agents 0.19.0 → 0.20.0

package/dist/mcp/client.d.ts

@@ -1,23 +1,27 @@
 import {
-  At as MCP_SERVER_ID_MAX_LENGTH,
-  Ct as MCPClientOAuthCallbackConfig,
-  Dt as MCPOAuthCallbackResult,
-  Et as MCPDiscoverResult,
-  Mt as getNamespacedData,
-  Nt as normalizeServerId,
-  Ot as MCPServerFilter,
-  St as MCPClientManagerOptions,
-  Tt as MCPConnectionResult,
-  _t as MCPAITool,
-  bt as MCPClientElicitationHandlers,
-  jt as RegisterServerOptions,
-  kt as MCPServerOptions,
-  vt as MCPAIToolSet,
-  wt as MCPClientOAuthResult,
-  xt as MCPClientManager,
-  yt as MCPClientElicitationHandler
-} from "../agent-tool-types-BNUGGBzQ.js";
+  At as MCPServerFilter,
+  Ct as MCPClientManager,
+  Dt as MCPConnectionResult,
+  Et as MCPClientOAuthResult,
+  Ft as normalizeServerId,
+  Mt as MCP_SERVER_ID_MAX_LENGTH,
+  Nt as RegisterServerOptions,
+  Ot as MCPDiscoverResult,
+  Pt as getNamespacedData,
+  St as MCPClientElicitationHandlers,
+  Tt as MCPClientOAuthCallbackConfig,
+  _t as ElicitRequest,
+  bt as MCPAIToolSet,
+  jt as MCPServerOptions,
+  kt as MCPOAuthCallbackResult,
+  vt as ElicitResult,
+  wt as MCPClientManagerOptions,
+  xt as MCPClientElicitationHandler,
+  yt as MCPAITool
+} from "../agent-tool-types-Btk9ETS-.js";
 export {
+  type ElicitRequest,
+  type ElicitResult,
   MCPAITool,
   MCPAIToolSet,
   MCPClientElicitationHandler,

package/dist/mcp/client.js

@@ -1,2 +1,2 @@
-import { i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, r as getNamespacedData, t as MCPClientManager } from "../client-CcjiFpTf.js";
+import { i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, r as getNamespacedData, t as MCPClientManager } from "../client-zqKcsyFa.js";
 export { MCPClientManager, MCP_SERVER_ID_MAX_LENGTH, getNamespacedData, normalizeServerId };

package/dist/mcp/do-oauth-client-provider.d.ts

@@ -2,7 +2,7 @@ import {
   n as AgentsOAuthProvider,
   r as DurableObjectOAuthClientProvider,
   t as AgentMcpOAuthProvider
-} from "../do-oauth-client-provider-D4ZwyBDu.js";
+} from "../do-oauth-client-provider-VTZj2VtM.js";
 export {
   AgentMcpOAuthProvider,
   AgentsOAuthProvider,

package/dist/mcp/do-oauth-client-provider.js

@@ -68,23 +68,33 @@ var DurableObjectOAuthClientProvider = class {
 	clientInfoKey(clientId) {
 		return `${this.keyPrefix(clientId)}/client_info/`;
 	}
-	async clientInformation() {
-		if (!this._clientId_) return;
+	discoveryStateKey() {
+		return `/${this.clientName}/${this.serverId}/oauth_discovery`;
+	}
+	async saveDiscoveryState(state) {
+		await this.storage.put(this.discoveryStateKey(), state);
+	}
+	async discoveryState() {
+		return await this.storage.get(this.discoveryStateKey()) ?? void 0;
+	}
+	async clientInformation(_context) {
+		if (!this._clientId_) return void 0;
 		return await this.storage.get(this.clientInfoKey(this.clientId)) ?? void 0;
 	}
-	async saveClientInformation(clientInformation) {
-		await this.storage.put(this.clientInfoKey(clientInformation.client_id), clientInformation);
+	async saveClientInformation(clientInformation, _context) {
 		this.clientId = clientInformation.client_id;
+		await this.storage.put(this.clientInfoKey(clientInformation.client_id), clientInformation);
 	}
 	tokenKey(clientId) {
 		return `${this.keyPrefix(clientId)}/token`;
 	}
-	async tokens() {
-		if (!this._clientId_) return;
+	async tokens(_context) {
+		if (!this._clientId_) return void 0;
 		return await this.storage.get(this.tokenKey(this.clientId)) ?? void 0;
 	}
-	async saveTokens(tokens) {
+	async saveTokens(tokens, _context) {
 		await this.storage.put(this.tokenKey(this.clientId), tokens);
+		await this.storage.delete(this.discoveryStateKey());
 	}
 	get authUrl() {
 		return this._authUrl_;
@@ -166,12 +176,15 @@ var DurableObjectOAuthClientProvider = class {
 		await this.storage.delete(challengeKey);
 	}
 	async invalidateCredentials(scope) {
-		if (!this._clientId_) return;
 		const deleteKeys = [];
-		if (scope === "all" || scope === "client") deleteKeys.push(this.clientInfoKey(this.clientId));
-		if (scope === "all" || scope === "tokens") deleteKeys.push(this.tokenKey(this.clientId));
-		if (scope === "all" || scope === "verifier") deleteKeys.push(...await this.codeVerifierKeys(this.clientId, { includeChallengeKeys: true }));
-		if (deleteKeys.length > 0) await this.storage.delete(deleteKeys);
+		if (scope === "all" || scope === "discovery") deleteKeys.push(this.discoveryStateKey());
+		if (this._clientId_) {
+			const clientId = this.clientId;
+			if (scope === "all" || scope === "client") deleteKeys.push(this.clientInfoKey(clientId));
+			if (scope === "all" || scope === "tokens") deleteKeys.push(this.tokenKey(clientId));
+			if (scope === "all" || scope === "verifier") deleteKeys.push(...await this.codeVerifierKeys(clientId, { includeChallengeKeys: true }));
+		}
+		if (deleteKeys.length > 0) await this.storage.delete([...new Set(deleteKeys)]);
 	}
 	codeVerifierKey(clientId) {
 		return `${this.keyPrefix(clientId)}/code_verifier`;

package/dist/mcp/do-oauth-client-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"do-oauth-client-provider.js","names":[],"sources":["../../src/mcp/do-oauth-client-provider.ts"],"sourcesContent":["import type { OAuthClientProvider } from \"@modelcontextprotocol/sdk/client/auth.js\";\nimport type {\n  OAuthClientInformation,\n  OAuthClientInformationFull,\n  OAuthClientMetadata,\n  OAuthTokens\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { nanoid } from \"nanoid\";\n\nconst STATE_EXPIRATION_MS = 10 * 60 * 1000; // 10 minutes\n\nconst codeVerifierStateStorage = new AsyncLocalStorage<{\n  state: string;\n  servedKey?: string;\n}>();\n\ninterface StoredState {\n  nonce: string;\n  serverId: string;\n  createdAt: number;\n}\n\ninterface StoredCodeVerifier {\n  verifier: string;\n  createdAt: number;\n}\n\n// A slight extension to the standard OAuthClientProvider interface because `redirectToAuthorization` doesn't give us the interface we need\n// This allows us to track authentication for a specific server and associated dynamic client registration\nexport interface AgentMcpOAuthProvider extends OAuthClientProvider {\n  authUrl: string | undefined;\n  clientId: string | undefined;\n  serverId: string | undefined;\n  checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }>;\n  consumeState(state: string): Promise<void>;\n  runWithCodeVerifierState?<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T>;\n  deleteCodeVerifier(): Promise<void>;\n}\n\nfunction parseOAuthState(\n  state: string\n): { nonce: string; serverId: string } | undefined {\n  const parts = state.split(\".\");\n  if (parts.length !== 2) {\n    return undefined;\n  }\n\n  const [nonce, serverId] = parts;\n  if (!nonce || !serverId) {\n    return undefined;\n  }\n\n  return { nonce, serverId };\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function createCodeChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier)\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction isExpired(createdAt: number): boolean {\n  return Date.now() - createdAt > STATE_EXPIRATION_MS;\n}\n\n/**\n * @deprecated Use {@link AgentMcpOAuthProvider} instead.