsB,EAChC,MAAM,EACN,IAAI,CACL,CAAC;IACF,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,EAC7B,yCAAyC,MAAM,EAAE,EACjD,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiC,EACjC,KAAyB,EACzB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;QACV,CAAC,CAAC,EAAU,EAAE,EAAE,CACd,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IAChD,IAAI,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC;QACR,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QACpC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACrC,SAAS,CAAC,QAAQ,EAClB;YACE,SAAS,EAAE,SAAS,CAAC,QAAQ;YAC7B,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,UAAU,EAAE,8CAA8C;SAC3D,EACD,IAAI,CACL,CAAC;QACF,IAAI,MAAM,GAAG,GAAG;YAAE,OAAO,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;YAClD,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,qCAAqC,EACrC,IAAI,CACL,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,eAAe,IAAI,sBAAsB,CAAC;YAC1C,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC,CAAC;YAClD,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,qCAAqC,EACrC,IAAI,CACL,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,sCAAsC,EACtC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,qCAAqC,EACrC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,6BAA6B,EAC7B,kCAAkC,MAAM,EAAE,EAC1C,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiC,EACjC,OAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiC,EACjC,YAAoB,EACpB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,cAAc,CAAC,IAAI,CAAC,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACrC,SAAS,CAAC,QAAQ,EAClB;QACE,SAAS,EAAE,SAAS,CAAC,QAAQ;QAC7B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,YAAY;KAC5B,EACD,IAAI,CACL,CAAC;IACF,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,gBAAgB,EAChB,kCAAkC,MAAM,EAAE,EAC1C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,kEAAkE;IAClE,OAAO,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAC5B,MAAqC,EACrC,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EACpC,SAAiB,cAAc;IAE/B,IAAI,CAAC,MAAM,EAAE,WAAW;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;AAC5C,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,0BAA0B,CACxC,MAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IACpD,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAoC,EACpC,OAAqD;IAErD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3D,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAMD;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAgB;IACrD,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,mBAAmB;IAGD;IAFrB,MAAM,CAAgC;IAE9C,YAA6B,WAAoB;QAApB,gBAAW,GAAX,WAAW,CAAS;QAC/C,IAAI,WAAW;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,MAAqC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,SAAkC,EAClC,OAA0B,EAAE;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC;YAAE,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACxC,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,OAAO,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAEO,IAAI;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAmB,CAAC;YACrE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAC3E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAEO,IAAI;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,eAAe,CAAC,IAAI,EAAE;YACpB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvB,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/node_modules/@xrkseek/mcp/dist/oauth-discovery.d.ts

@@ -0,0 +1,92 @@
+/**
+ * MCP OAuth discovery: RFC 9728 protected-resource metadata + RFC 8414 /
+ * OIDC authorization-server metadata.
+ *
+ * An HTTP MCP server that needs OAuth publishes (a) which authorization
+ * servers it trusts and (b) where to log in. Rather than making the operator
+ * hand-copy three endpoints, the Host walks the same well-known documents a
+ * spec-compliant client does and hands back {@link McpDeviceCodeEndpoints}.
+ *
+ * `fetch` (and an optional `signal`) are injected, so the walk is deterministic
+ * under test and the module has no globals.
+ */
+import type { McpDeviceCodeEndpoints } from "./oauth-device.js";
+/** RFC 9728 protected-resource metadata, narrowed to what a login needs. */
+export interface McpProtectedResourceMetadata {
+    /** Canonical resource identifier (used as the OAuth `resource` audience). */
+    readonly resource?: string;
+    readonly authorizationServers: readonly string[];
+    readonly scopesSupported: readonly string[];
+    /** Document URL the metadata was read from (or the `resource_metadata` hint). */
+    readonly metadataUrl?: string;
+}
+/** RFC 8414 / OIDC authorization-server metadata, narrowed to a login need. */
+export interface McpAuthorizationServerMetadata {
+    readonly issuer?: string;
+    readonly deviceAuthorizationUrl: string;
+    readonly tokenUrl: string;
+    readonly registrationUrl?: string;
+    readonly scopesSupported: readonly string[];
+    /** Document URL the metadata was read from. */
+    readonly metadataUrl?: string;
+}
+export type McpOAuthDiscoveryErrorCode = 
+/** A document was not an object, or was missing a required field. */
+"invalid-response"
+/** A document could not be fetched (network error / non-2xx everywhere). */
+ | "request-failed"
+/** Fetched documents were fine but do not describe a device-code login. */
+ | "unsupported";
+/** Failure with a stable code so callers can print an actionable message. */
+export declare class McpOAuthDiscoveryError extends Error {
+    readonly code: McpOAuthDiscoveryErrorCode;
+    readonly status?: number;
+    constructor(code: McpOAuthDiscoveryErrorCode, message: string, status?: number);
+}
+/** Injected side effects; all optional so prod callers pass nothing. */
+export interface McpOAuthDiscoveryDeps {
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+/**
+ * Well-known paths for a resource, most specific first. RFC 9728 keeps the
+ * resource's path as a suffix; the bare origin form is the fallback.