\n */\nexport type AgentsOAuthProvider = AgentMcpOAuthProvider;\n\nexport class DurableObjectOAuthClientProvider implements AgentMcpOAuthProvider {\n  private _authUrl_: string | undefined;\n  private _serverId_: string | undefined;\n  private _clientId_: string | undefined;\n\n  constructor(\n    public storage: DurableObjectStorage,\n    public clientName: string,\n    public baseRedirectUrl: string\n  ) {\n    if (!storage) {\n      throw new Error(\n        \"DurableObjectOAuthClientProvider requires a valid DurableObjectStorage instance\"\n      );\n    }\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return {\n      client_name: this.clientName,\n      client_uri: this.clientUri,\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      redirect_uris: [this.redirectUrl],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\"\n    };\n  }\n\n  get clientUri() {\n    return new URL(this.redirectUrl).origin;\n  }\n\n  get redirectUrl() {\n    return this.baseRedirectUrl;\n  }\n\n  get clientId() {\n    if (!this._clientId_) {\n      throw new Error(\"Trying to access clientId before it was set\");\n    }\n    return this._clientId_;\n  }\n\n  set clientId(clientId_: string) {\n    this._clientId_ = clientId_;\n  }\n\n  get serverId() {\n    if (!this._serverId_) {\n      throw new Error(\"Trying to access serverId before it was set\");\n    }\n    return this._serverId_;\n  }\n\n  set serverId(serverId_: string) {\n    this._serverId_ = serverId_;\n  }\n\n  keyPrefix(clientId: string) {\n    return `/${this.clientName}/${this.serverId}/${clientId}`;\n  }\n\n  clientInfoKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/client_info/`;\n  }\n\n  async clientInformation(): Promise<OAuthClientInformation | undefined> {\n    if (!this._clientId_) {\n      return undefined;\n    }\n    return (\n      (await this.storage.get<OAuthClientInformation>(\n        this.clientInfoKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveClientInformation(\n    clientInformation: OAuthClientInformationFull\n  ): Promise<void> {\n    await this.storage.put(\n      this.clientInfoKey(clientInformation.client_id),\n      clientInformation\n    );\n    this.clientId = clientInformation.client_id;\n  }\n\n  tokenKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/token`;\n  }\n\n  async tokens(): Promise<OAuthTokens | undefined> {\n    if (!this._clientId_) {\n      return undefined;\n    }\n    return (\n      (await this.storage.get<OAuthTokens>(this.tokenKey(this.clientId))) ??\n      undefined\n    );\n  }\n\n  async saveTokens(tokens: OAuthTokens): Promise<void> {\n    await this.storage.put(this.tokenKey(this.clientId), tokens);\n  }\n\n  get authUrl() {\n    return this._authUrl_;\n  }\n\n  stateKey(nonce: string) {\n    return `/${this.clientName}/${this.serverId}/state/${nonce}`;\n  }\n\n  async state(): Promise<string> {\n    const nonce = nanoid();\n    const state = `${nonce}.${this.serverId}`;\n    const storedState: StoredState = {\n      nonce,\n      serverId: this.serverId,\n      createdAt: Date.now()\n    };\n    await this.storage.put(this.stateKey(nonce), storedState);\n    return state;\n  }\n\n  async checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      return { valid: false, error: \"Invalid state format\" };\n    }\n\n    const { nonce, serverId } = parsed;\n    const key = this.stateKey(nonce);\n    const storedState = await this.storage.get<StoredState>(key);\n\n    if (!storedState) {\n      return { valid: false, error: \"State not found or already used\" };\n    }\n\n    if (storedState.serverId !== serverId) {\n      await this.storage.delete(key);\n      return { valid: false, error: \"State serverId mismatch\" };\n    }\n\n    if (isExpired(storedState.createdAt)) {\n      const deleteKeys = [key];\n      if (this._clientId_) {\n        deleteKeys.push(this.stateCodeVerifierKey(this.clientId, nonce));\n      }\n      await this.storage.delete(deleteKeys);\n      return { valid: false, error: \"State expired\" };\n    }\n\n    return { valid: true, serverId };\n  }\n\n  async consumeState(state: string): Promise<void> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      // This should never happen since checkState validates format first.\n      // Log for debugging but don't throw - state consumption is best-effort.\n      console.warn(`[OAuth] consumeState called with invalid state format`);\n      return;\n    }\n    await this.storage.delete(this.stateKey(parsed.nonce));\n  }\n\n  async redirectToAuthorization(authUrl: URL): Promise<void> {\n    this._authUrl_ = authUrl.toString();\n\n    const clientId = this._clientId_;\n    const serverId = this._serverId_;\n    if (!clientId || !serverId) {\n      return;\n    }\n\n    const state = authUrl.searchParams.get(\"state\");\n    const codeChallenge = authUrl.searchParams.get(\"code_challenge\");\n    if (!state || !codeChallenge) {\n      return;\n    }\n\n    const parsed = parseOAuthState(state);\n    if (!parsed || parsed.serverId !== serverId) {\n      return;\n    }\n\n    const challengeKey = this.challengeCodeVerifierKey(clientId, codeChallenge);\n    const pendingVerifier =\n      await this.storage.get<StoredCodeVerifier>(challengeKey);\n    if (!pendingVerifier) {\n      return;\n    }\n\n    if (isExpired(pendingVerifier.createdAt)) {\n      await this.storage.delete(challengeKey);\n      return;\n    }\n\n    await this.storage.put(\n      this.stateCodeVerifierKey(clientId, parsed.nonce),\n      pendingVerifier\n    );\n    await this.storage.delete(challengeKey);\n  }\n\n  async invalidateCredentials(\n    scope: \"all\" | \"client\" | \"tokens\" | \"verifier\"\n  ): Promise<void> {\n    if (!this._clientId_) return;\n\n    const deleteKeys: string[] = [];\n\n    if (scope === \"all\" || scope === \"client\") {\n      deleteKeys.push(this.clientInfoKey(this.clientId));\n    }\n    if (scope === \"all\" || scope === \"tokens\") {\n      deleteKeys.push(this.tokenKey(this.clientId));\n    }\n    if (scope === \"all\" || scope === \"verifier\") {\n      deleteKeys.push(\n        ...(await this.codeVerifierKeys(this.clientId, {\n          includeChallengeKeys: true\n        }))\n      );\n    }\n\n    if (deleteKeys.length > 0) {\n      await this.storage.delete(deleteKeys);\n    }\n  }\n\n  codeVerifierKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier`;\n  }\n\n  stateCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier/`;\n  }\n\n  stateCodeVerifierKey(clientId: string, nonce: string) {\n    return `${this.stateCodeVerifierPrefix(clientId)}${nonce}`;\n  }\n\n  challengeCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier_challenge/`;\n  }\n\n  challengeCodeVerifierKey(clientId: string, codeChallenge: string) {\n    return `${this.challengeCodeVerifierPrefix(clientId)}${codeChallenge}`;\n  }\n\n  async codeVerifierKeys(\n    clientId: string,\n    options: { includeChallengeKeys?: boolean } = {}\n  ): Promise<string[]> {\n    const legacyKey = this.codeVerifierKey(clientId);\n    const keys: string[] = [];\n\n    if (await this.storage.get(legacyKey)) {\n      keys.push(legacyKey);\n    }\n\n    const stateKeys = await this.storage.list({\n      prefix: this.stateCodeVerifierPrefix(clientId)\n    });\n    keys.push(...stateKeys.keys());\n\n    if (options.includeChallengeKeys) {\n      const challengeKeys = await this.storage.list({\n        prefix: this.challengeCodeVerifierPrefix(clientId)\n      });\n      keys.push(...challengeKeys.keys());\n    }\n\n    return keys;\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.deleteExpiredChallengeCodeVerifiers(this.clientId);\n\n    const codeChallenge = await createCodeChallenge(verifier);\n    const storedVerifier: StoredCodeVerifier = {\n      verifier,\n      createdAt: Date.now()\n    };\n\n    await this.storage.put(\n      this.challengeCodeVerifierKey(this.clientId, codeChallenge),\n      storedVerifier\n    );\n  }\n\n  private async deleteExpiredChallengeCodeVerifiers(\n    clientId: string\n  ): Promise<void> {\n    const challengeVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.challengeCodeVerifierPrefix(clientId)\n    });\n    const expiredKeys = [...challengeVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n  }\n\n  async codeVerifier(): Promise<string> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context) {\n      const stateVerifier = await this.codeVerifierForState(context.state);\n      if (stateVerifier) {\n        context.servedKey = stateVerifier.key;\n        return stateVerifier.verifier;\n      }\n    }\n\n    const legacyVerifier = await this.storage.get<string>(\n      this.codeVerifierKey(this.clientId)\n    );\n    if (legacyVerifier) {\n      if (context) {\n        context.servedKey = this.codeVerifierKey(this.clientId);\n      }\n      return legacyVerifier;\n    }\n\n    if (context) {\n      throw new Error(\"No code verifier found for OAuth state\");\n    }\n\n    const pendingVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.stateCodeVerifierPrefix(this.clientId)\n    });\n    const unexpiredPendingVerifiers = [...pendingVerifiers.entries()].filter(\n      ([, storedVerifier]) => !isExpired(storedVerifier.createdAt)\n    );\n    const expiredKeys = [...pendingVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n\n    if (unexpiredPendingVerifiers.length === 1) {\n      const [[, storedVerifier]] = unexpiredPendingVerifiers;\n      return storedVerifier.verifier;\n    }\n\n    if (unexpiredPendingVerifiers.length > 1) {\n      throw new Error(\n        \"Multiple OAuth code verifiers are pending; complete authorization with the callback state\"\n      );\n    }\n\n    throw new Error(\"No code verifier found\");\n  }\n\n  private async codeVerifierForState(\n    state: string\n  ): Promise<{ key: string; verifier: string } | undefined> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      throw new Error(\"Invalid state format\");\n    }\n\n    const key = this.stateCodeVerifierKey(this.clientId, parsed.nonce);\n    const storedVerifier = await this.storage.get<StoredCodeVerifier>(key);\n    if (!storedVerifier) {\n      return undefined;\n    }\n\n    if (isExpired(storedVerifier.createdAt)) {\n      await this.storage.delete(key);\n      throw new Error(\"Code verifier expired\");\n    }\n\n    return { key, verifier: storedVerifier.verifier };\n  }\n\n  async runWithCodeVerifierState<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T> {\n    return codeVerifierStateStorage.run({ state }, callback);\n  }\n\n  async deleteCodeVerifier(): Promise<void> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context?.servedKey) {\n      await this.storage.delete(context.servedKey);\n      return;\n    }\n\n    if (context) {\n      const parsed = parseOAuthState(context.state);\n      if (parsed) {\n        await this.storage.delete(\n          this.stateCodeVerifierKey(this.clientId, parsed.nonce)\n        );\n        return;\n      }\n    }\n\n    const keys = await this.codeVerifierKeys(this.clientId);\n    if (keys.length > 0) {\n      await this.storage.delete(keys);\n    }\n  }\n}\n"],"mappings":";;;AAUA,MAAM,sBAAsB,MAAU;AAEtC,MAAM,2BAA2B,IAAI,kBAGlC;AA8BH,SAAS,gBACP,OACiD;CACjD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB;CAGF,MAAM,CAAC,OAAO,YAAY;CAC1B,IAAI,CAAC,SAAS,CAAC,UACb;CAGF,OAAO;EAAE;EAAO;CAAS;AAC3B;AAEA,SAAS,gBAAgB,OAA2B;CAClD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAChB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,oBAAoB,UAAmC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CACnC;CACA,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,UAAU,WAA4B;CAC7C,OAAO,KAAK,IAAI,IAAI,YAAY;AAClC;AAOA,IAAa,mCAAb,MAA+E;CAK7E,YACE,SACA,YACA,iBACA;EAHO,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,kBAAA;EAEP,IAAI,CAAC,SACH,MAAM,IAAI,MACR,iFACF;CAEJ;CAEA,IAAI,iBAAsC;EACxC,OAAO;GACL,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,aAAa,CAAC,sBAAsB,eAAe;GACnD,eAAe,CAAC,KAAK,WAAW;GAChC,gBAAgB,CAAC,MAAM;GACvB,4BAA4B;EAC9B;CACF;CAEA,IAAI,YAAY;EACd,OAAO,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC;CACnC;CAEA,IAAI,cAAc;EAChB,OAAO,KAAK;CACd;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,UAAU,UAAkB;EAC1B,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,GAAG;CACjD;CAEA,cAAc,UAAkB;EAC9B,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,MAAM,oBAAiE;EACrE,IAAI,CAAC,KAAK,YACR;EAEF,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,cAAc,KAAK,QAAQ,CAClC,KAAM,KAAA;CAEV;CAEA,MAAM,sBACJ,mBACe;EACf,MAAM,KAAK,QAAQ,IACjB,KAAK,cAAc,kBAAkB,SAAS,GAC9C,iBACF;EACA,KAAK,WAAW,kBAAkB;CACpC;CAEA,SAAS,UAAkB;EACzB,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,MAAM,SAA2C;EAC/C,IAAI,CAAC,KAAK,YACR;EAEF,OACG,MAAM,KAAK,QAAQ,IAAiB,KAAK,SAAS,KAAK,QAAQ,CAAC,KACjE,KAAA;CAEJ;CAEA,MAAM,WAAW,QAAoC;EACnD,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,GAAG,MAAM;CAC7D;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;CAEA,SAAS,OAAe;EACtB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,SAAS;CACvD;CAEA,MAAM,QAAyB;EAC7B,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK;EAC/B,MAAM,cAA2B;GAC/B;GACA,UAAU,KAAK;GACf,WAAW,KAAK,IAAI;EACtB;EACA,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,WAAW;EACxD,OAAO;CACT;CAEA,MAAM,WACJ,OACgE;EAChE,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAuB;EAGvD,MAAM,EAAE,OAAO,aAAa;EAC5B,MAAM,MAAM,KAAK,SAAS,KAAK;EAC/B,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAiB,GAAG;EAE3D,IAAI,CAAC,aACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAkC;EAGlE,IAAI,YAAY,aAAa,UAAU;GACrC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,OAAO;IAAE,OAAO;IAAO,OAAO;GAA0B;EAC1D;EAEA,IAAI,UAAU,YAAY,SAAS,GAAG;GACpC,MAAM,aAAa,CAAC,GAAG;GACvB,IAAI,KAAK,YACP,WAAW,KAAK,KAAK,qBAAqB,KAAK,UAAU,KAAK,CAAC;GAEjE,MAAM,KAAK,QAAQ,OAAO,UAAU;GACpC,OAAO;IAAE,OAAO;IAAO,OAAO;GAAgB;EAChD;EAEA,OAAO;GAAE,OAAO;GAAM;EAAS;CACjC;CAEA,MAAM,aAAa,OAA8B;EAC/C,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QAAQ;GAGX,QAAQ,KAAK,uDAAuD;GACpE;EACF;EACA,MAAM,KAAK,QAAQ,OAAO,KAAK,SAAS,OAAO,KAAK,CAAC;CACvD;CAEA,MAAM,wBAAwB,SAA6B;EACzD,KAAK,YAAY,QAAQ,SAAS;EAElC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,YAAY,CAAC,UAChB;EAGF,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO;EAC9C,MAAM,gBAAgB,QAAQ,aAAa,IAAI,gBAAgB;EAC/D,IAAI,CAAC,SAAS,CAAC,eACb;EAGF,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC;EAGF,MAAM,eAAe,KAAK,yBAAyB,UAAU,aAAa;EAC1E,MAAM,kBACJ,MAAM,KAAK,QAAQ,IAAwB,YAAY;EACzD,IAAI,CAAC,iBACH;EAGF,IAAI,UAAU,gBAAgB,SAAS,GAAG;GACxC,MAAM,KAAK,QAAQ,OAAO,YAAY;GACtC;EACF;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,qBAAqB,UAAU,OAAO,KAAK,GAChD,eACF;EACA,MAAM,KAAK,QAAQ,OAAO,YAAY;CACxC;CAEA,MAAM,sBACJ,OACe;EACf,IAAI,CAAC,KAAK,YAAY;EAEtB,MAAM,aAAuB,CAAC;EAE9B,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,cAAc,KAAK,QAAQ,CAAC;EAEnD,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,SAAS,KAAK,QAAQ,CAAC;EAE9C,IAAI,UAAU,SAAS,UAAU,YAC/B,WAAW,KACT,GAAI,MAAM,KAAK,iBAAiB,KAAK,UAAU,EAC7C,sBAAsB,KACxB,CAAC,CACH;EAGF,IAAI,WAAW,SAAS,GACtB,MAAM,KAAK,QAAQ,OAAO,UAAU;CAExC;CAEA,gBAAgB,UAAkB;EAChC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,wBAAwB,UAAkB;EACxC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,qBAAqB,UAAkB,OAAe;EACpD,OAAO,GAAG,KAAK,wBAAwB,QAAQ,IAAI;CACrD;CAEA,4BAA4B,UAAkB;EAC5C,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,yBAAyB,UAAkB,eAAuB;EAChE,OAAO,GAAG,KAAK,4BAA4B,QAAQ,IAAI;CACzD;CAEA,MAAM,iBACJ,UACA,UAA8C,CAAC,GAC5B;EACnB,MAAM,YAAY,KAAK,gBAAgB,QAAQ;EAC/C,MAAM,OAAiB,CAAC;EAExB,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,GAClC,KAAK,KAAK,SAAS;EAGrB,MAAM,YAAY,MAAM,KAAK,QAAQ,KAAK,EACxC,QAAQ,KAAK,wBAAwB,QAAQ,EAC/C,CAAC;EACD,KAAK,KAAK,GAAG,UAAU,KAAK,CAAC;EAE7B,IAAI,QAAQ,sBAAsB;GAChC,MAAM,gBAAgB,MAAM,KAAK,QAAQ,KAAK,EAC5C,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC;GACD,KAAK,KAAK,GAAG,cAAc,KAAK,CAAC;EACnC;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,UAAiC;EACtD,MAAM,KAAK,oCAAoC,KAAK,QAAQ;EAE5D,MAAM,gBAAgB,MAAM,oBAAoB,QAAQ;EACxD,MAAM,iBAAqC;GACzC;GACA,WAAW,KAAK,IAAI;EACtB;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,yBAAyB,KAAK,UAAU,aAAa,GAC1D,cACF;CACF;CAEA,MAAc,oCACZ,UACe;EAIf,MAAM,cAAc,CAAC,IAAG,MAHS,KAAK,QAAQ,KAAyB,EACrE,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC,EAAA,CAC0C,QAAQ,CAAC,CAAC,CAClD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;CAEzC;CAEA,MAAM,eAAgC;EACpC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS;GACX,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,QAAQ,KAAK;GACnE,IAAI,eAAe;IACjB,QAAQ,YAAY,cAAc;IAClC,OAAO,cAAc;GACvB;EACF;EAEA,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IACxC,KAAK,gBAAgB,KAAK,QAAQ,CACpC;EACA,IAAI,gBAAgB;GAClB,IAAI,SACF,QAAQ,YAAY,KAAK,gBAAgB,KAAK,QAAQ;GAExD,OAAO;EACT;EAEA,IAAI,SACF,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,mBAAmB,MAAM,KAAK,QAAQ,KAAyB,EACnE,QAAQ,KAAK,wBAAwB,KAAK,QAAQ,EACpD,CAAC;EACD,MAAM,4BAA4B,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAAC,QAC/D,GAAG,oBAAoB,CAAC,UAAU,eAAe,SAAS,CAC7D;EACA,MAAM,cAAc,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAChD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;EAGvC,IAAI,0BAA0B,WAAW,GAAG;GAC1C,MAAM,CAAC,GAAG,mBAAmB;GAC7B,OAAO,eAAe;EACxB;EAEA,IAAI,0BAA0B,SAAS,GACrC,MAAM,IAAI,MACR,2FACF;EAGF,MAAM,IAAI,MAAM,wBAAwB;CAC1C;CAEA,MAAc,qBACZ,OACwD;EACxD,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sBAAsB;EAGxC,MAAM,MAAM,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK;EACjE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IAAwB,GAAG;EACrE,IAAI,CAAC,gBACH;EAGF,IAAI,UAAU,eAAe,SAAS,GAAG;GACvC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,MAAM,IAAI,MAAM,uBAAuB;EACzC;EAEA,OAAO;GAAE;GAAK,UAAU,eAAe;EAAS;CAClD;CAEA,MAAM,yBACJ,OACA,UACY;EACZ,OAAO,yBAAyB,IAAI,EAAE,MAAM,GAAG,QAAQ;CACzD;CAEA,MAAM,qBAAoC;EACxC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS,WAAW;GACtB,MAAM,KAAK,QAAQ,OAAO,QAAQ,SAAS;GAC3C;EACF;EAEA,IAAI,SAAS;GACX,MAAM,SAAS,gBAAgB,QAAQ,KAAK;GAC5C,IAAI,QAAQ;IACV,MAAM,KAAK,QAAQ,OACjB,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK,CACvD;IACA;GACF;EACF;EAEA,MAAM,OAAO,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACtD,IAAI,KAAK,SAAS,GAChB,MAAM,KAAK,QAAQ,OAAO,IAAI;CAElC;AACF"}