+ */
+export declare function protectedResourceMetadataUrls(resourceUrl: string): string[];
+/**
+ * Well-known paths for an issuer, most specific first. RFC 8414 inserts the
+ * issuer path after the well-known segment; OIDC appends it after the issuer.
+ */
+export declare function authorizationServerMetadataUrls(issuerUrl: string): string[];
+/** `Bearer resource_metadata="…"` from a 401 challenge, when present. */
+export declare function parseResourceMetadataChallenge(header: string | null | undefined): string | undefined;
+/** Throwing form for a protected-resource metadata document. */
+export declare function parseProtectedResourceMetadata(raw: unknown): McpProtectedResourceMetadata;
+/** Throwing form for an authorization-server metadata document. */
+export declare function parseAuthorizationServerMetadata(raw: unknown): McpAuthorizationServerMetadata;
+/** First well-known document that parses; the 401 challenge as a fallback. */
+export declare function discoverProtectedResource(resourceUrl: string, deps?: McpOAuthDiscoveryDeps): Promise<McpProtectedResourceMetadata>;
+/** First well-known authorization-server document that parses. */
+export declare function discoverAuthorizationServerMetadata(issuerUrl: string, deps?: McpOAuthDiscoveryDeps): Promise<McpAuthorizationServerMetadata>;
+export interface McpDeviceCodeDiscoveryInput {
+    /** URL of the MCP server (its transport endpoint). */
+    readonly resourceUrl: string;
+    readonly clientId: string;
+    /** Overrides `scopes_supported` from discovery. */
+    readonly scopes?: readonly string[];
+    /** Overrides the discovered `resource` audience. */
+    readonly audience?: string;
+    readonly deps?: McpOAuthDiscoveryDeps;
+}
+export interface McpDeviceCodeDiscoveryResult {
+    readonly endpoints: McpDeviceCodeEndpoints;
+    readonly protectedResource: McpProtectedResourceMetadata;
+    readonly authorizationServer: McpAuthorizationServerMetadata;
+}
+/**
+ * Full discovery: resource metadata → authorization server → token endpoints.
+ * The discovered `resource` becomes the `resource` audience param when the
+ * metadata names one, so audience-bound servers accept the token.
+ */
+export declare function discoverDeviceCodeEndpoints(input: McpDeviceCodeDiscoveryInput): Promise<McpDeviceCodeDiscoveryResult>;
+//# sourceMappingURL=oauth-discovery.d.ts.map

package/node_modules/@xrkseek/mcp/dist/oauth-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-discovery.d.ts","sourceRoot":"","sources":["../src/oauth-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,+EAA+E;AAC/E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,0BAA0B;AACpC,qEAAqE;AACnE,kBAAkB;AACpB,4EAA4E;GAC1E,gBAAgB;AAClB,2EAA2E;GACzE,aAAa,CAAC;AAElB,6EAA6E;AAC7E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAM/E;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAsCD;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAS3E;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAY3E;AAED,yEAAyE;AACzE,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CAKpB;AAED,gEAAgE;AAChE,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAc9B;AAED,mEAAmE;AACnE,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,OAAO,GACX,8BAA8B,CA+BhC;AAgCD,8EAA8E;AAC9E,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,4BAA4B,CAAC,CAsCvC;AAED,kEAAkE;AAClE,wBAAsB,mCAAmC,CACvD,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,8BAA8B,CAAC,CAsBzC;AAED,MAAM,WAAW,2BAA2B;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,4BAA4B,CAAC;IACzD,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;CAC9D;AAED;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAwBvC"}