+{"version":3,"file":"do-oauth-client-provider.js","names":[],"sources":["../../src/mcp/do-oauth-client-provider.ts"],"sourcesContent":["import type {\n  OAuthClientInformationContext,\n  OAuthClientMetadata,\n  OAuthClientProvider,\n  OAuthDiscoveryState,\n  StoredOAuthClientInformation,\n  StoredOAuthTokens\n} from \"@modelcontextprotocol/client\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { nanoid } from \"nanoid\";\n\nconst STATE_EXPIRATION_MS = 10 * 60 * 1000; // 10 minutes\n\nconst codeVerifierStateStorage = new AsyncLocalStorage<{\n  state: string;\n  servedKey?: string;\n}>();\n\ninterface StoredState {\n  nonce: string;\n  serverId: string;\n  createdAt: number;\n}\n\ninterface StoredCodeVerifier {\n  verifier: string;\n  createdAt: number;\n}\n\n// A slight extension to the standard OAuthClientProvider interface because `redirectToAuthorization` doesn't give us the interface we need\n// This allows us to track authentication for a specific server and associated dynamic client registration\nexport interface AgentMcpOAuthProvider extends OAuthClientProvider {\n  authUrl: string | undefined;\n  clientId: string | undefined;\n  serverId: string | undefined;\n  checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }>;\n  consumeState(state: string): Promise<void>;\n  runWithCodeVerifierState?<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T>;\n  deleteCodeVerifier(): Promise<void>;\n}\n\nfunction parseOAuthState(\n  state: string\n): { nonce: string; serverId: string } | undefined {\n  const parts = state.split(\".\");\n  if (parts.length !== 2) {\n    return undefined;\n  }\n\n  const [nonce, serverId] = parts;\n  if (!nonce || !serverId) {\n    return undefined;\n  }\n\n  return { nonce, serverId };\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function createCodeChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier)\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction isExpired(createdAt: number): boolean {\n  return Date.now() - createdAt > STATE_EXPIRATION_MS;\n}\n\n/**\n * @deprecated Use {@link AgentMcpOAuthProvider} instead.\n */\nexport type AgentsOAuthProvider = AgentMcpOAuthProvider;\n\nexport class DurableObjectOAuthClientProvider implements AgentMcpOAuthProvider {\n  private _authUrl_: string | undefined;\n  private _serverId_: string | undefined;\n  private _clientId_: string | undefined;\n\n  constructor(\n    public storage: DurableObjectStorage,\n    public clientName: string,\n    public baseRedirectUrl: string\n  ) {\n    if (!storage) {\n      throw new Error(\n        \"DurableObjectOAuthClientProvider requires a valid DurableObjectStorage instance\"\n      );\n    }\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return {\n      client_name: this.clientName,\n      client_uri: this.clientUri,\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      redirect_uris: [this.redirectUrl],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\"\n    };\n  }\n\n  get clientUri() {\n    return new URL(this.redirectUrl).origin;\n  }\n\n  get redirectUrl() {\n    return this.baseRedirectUrl;\n  }\n\n  get clientId() {\n    if (!this._clientId_) {\n      throw new Error(\"Trying to access clientId before it was set\");\n    }\n    return this._clientId_;\n  }\n\n  set clientId(clientId_: string) {\n    this._clientId_ = clientId_;\n  }\n\n  get serverId() {\n    if (!this._serverId_) {\n      throw new Error(\"Trying to access serverId before it was set\");\n    }\n    return this._serverId_;\n  }\n\n  set serverId(serverId_: string) {\n    this._serverId_ = serverId_;\n  }\n\n  keyPrefix(clientId: string) {\n    return `/${this.clientName}/${this.serverId}/${clientId}`;\n  }\n\n  clientInfoKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/client_info/`;\n  }\n\n  discoveryStateKey() {\n    return `/${this.clientName}/${this.serverId}/oauth_discovery`;\n  }\n\n  async saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {\n    await this.storage.put(this.discoveryStateKey(), state);\n  }\n\n  async discoveryState(): Promise<OAuthDiscoveryState | undefined> {\n    return (\n      (await this.storage.get<OAuthDiscoveryState>(this.discoveryStateKey())) ??\n      undefined\n    );\n  }\n\n  async clientInformation(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthClientInformation | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthClientInformation>(\n        this.clientInfoKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveClientInformation(\n    clientInformation: StoredOAuthClientInformation,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    this.clientId = clientInformation.client_id;\n    // Round-trip the SDK's issuer stamp verbatim. The SDK treats a credential\n    // stamped for another issuer as absent, so one durable slot per MCP server\n    // is both sufficient and safer than maintaining our own issuer index.\n    await this.storage.put(\n      this.clientInfoKey(clientInformation.client_id),\n      clientInformation\n    );\n  }\n\n  tokenKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/token`;\n  }\n\n  async tokens(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthTokens | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthTokens>(\n        this.tokenKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveTokens(\n    tokens: StoredOAuthTokens,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    // Keep the SDK-owned issuer stamp intact for SEP-2352 validation. Discovery\n    // is needed across the browser redirect, but once token issuance succeeds\n    // it must not pin later re-authorization to this AS: a subsequent 401 must\n    // re-read PRM so an authorization-server migration can be observed.\n    await this.storage.put(this.tokenKey(this.clientId), tokens);\n    await this.storage.delete(this.discoveryStateKey());\n  }\n\n  get authUrl() {\n    return this._authUrl_;\n  }\n\n  stateKey(nonce: string) {\n    return `/${this.clientName}/${this.serverId}/state/${nonce}`;\n  }\n\n  async state(): Promise<string> {\n    const nonce = nanoid();\n    const state = `${nonce}.${this.serverId}`;\n    const storedState: StoredState = {\n      nonce,\n      serverId: this.serverId,\n      createdAt: Date.now()\n    };\n    await this.storage.put(this.stateKey(nonce), storedState);\n    return state;\n  }\n\n  async checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      return { valid: false, error: \"Invalid state format\" };\n    }\n\n    const { nonce, serverId } = parsed;\n    const key = this.stateKey(nonce);\n    const storedState = await this.storage.get<StoredState>(key);\n\n    if (!storedState) {\n      return { valid: false, error: \"State not found or already used\" };\n    }\n\n    if (storedState.serverId !== serverId) {\n      await this.storage.delete(key);\n      return { valid: false, error: \"State serverId mismatch\" };\n    }\n\n    if (isExpired(storedState.createdAt)) {\n      const deleteKeys = [key];\n      if (this._clientId_) {\n        deleteKeys.push(this.stateCodeVerifierKey(this.clientId, nonce));\n      }\n      await this.storage.delete(deleteKeys);\n      return { valid: false, error: \"State expired\" };\n    }\n\n    return { valid: true, serverId };\n  }\n\n  async consumeState(state: string): Promise<void> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      // This should never happen since checkState validates format first.\n      // Log for debugging but don't throw - state consumption is best-effort.\n      console.warn(`[OAuth] consumeState called with invalid state format`);\n      return;\n    }\n    await this.storage.delete(this.stateKey(parsed.nonce));\n  }\n\n  async redirectToAuthorization(authUrl: URL): Promise<void> {\n    this._authUrl_ = authUrl.toString();\n\n    const clientId = this._clientId_;\n    const serverId = this._serverId_;\n    if (!clientId || !serverId) {\n      return;\n    }\n\n    const state = authUrl.searchParams.get(\"state\");\n    const codeChallenge = authUrl.searchParams.get(\"code_challenge\");\n    if (!state || !codeChallenge) {\n      return;\n    }\n\n    const parsed = parseOAuthState(state);\n    if (!parsed || parsed.serverId !== serverId) {\n      return;\n    }\n\n    const challengeKey = this.challengeCodeVerifierKey(clientId, codeChallenge);\n    const pendingVerifier =\n      await this.storage.get<StoredCodeVerifier>(challengeKey);\n    if (!pendingVerifier) {\n      return;\n    }\n\n    if (isExpired(pendingVerifier.createdAt)) {\n      await this.storage.delete(challengeKey);\n      return;\n    }\n\n    await this.storage.put(\n      this.stateCodeVerifierKey(clientId, parsed.nonce),\n      pendingVerifier\n    );\n    await this.storage.delete(challengeKey);\n  }\n\n  async invalidateCredentials(\n    scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"\n  ): Promise<void> {\n    const deleteKeys: string[] = [];\n\n    if (scope === \"all\" || scope === \"discovery\") {\n      deleteKeys.push(this.discoveryStateKey());\n    }\n\n    if (this._clientId_) {\n      const clientId = this.clientId;\n      if (scope === \"all\" || scope === \"client\") {\n        deleteKeys.push(this.clientInfoKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"tokens\") {\n        deleteKeys.push(this.tokenKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"verifier\") {\n        deleteKeys.push(\n          ...(await this.codeVerifierKeys(clientId, {\n            includeChallengeKeys: true\n          }))\n        );\n      }\n    }\n\n    if (deleteKeys.length > 0) {\n      await this.storage.delete([...new Set(deleteKeys)]);\n    }\n  }\n\n  codeVerifierKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier`;\n  }\n\n  stateCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier/`;\n  }\n\n  stateCodeVerifierKey(clientId: string, nonce: string) {\n    return `${this.stateCodeVerifierPrefix(clientId)}${nonce}`;\n  }\n\n  challengeCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier_challenge/`;\n  }\n\n  challengeCodeVerifierKey(clientId: string, codeChallenge: string) {\n    return `${this.challengeCodeVerifierPrefix(clientId)}${codeChallenge}`;\n  }\n\n  async codeVerifierKeys(\n    clientId: string,\n    options: { includeChallengeKeys?: boolean } = {}\n  ): Promise<string[]> {\n    const legacyKey = this.codeVerifierKey(clientId);\n    const keys: string[] = [];\n\n    if (await this.storage.get(legacyKey)) {\n      keys.push(legacyKey);\n    }\n\n    const stateKeys = await this.storage.list({\n      prefix: this.stateCodeVerifierPrefix(clientId)\n    });\n    keys.push(...stateKeys.keys());\n\n    if (options.includeChallengeKeys) {\n      const challengeKeys = await this.storage.list({\n        prefix: this.challengeCodeVerifierPrefix(clientId)\n      });\n      keys.push(...challengeKeys.keys());\n    }\n\n    return keys;\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.deleteExpiredChallengeCodeVerifiers(this.clientId);\n\n    const codeChallenge = await createCodeChallenge(verifier);\n    const storedVerifier: StoredCodeVerifier = {\n      verifier,\n      createdAt: Date.now()\n    };\n\n    await this.storage.put(\n      this.challengeCodeVerifierKey(this.clientId, codeChallenge),\n      storedVerifier\n    );\n  }\n\n  private async deleteExpiredChallengeCodeVerifiers(\n    clientId: string\n  ): Promise<void> {\n    const challengeVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.challengeCodeVerifierPrefix(clientId)\n    });\n    const expiredKeys = [...challengeVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n  }\n\n  async codeVerifier(): Promise<string> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context) {\n      const stateVerifier = await this.codeVerifierForState(context.state);\n      if (stateVerifier) {\n        context.servedKey = stateVerifier.key;\n        return stateVerifier.verifier;\n      }\n    }\n\n    const legacyVerifier = await this.storage.get<string>(\n      this.codeVerifierKey(this.clientId)\n    );\n    if (legacyVerifier) {\n      if (context) {\n        context.servedKey = this.codeVerifierKey(this.clientId);\n      }\n      return legacyVerifier;\n    }\n\n    if (context) {\n      throw new Error(\"No code verifier found for OAuth state\");\n    }\n\n    const pendingVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.stateCodeVerifierPrefix(this.clientId)\n    });\n    const unexpiredPendingVerifiers = [...pendingVerifiers.entries()].filter(\n      ([, storedVerifier]) => !isExpired(storedVerifier.createdAt)\n    );\n    const expiredKeys = [...pendingVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n\n    if (unexpiredPendingVerifiers.length === 1) {\n      const [[, storedVerifier]] = unexpiredPendingVerifiers;\n      return storedVerifier.verifier;\n    }\n\n    if (unexpiredPendingVerifiers.length > 1) {\n      throw new Error(\n        \"Multiple OAuth code verifiers are pending; complete authorization with the callback state\"\n      );\n    }\n\n    throw new Error(\"No code verifier found\");\n  }\n\n  private async codeVerifierForState(\n    state: string\n  ): Promise<{ key: string; verifier: string } | undefined> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      throw new Error(\"Invalid state format\");\n    }\n\n    const key = this.stateCodeVerifierKey(this.clientId, parsed.nonce);\n    const storedVerifier = await this.storage.get<StoredCodeVerifier>(key);\n    if (!storedVerifier) {\n      return undefined;\n    }\n\n    if (isExpired(storedVerifier.createdAt)) {\n      await this.storage.delete(key);\n      throw new Error(\"Code verifier expired\");\n    }\n\n    return { key, verifier: storedVerifier.verifier };\n  }\n\n  async runWithCodeVerifierState<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T> {\n    return codeVerifierStateStorage.run({ state }, callback);\n  }\n\n  async deleteCodeVerifier(): Promise<void> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context?.servedKey) {\n      await this.storage.delete(context.servedKey);\n      return;\n    }\n\n    if (context) {\n      const parsed = parseOAuthState(context.state);\n      if (parsed) {\n        await this.storage.delete(\n          this.stateCodeVerifierKey(this.clientId, parsed.nonce)\n        );\n        return;\n      }\n    }\n\n    const keys = await this.codeVerifierKeys(this.clientId);\n    if (keys.length > 0) {\n      await this.storage.delete(keys);\n    }\n  }\n}\n"],"mappings":";;;AAWA,MAAM,sBAAsB,MAAU;AAEtC,MAAM,2BAA2B,IAAI,kBAGlC;AA8BH,SAAS,gBACP,OACiD;CACjD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB;CAGF,MAAM,CAAC,OAAO,YAAY;CAC1B,IAAI,CAAC,SAAS,CAAC,UACb;CAGF,OAAO;EAAE;EAAO;CAAS;AAC3B;AAEA,SAAS,gBAAgB,OAA2B;CAClD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAChB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,oBAAoB,UAAmC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CACnC;CACA,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,UAAU,WAA4B;CAC7C,OAAO,KAAK,IAAI,IAAI,YAAY;AAClC;AAOA,IAAa,mCAAb,MAA+E;CAK7E,YACE,SACA,YACA,iBACA;EAHO,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,kBAAA;EAEP,IAAI,CAAC,SACH,MAAM,IAAI,MACR,iFACF;CAEJ;CAEA,IAAI,iBAAsC;EACxC,OAAO;GACL,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,aAAa,CAAC,sBAAsB,eAAe;GACnD,eAAe,CAAC,KAAK,WAAW;GAChC,gBAAgB,CAAC,MAAM;GACvB,4BAA4B;EAC9B;CACF;CAEA,IAAI,YAAY;EACd,OAAO,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC;CACnC;CAEA,IAAI,cAAc;EAChB,OAAO,KAAK;CACd;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,UAAU,UAAkB;EAC1B,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,GAAG;CACjD;CAEA,cAAc,UAAkB;EAC9B,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,oBAAoB;EAClB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS;CAC9C;CAEA,MAAM,mBAAmB,OAA2C;EAClE,MAAM,KAAK,QAAQ,IAAI,KAAK,kBAAkB,GAAG,KAAK;CACxD;CAEA,MAAM,iBAA2D;EAC/D,OACG,MAAM,KAAK,QAAQ,IAAyB,KAAK,kBAAkB,CAAC,KACrE,KAAA;CAEJ;CAEA,MAAM,kBACJ,UACmD;EACnD,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,cAAc,KAAK,QAAQ,CAClC,KAAM,KAAA;CAEV;CAEA,MAAM,sBACJ,mBACA,UACe;EACf,KAAK,WAAW,kBAAkB;EAIlC,MAAM,KAAK,QAAQ,IACjB,KAAK,cAAc,kBAAkB,SAAS,GAC9C,iBACF;CACF;CAEA,SAAS,UAAkB;EACzB,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,MAAM,OACJ,UACwC;EACxC,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,SAAS,KAAK,QAAQ,CAC7B,KAAM,KAAA;CAEV;CAEA,MAAM,WACJ,QACA,UACe;EAKf,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,GAAG,MAAM;EAC3D,MAAM,KAAK,QAAQ,OAAO,KAAK,kBAAkB,CAAC;CACpD;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;CAEA,SAAS,OAAe;EACtB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,SAAS;CACvD;CAEA,MAAM,QAAyB;EAC7B,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK;EAC/B,MAAM,cAA2B;GAC/B;GACA,UAAU,KAAK;GACf,WAAW,KAAK,IAAI;EACtB;EACA,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,WAAW;EACxD,OAAO;CACT;CAEA,MAAM,WACJ,OACgE;EAChE,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAuB;EAGvD,MAAM,EAAE,OAAO,aAAa;EAC5B,MAAM,MAAM,KAAK,SAAS,KAAK;EAC/B,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAiB,GAAG;EAE3D,IAAI,CAAC,aACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAkC;EAGlE,IAAI,YAAY,aAAa,UAAU;GACrC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,OAAO;IAAE,OAAO;IAAO,OAAO;GAA0B;EAC1D;EAEA,IAAI,UAAU,YAAY,SAAS,GAAG;GACpC,MAAM,aAAa,CAAC,GAAG;GACvB,IAAI,KAAK,YACP,WAAW,KAAK,KAAK,qBAAqB,KAAK,UAAU,KAAK,CAAC;GAEjE,MAAM,KAAK,QAAQ,OAAO,UAAU;GACpC,OAAO;IAAE,OAAO;IAAO,OAAO;GAAgB;EAChD;EAEA,OAAO;GAAE,OAAO;GAAM;EAAS;CACjC;CAEA,MAAM,aAAa,OAA8B;EAC/C,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QAAQ;GAGX,QAAQ,KAAK,uDAAuD;GACpE;EACF;EACA,MAAM,KAAK,QAAQ,OAAO,KAAK,SAAS,OAAO,KAAK,CAAC;CACvD;CAEA,MAAM,wBAAwB,SAA6B;EACzD,KAAK,YAAY,QAAQ,SAAS;EAElC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,YAAY,CAAC,UAChB;EAGF,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO;EAC9C,MAAM,gBAAgB,QAAQ,aAAa,IAAI,gBAAgB;EAC/D,IAAI,CAAC,SAAS,CAAC,eACb;EAGF,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC;EAGF,MAAM,eAAe,KAAK,yBAAyB,UAAU,aAAa;EAC1E,MAAM,kBACJ,MAAM,KAAK,QAAQ,IAAwB,YAAY;EACzD,IAAI,CAAC,iBACH;EAGF,IAAI,UAAU,gBAAgB,SAAS,GAAG;GACxC,MAAM,KAAK,QAAQ,OAAO,YAAY;GACtC;EACF;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,qBAAqB,UAAU,OAAO,KAAK,GAChD,eACF;EACA,MAAM,KAAK,QAAQ,OAAO,YAAY;CACxC;CAEA,MAAM,sBACJ,OACe;EACf,MAAM,aAAuB,CAAC;EAE9B,IAAI,UAAU,SAAS,UAAU,aAC/B,WAAW,KAAK,KAAK,kBAAkB,CAAC;EAG1C,IAAI,KAAK,YAAY;GACnB,MAAM,WAAW,KAAK;GACtB,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,cAAc,QAAQ,CAAC;GAE9C,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,SAAS,QAAQ,CAAC;GAEzC,IAAI,UAAU,SAAS,UAAU,YAC/B,WAAW,KACT,GAAI,MAAM,KAAK,iBAAiB,UAAU,EACxC,sBAAsB,KACxB,CAAC,CACH;EAEJ;EAEA,IAAI,WAAW,SAAS,GACtB,MAAM,KAAK,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC;CAEtD;CAEA,gBAAgB,UAAkB;EAChC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,wBAAwB,UAAkB;EACxC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,qBAAqB,UAAkB,OAAe;EACpD,OAAO,GAAG,KAAK,wBAAwB,QAAQ,IAAI;CACrD;CAEA,4BAA4B,UAAkB;EAC5C,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,yBAAyB,UAAkB,eAAuB;EAChE,OAAO,GAAG,KAAK,4BAA4B,QAAQ,IAAI;CACzD;CAEA,MAAM,iBACJ,UACA,UAA8C,CAAC,GAC5B;EACnB,MAAM,YAAY,KAAK,gBAAgB,QAAQ;EAC/C,MAAM,OAAiB,CAAC;EAExB,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,GAClC,KAAK,KAAK,SAAS;EAGrB,MAAM,YAAY,MAAM,KAAK,QAAQ,KAAK,EACxC,QAAQ,KAAK,wBAAwB,QAAQ,EAC/C,CAAC;EACD,KAAK,KAAK,GAAG,UAAU,KAAK,CAAC;EAE7B,IAAI,QAAQ,sBAAsB;GAChC,MAAM,gBAAgB,MAAM,KAAK,QAAQ,KAAK,EAC5C,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC;GACD,KAAK,KAAK,GAAG,cAAc,KAAK,CAAC;EACnC;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,UAAiC;EACtD,MAAM,KAAK,oCAAoC,KAAK,QAAQ;EAE5D,MAAM,gBAAgB,MAAM,oBAAoB,QAAQ;EACxD,MAAM,iBAAqC;GACzC;GACA,WAAW,KAAK,IAAI;EACtB;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,yBAAyB,KAAK,UAAU,aAAa,GAC1D,cACF;CACF;CAEA,MAAc,oCACZ,UACe;EAIf,MAAM,cAAc,CAAC,IAAG,MAHS,KAAK,QAAQ,KAAyB,EACrE,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC,EAAA,CAC0C,QAAQ,CAAC,CAAC,CAClD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;CAEzC;CAEA,MAAM,eAAgC;EACpC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS;GACX,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,QAAQ,KAAK;GACnE,IAAI,eAAe;IACjB,QAAQ,YAAY,cAAc;IAClC,OAAO,cAAc;GACvB;EACF;EAEA,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IACxC,KAAK,gBAAgB,KAAK,QAAQ,CACpC;EACA,IAAI,gBAAgB;GAClB,IAAI,SACF,QAAQ,YAAY,KAAK,gBAAgB,KAAK,QAAQ;GAExD,OAAO;EACT;EAEA,IAAI,SACF,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,mBAAmB,MAAM,KAAK,QAAQ,KAAyB,EACnE,QAAQ,KAAK,wBAAwB,KAAK,QAAQ,EACpD,CAAC;EACD,MAAM,4BAA4B,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAAC,QAC/D,GAAG,oBAAoB,CAAC,UAAU,eAAe,SAAS,CAC7D;EACA,MAAM,cAAc,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAChD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;EAGvC,IAAI,0BAA0B,WAAW,GAAG;GAC1C,MAAM,CAAC,GAAG,mBAAmB;GAC7B,OAAO,eAAe;EACxB;EAEA,IAAI,0BAA0B,SAAS,GACrC,MAAM,IAAI,MACR,2FACF;EAGF,MAAM,IAAI,MAAM,wBAAwB;CAC1C;CAEA,MAAc,qBACZ,OACwD;EACxD,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sBAAsB;EAGxC,MAAM,MAAM,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK;EACjE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IAAwB,GAAG;EACrE,IAAI,CAAC,gBACH;EAGF,IAAI,UAAU,eAAe,SAAS,GAAG;GACvC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,MAAM,IAAI,MAAM,uBAAuB;EACzC;EAEA,OAAO;GAAE;GAAK,UAAU,eAAe;EAAS;CAClD;CAEA,MAAM,yBACJ,OACA,UACY;EACZ,OAAO,yBAAyB,IAAI,EAAE,MAAM,GAAG,QAAQ;CACzD;CAEA,MAAM,qBAAoC;EACxC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS,WAAW;GACtB,MAAM,KAAK,QAAQ,OAAO,QAAQ,SAAS;GAC3C;EACF;EAEA,IAAI,SAAS;GACX,MAAM,SAAS,gBAAgB,QAAQ,KAAK;GAC5C,IAAI,QAAQ;IACV,MAAM,KAAK,QAAQ,OACjB,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK,CACvD;IACA;GACF;EACF;EAEA,MAAM,OAAO,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACtD,IAAI,KAAK,SAAS,GAChB,MAAM,KAAK,QAAQ,OAAO,IAAI;CAElC;AACF"}

package/dist/mcp/index.d.ts

@@ -1,45 +1,56 @@
 import {
-  $t as WorkerTransport,
-  At as MCP_SERVER_ID_MAX_LENGTH,
-  Bt as RPC_DO_PREFIX,
-  Ct as MCPClientOAuthCallbackConfig,
-  Et as MCPDiscoverResult,
-  Ft as MCPElicitationHandlers,
-  Gt as ClearableEventStore,
-  Ht as ElicitRequestSchema,
-  It as RPCClientTransport,
-  Jt as createMcpHandler,
-  Kt as DurableObjectEventStore,
-  Lt as RPCClientTransportOptions,
-  Nt as normalizeServerId,
-  Pt as MCPElicitationHandler,
-  Qt as TransportState,
-  Rt as RPCServerTransport,
-  Tt as MCPConnectionResult,
-  Ut as ElicitResult,
-  Vt as ElicitRequest,
-  Wt as McpAgent,
-  Xt as McpAuthContext,
-  Yt as experimental_createMcpHandler,
-  Zt as getMcpAuthContext,
-  bt as MCPClientElicitationHandlers,
-  en as WorkerTransportOptions,
-  kt as MCPServerOptions,
-  nn as StreamableHTTPEdgeClientTransport,
-  qt as CreateMcpHandlerOptions,
-  rn as McpClientOptions,
-  tn as SSEEdgeClientTransport,
-  wt as MCPClientOAuthResult,
-  yt as MCPClientElicitationHandler,
-  zt as RPCServerTransportOptions
-} from "../agent-tool-types-BNUGGBzQ.js";
+  $t as LegacyMcpHandler,
+  Bt as RPCServerTransport,
+  Dt as MCPConnectionResult,
+  Et as MCPClientOAuthResult,
+  Ft as normalizeServerId,
+  Gt as ElicitResult,
+  Ht as RPC_DO_PREFIX,
+  It as MCPElicitationHandler,
+  Jt as DurableObjectEventStore,
+  Kt as McpAgent,
+  Lt as MCPElicitationHandlers,
+  Mt as MCP_SERVER_ID_MAX_LENGTH,
+  Ot as MCPDiscoverResult,
+  Qt as CreateMcpHandlerOptions,
+  Rt as RPCClientTransport,
+  St as MCPClientElicitationHandlers,
+  Tt as MCPClientOAuthCallbackConfig,
+  Ut as ElicitRequest,
+  Vt as RPCServerTransportOptions,
+  Wt as ElicitRequestSchema,
+  Xt as experimental_createMcpHandler,
+  Yt as createMcpHandler,
+  Zt as CreateLegacyMcpHandlerOptions,
+  an as SSEEdgeClientTransport,
+  en as createLegacyMcpHandler,
+  in as WorkerTransportOptions,
+  jt as MCPServerOptions,
+  nn as TransportState,
+  on as StreamableHTTPEdgeClientTransport,
+  qt as ClearableEventStore,
+  rn as WorkerTransport,
+  tn as MCPStorageApi,
+  xt as MCPClientElicitationHandler,
+  zt as RPCClientTransportOptions
+} from "../agent-tool-types-Btk9ETS-.js";
+import {
+  a as McpAuthContext,
+  n as StatelessMcpHandler,
+  o as getMcpAuthContext,
+  t as CreateStatelessMcpHandlerOptions,
+  u as McpClientOptions
+} from "../handler-stateless-C_bo-Ytq.js";
 export {
   type ClearableEventStore,
+  type CreateLegacyMcpHandlerOptions,
   type CreateMcpHandlerOptions,
+  type CreateStatelessMcpHandlerOptions,
   DurableObjectEventStore,
   type ElicitRequest,
   ElicitRequestSchema,
   type ElicitResult,
+  type LegacyMcpHandler,
   type MCPClientElicitationHandler,
   type MCPClientElicitationHandlers,
   type MCPClientOAuthCallbackConfig,
@@ -49,6 +60,7 @@ export {
   type MCPElicitationHandler,
   type MCPElicitationHandlers,
   type MCPServerOptions,
+  type MCPStorageApi,
   MCP_SERVER_ID_MAX_LENGTH,
   McpAgent,
   type McpAuthContext,
@@ -59,10 +71,12 @@ export {
   type RPCServerTransportOptions,
   RPC_DO_PREFIX,
   SSEEdgeClientTransport,
+  type StatelessMcpHandler,
   StreamableHTTPEdgeClientTransport,
   type TransportState,
   WorkerTransport,
   type WorkerTransportOptions,
+  createLegacyMcpHandler,
   createMcpHandler,
   experimental_createMcpHandler,
   getMcpAuthContext,

package/dist/mcp/index.js

@@ -1,44 +1,13 @@
 import "../types.js";
-import { c as RPC_DO_PREFIX, i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, o as RPCClientTransport, s as RPCServerTransport } from "../client-CcjiFpTf.js";
+import { c as RPC_DO_PREFIX, i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, o as RPCClientTransport, s as RPCServerTransport } from "../client-zqKcsyFa.js";
 import { Agent, getAgentByName, getCurrentAgent } from "../index.js";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { ElicitRequestSchema, InitializeRequestSchema, JSONRPCMessageSchema, isInitializeRequest, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResultResponse } from "@modelcontextprotocol/sdk/types.js";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
-//#region src/mcp/sse-keepalive.ts
-/**
-* Shared SSE keepalive utility for MCP transports.
-*
-* Cloudflare's edge closes idle SSE responses after ~5 minutes. Writers
-* that may sit silent for that long (long-running tool calls, idle
-* standalone GET streams) arm a keepalive to keep the response under the
-* watchdog.
-*
-* See cloudflare/agents#1583.
-*/
-/** Interval between SSE keepalive comment frames, in ms.
-*
-* The WHATWG SSE spec recommends a comment line every "15 seconds or so"
-* (html.spec.whatwg.org §9.2.7). 25s gives comfortable headroom below
-* both the ~30s post-handler background-work cancellation window on
-* Workers and the ~5min Cloudflare edge idle-stream watchdog.
-*/
-const KEEPALIVE_INTERVAL_MS = 25e3;
-/** SSE comment frame the parser drops before any event dispatch. */
-const KEEPALIVE_FRAME = ": keepalive\n\n";
-/**
-* Start an SSE keepalive on `writer`. Returns a `clearInterval` handle
-* that the stream cleanup must invoke when the stream closes.
-*/
-function startKeepalive(writer, encoder) {
-	const handle = setInterval(() => {
-		writer.write(encoder.encode(KEEPALIVE_FRAME)).catch(() => clearInterval(handle));
-	}, KEEPALIVE_INTERVAL_MS);
-	return handle;
-}
-//#endregion
+import { a as KEEPALIVE_INTERVAL_MS, i as KEEPALIVE_FRAME, n as getMcpAuthContext, o as startKeepalive, r as runWithAuthContext, t as createStatelessMcpHandler } from "../handler-stateless-8hQN_kC3.js";
+import { SSEClientTransport, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
+import { ElicitRequestSchema, InitializeRequestSchema, JSONRPCMessageSchema, SUPPORTED_PROTOCOL_VERSIONS, isInitializeRequest, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResultResponse } from "@modelcontextprotocol/sdk/types.js";
+import { McpServer, Server } from "@modelcontextprotocol/server";
+import { McpServer as McpServer$1 } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { Server as Server$1 } from "@modelcontextprotocol/sdk/server/index.js";
+import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport$1 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 //#region src/mcp/utils.ts
 /**
 * Since we use WebSockets to bridge the client to the
@@ -54,6 +23,18 @@ const MCP_HTTP_METHOD_HEADER = "cf-mcp-method";
 */
 const MCP_MESSAGE_HEADER = "cf-mcp-message";
 const MAXIMUM_MESSAGE_SIZE_BYTES = 4 * 1024 * 1024;
+function unsupportedProtocolVersionResponse(request) {
+	const protocolVersion = request.headers.get("mcp-protocol-version");
+	if (protocolVersion === null || SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) return;
+	return Response.json({
+		error: {
+			code: -32e3,
+			message: `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`
+		},
+		id: null,
+		jsonrpc: "2.0"
+	}, { status: 400 });
+}
 const createStreamingHttpHandler = (basePath, namespace, options = {}) => {
 	let pathname = basePath;
 	if (basePath === "/") pathname = "/*";
@@ -151,6 +132,10 @@ const createStreamingHttpHandler = (basePath, namespace, options = {}) => {
 					});
 					return new Response(body, { status: 400 });
 				}
+				if (!maybeInitializeRequest) {
+					const unsupportedVersion = unsupportedProtocolVersionResponse(request);
+					if (unsupportedVersion) return unsupportedVersion;
+				}
 				if (!maybeInitializeRequest && !sessionId) {
 					const body = JSON.stringify({
 						error: {
@@ -279,6 +264,8 @@ const createStreamingHttpHandler = (basePath, namespace, options = {}) => {
 					id: null,
 					jsonrpc: "2.0"
 				}), { status: 400 });
+				const unsupportedVersion = unsupportedProtocolVersionResponse(request);
+				if (unsupportedVersion) return unsupportedVersion;
 				const { readable, writable } = new TransformStream();
 				const writer = writable.getWriter();
 				const encoder = new TextEncoder();
@@ -338,6 +325,8 @@ const createStreamingHttpHandler = (basePath, namespace, options = {}) => {
 					status: 200
 				});
 			} else if (request.method === "DELETE") {
+				const unsupportedVersion = unsupportedProtocolVersionResponse(request);
+				if (unsupportedVersion) return unsupportedVersion;
 				const sessionId = request.headers.get("mcp-session-id");
 				if (!sessionId) return new Response(JSON.stringify({
 					jsonrpc: "2.0",
@@ -980,36 +969,36 @@ DurableObjectEventStore.REPLAY_LIMIT = 1e3;
 */
 let didWarnAboutSSEEdgeClientTransport = false;
 /**
-* @deprecated Use SSEClientTransport from @modelcontextprotocol/sdk/client/sse.js instead. This alias will be removed in the next major version.
+* @deprecated Use SSEClientTransport from @modelcontextprotocol/client instead. This alias will be removed in the next major version.
 */
 var SSEEdgeClientTransport = class extends SSEClientTransport {
 	constructor(url, options) {
 		super(url, options);
 		if (!didWarnAboutSSEEdgeClientTransport) {
 			didWarnAboutSSEEdgeClientTransport = true;
-			console.warn("SSEEdgeClientTransport is deprecated. Use SSEClientTransport from @modelcontextprotocol/sdk/client/sse.js instead. SSEEdgeClientTransport will be removed in the next major version.");
+			console.warn("SSEEdgeClientTransport is deprecated. Use SSEClientTransport from @modelcontextprotocol/client instead. SSEEdgeClientTransport will be removed in the next major version.");
 		}
 	}
 };
 let didWarnAboutStreamableHTTPEdgeClientTransport = false;
 /**
-* @deprecated Use StreamableHTTPClientTransport from @modelcontextprotocol/sdk/client/streamableHttp.js instead. This alias will be removed in the next major version.
+* @deprecated Use StreamableHTTPClientTransport from @modelcontextprotocol/client instead. This alias will be removed in the next major version.
 */
 var StreamableHTTPEdgeClientTransport = class extends StreamableHTTPClientTransport {
 	constructor(url, options) {
 		super(url, options);
 		if (!didWarnAboutStreamableHTTPEdgeClientTransport) {
 			didWarnAboutStreamableHTTPEdgeClientTransport = true;
-			console.warn("StreamableHTTPEdgeClientTransport is deprecated. Use StreamableHTTPClientTransport from @modelcontextprotocol/sdk/client/streamableHttp.js instead. StreamableHTTPEdgeClientTransport will be removed in the next major version.");
+			console.warn("StreamableHTTPEdgeClientTransport is deprecated. Use StreamableHTTPClientTransport from @modelcontextprotocol/client instead. StreamableHTTPEdgeClientTransport will be removed in the next major version.");
 		}
 	}
 };
 //#endregion
 //#region src/mcp/worker-transport.ts
 /**
-* WorkerTransport
+* WorkerTransport — retained sessionful Legacy transport
 *
-* Thin Cloudflare-Workers wrapper around the official MCP SDK
+* Thin Cloudflare-Workers wrapper around the official MCP SDK v1
 * `WebStandardStreamableHTTPServerTransport`. The wrapper layers a couple of
 * Workers-specific concerns on top of the SDK transport without forking it:
 *
@@ -1029,7 +1018,8 @@ var StreamableHTTPEdgeClientTransport = class extends StreamableHTTPClientTransp
 *     POST response streams always keepalive (no resumption path during a
 *     mid-flight tool call). See cloudflare/agents#1583.
 *
-* Everything else (session validation, SSE streaming, protocol-version
+* Stateless handlers do not import this module. Everything else (session
+* validation, SSE streaming, protocol-version
 * negotiation, event-store resumability, etc.) is delegated to the SDK
 * transport.
 */
@@ -1042,7 +1032,7 @@ const DEFAULT_CORS_OPTIONS = {
 	exposeHeaders: "mcp-session-id",
 	maxAge: 86400
 };
-var WorkerTransport = class extends WebStandardStreamableHTTPServerTransport {
+var WorkerTransport = class extends WebStandardStreamableHTTPServerTransport$1 {
 	constructor(options = {}) {
 		const { corsOptions, storage, onsessioninitialized, ...sdkOptions } = options;
 		super({
@@ -1294,67 +1284,81 @@ var WorkerTransport = class extends WebStandardStreamableHTTPServerTransport {
 	}
 };
 //#endregion
-//#region src/mcp/auth-context.ts
-const authContextStorage = new AsyncLocalStorage();
-function getMcpAuthContext() {
-	return authContextStorage.getStore();
-}
-function runWithAuthContext(context, fn) {
-	return authContextStorage.run(context, fn);
-}
-//#endregion
-//#region src/mcp/handler.ts
-function createMcpHandler(server, options = {}) {
+//#region src/mcp/handler-legacy.ts
+/**
+* Create a sessionful Legacy MCP handler backed by SDK v1.
+*
+* New Stateless servers should use `createMcpHandler` from
+* `agents/mcp/server` instead.
+*/
+function createLegacyMcpHandler(server, options = {}) {
 	const route = options.route ?? "/mcp";
 	const { route: _route, authContext, transport: providedTransport, ...transportOptions } = options;
 	return async (request, _env, ctx) => {
 		const url = new URL(request.url);
 		if (route && url.pathname !== route) return new Response("Not Found", { status: 404 });
 		const transport = providedTransport ?? new WorkerTransport(transportOptions);
-		const buildAuthContext = () => {
-			if (authContext) return authContext;
-			if (ctx.props && Object.keys(ctx.props).length > 0) return { props: ctx.props };
-		};
-		const handleRequest = async () => {
-			return await transport.handleRequest(request);
-		};
-		const resolvedAuthContext = buildAuthContext();
+		const resolvedAuthContext = authContext ?? (ctx.props && Object.keys(ctx.props).length > 0 ? { props: ctx.props } : void 0);
 		if (!transport.started) {
-			if (server instanceof McpServer ? server.isConnected() : server.transport !== void 0) throw new Error("Server is already connected to a transport. Create a new McpServer instance per request for stateless handlers.");
+			if (server instanceof McpServer$1 ? server.isConnected() : server.transport !== void 0) throw new Error("Server is already connected to a transport. Create a new McpServer instance per request for stateless handlers.");
 			await server.connect(transport);
 		}
+		const handleRequest = () => transport.handleRequest(request);
 		try {
-			if (resolvedAuthContext) return await runWithAuthContext(resolvedAuthContext, handleRequest);
-			else return await handleRequest();
+			return resolvedAuthContext ? await runWithAuthContext(resolvedAuthContext, handleRequest) : await handleRequest();
 		} catch (error) {
 			console.error("MCP handler error:", error);
-			return new Response(JSON.stringify({
+			return Response.json({
 				jsonrpc: "2.0",
 				error: {
 					code: -32603,
 					message: error instanceof Error ? error.message : "Internal server error"
 				},
 				id: null
-			}), {
-				status: 500,
-				headers: { "Content-Type": "application/json" }
-			});
+			}, { status: 500 });
 		}
 	};
 }
+//#endregion
+//#region src/mcp/handler-warning.ts
+let didWarnAboutLegacyCreateMcpHandlerOverload = false;
+function warnLegacyCreateMcpHandlerOverload() {
+	if (didWarnAboutLegacyCreateMcpHandlerOverload) return;
+	didWarnAboutLegacyCreateMcpHandlerOverload = true;
+	console.warn("[agents/mcp] Passing an MCP SDK v1 server to createMcpHandler is deprecated and will be removed in the next major version. Pass an @modelcontextprotocol/server factory to createMcpHandler. To temporarily retain sessionful SDK v1 behavior while migrating, use createLegacyMcpHandler.");
+}
+//#endregion
+//#region src/mcp/handler-compat.ts
+function createMcpHandler(serverOrFactory, options = {}) {
+	if (typeof serverOrFactory === "function") return createStatelessMcpHandler(serverOrFactory, options);
+	if (serverOrFactory instanceof McpServer$1 || serverOrFactory instanceof Server$1) {
+		warnLegacyCreateMcpHandlerOverload();
+		return createLegacyMcpHandler(serverOrFactory, options);
+	}
+	throw new TypeError("createMcpHandler received an unsupported server. Pass a factory returning McpServer or Server from \"@modelcontextprotocol/server\", or use createLegacyMcpHandler with an MCP SDK v1 server.");
+}
 let didWarnAboutExperimentalCreateMcpHandler = false;
 /**
-* @deprecated This has been renamed to createMcpHandler, and experimental_createMcpHandler will be removed in the next major version
+* @deprecated Pass an SDK v2 factory to createMcpHandler.
+* experimental_createMcpHandler will be removed in the next major version.
+* Use createLegacyMcpHandler only to temporarily retain sessionful SDK v1
+* behavior while migrating.
 */
 function experimental_createMcpHandler(server, options = {}) {
 	if (!didWarnAboutExperimentalCreateMcpHandler) {
 		didWarnAboutExperimentalCreateMcpHandler = true;
-		console.warn("experimental_createMcpHandler is deprecated, use createMcpHandler instead. experimental_createMcpHandler will be removed in the next major version.");
+		console.warn("experimental_createMcpHandler is deprecated and will be removed in the next major version. Pass an @modelcontextprotocol/server factory to createMcpHandler. To temporarily retain sessionful SDK v1 behavior while migrating, use createLegacyMcpHandler.");
 	}
-	return createMcpHandler(server, options);
+	return createLegacyMcpHandler(server, options);
 }
 //#endregion
-//#region src/mcp/index.ts
+//#region src/mcp/legacy-agent.ts
+/**
+* @deprecated McpAgent is feature-frozen. Migrate to an SDK v2 factory with
+* createMcpHandler from agents/mcp/server. When sessionful features prevent an
+* immediate migration, run the stateless route beside the existing McpAgent
+* route until clients transition and sessions drain.
+*/
 var McpAgent = class McpAgent extends Agent {
 	constructor(..._args) {
 		super(..._args);
@@ -1502,6 +1506,7 @@ var McpAgent = class McpAgent extends Agent {
 		else this.props = await this.ctx.storage.get("props");
 		await this.init();
 		const server = await this.server;
+		if (server instanceof McpServer || server instanceof Server) throw new TypeError("McpAgent uses MCP SDK v1 and cannot serve McpServer from \"@modelcontextprotocol/server\". For MCP SDK v2, use createMcpHandler. Existing McpAgent applications should continue importing McpServer from \"@modelcontextprotocol/sdk/server/mcp.js\".");
 		this._transport = this.initTransport();
 		if (!this._transport) throw new Error("Failed to initialize transport");
 		await server.connect(this._transport);
@@ -1698,6 +1703,6 @@ var McpAgent = class McpAgent extends Agent {
 };
 McpAgent.STREAM_REQS_KEY_PREFIX = "__mcp_stream_reqs__:";
 //#endregion
-export { DurableObjectEventStore, ElicitRequestSchema, MCP_SERVER_ID_MAX_LENGTH, McpAgent, RPCClientTransport, RPCServerTransport, RPC_DO_PREFIX, SSEEdgeClientTransport, StreamableHTTPEdgeClientTransport, WorkerTransport, createMcpHandler, experimental_createMcpHandler, getMcpAuthContext, normalizeServerId };
+export { DurableObjectEventStore, ElicitRequestSchema, MCP_SERVER_ID_MAX_LENGTH, McpAgent, RPCClientTransport, RPCServerTransport, RPC_DO_PREFIX, SSEEdgeClientTransport, StreamableHTTPEdgeClientTransport, WorkerTransport, createLegacyMcpHandler, createMcpHandler, experimental_createMcpHandler, getMcpAuthContext, normalizeServerId };
 
 //# sourceMappingURL=index.js.map