agents 0.25.0 → 0.27.0

package/dist/internal-kmw70xwR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-kmw70xwR.js","names":[],"sources":["../src/experimental/channels/internal.ts"],"sourcesContent":["import type {\n  ChannelMessage,\n  DeliveryResult,\n  ParticipantResult\n} from \"./channel\";\nimport type { ChannelIngressResult } from \"./ingress\";\nimport type { Participant } from \"./protocol\";\n\nconst textEncoder = new TextEncoder();\n\nexport function encodeUtf8(value: string): Uint8Array<ArrayBuffer> {\n  return textEncoder.encode(value);\n}\n\nexport function utf8ByteLength(value: string): number {\n  return encodeUtf8(value).byteLength;\n}\n\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function defaultText(message: ChannelMessage): string {\n  return message.title\n    ? `${message.title}\\n\\n${message.markdown}`\n    : message.markdown;\n}\n\nexport function renderInput(input: unknown): string {\n  if (typeof input === \"string\") return input;\n  try {\n    return JSON.stringify(input, null, 2) ?? String(input);\n  } catch {\n    return String(input);\n  }\n}\n\nexport function uncertain(\n  code: string,\n  message: string,\n  reference?: string\n): Extract<DeliveryResult, { status: \"uncertain\" }> {\n  return {\n    status: \"uncertain\",\n    ...(reference !== undefined && { reference }),\n    error: { code, message }\n  };\n}\n\nexport function emptyIngressResponse<TRaw>(\n  status = 200\n): ChannelIngressResult<TRaw> {\n  return { events: [], response: new Response(null, { status }) };\n}\n\nexport function unsupported(\n  code: string,\n  message: string\n): Extract<DeliveryResult, { status: \"failed\" }> {\n  return {\n    status: \"failed\",\n    retryable: false,\n    error: { code, message }\n  };\n}\n\n/** The agent object of a participant's own, namespaced so app routes cannot collide. */\nexport function participantRoute(participant: Participant): string {\n  return `participant:${participant.id}`;\n}\n\n/** Check what an application's `participant` callback returned. */\nexport function toParticipant(\n  result: ParticipantResult,\n  source: string\n): Participant | null {\n  if (result === null) return null;\n  if (typeof result === \"string\") {\n    if (result.length > 0) return { id: result };\n  } else if (\n    isRecord(result) &&\n    typeof result.id === \"string\" &&\n    result.id.length > 0 &&\n    (result.name === undefined || typeof result.name === \"string\")\n  ) {\n    return result.name === undefined\n      ? { id: result.id }\n      : { id: result.id, name: result.name };\n  }\n  throw new Error(\n    `${source} participant must return a non-empty id, a participant, or null`\n  );\n}\n"],"mappings":";AAQA,MAAM,cAAc,IAAI,YAAY;AAEpC,SAAgB,WAAW,OAAwC;CACjE,OAAO,YAAY,OAAO,KAAK;AACjC;AAEA,SAAgB,eAAe,OAAuB;CACpD,OAAO,WAAW,KAAK,CAAC,CAAC;AAC3B;AAEA,SAAgB,SAAS,OAAkD;CACzE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AA6BA,SAAgB,qBACd,SAAS,KACmB;CAC5B,OAAO;EAAE,QAAQ,CAAC;EAAG,UAAU,IAAI,SAAS,MAAM,EAAE,OAAO,CAAC;CAAE;AAChE;AAEA,SAAgB,YACd,MACA,SAC+C;CAC/C,OAAO;EACL,QAAQ;EACR,WAAW;EACX,OAAO;GAAE;GAAM;EAAQ;CACzB;AACF;;AAGA,SAAgB,iBAAiB,aAAkC;CACjE,OAAO,eAAe,YAAY;AACpC;;AAGA,SAAgB,cACd,QACA,QACoB;CACpB,IAAI,WAAW,MAAM,OAAO;CAC5B,IAAI,OAAO,WAAW;MAChB,OAAO,SAAS,GAAG,OAAO,EAAE,IAAI,OAAO;CAAA,OACtC,IACL,SAAS,MAAM,KACf,OAAO,OAAO,OAAO,YACrB,OAAO,GAAG,SAAS,MAClB,OAAO,SAAS,KAAA,KAAa,OAAO,OAAO,SAAS,WAErD,OAAO,OAAO,SAAS,KAAA,IACnB,EAAE,IAAI,OAAO,GAAG,IAChB;EAAE,IAAI,OAAO;EAAI,MAAM,OAAO;CAAK;CAEzC,MAAM,IAAI,MACR,GAAG,OAAO,gEACZ;AACF"}

package/dist/internal_context.d.ts

@@ -2,7 +2,7 @@ import {
   i as __DO_NOT_USE_WILL_BREAK__agentContext,
   n as CurrentAgentContext,
   t as AgentContextStore
-} from "./current-agent-vAk_5JMt.js";
+} from "./current-agent-C07C5o5Y.js";
 import { t as AgentEmail } from "./internal_context-BlxFEWfn.js";
 export {
   type AgentContextStore,

package/dist/lifecycle/index.d.ts

@@ -24,16 +24,16 @@ import {
   w as ConnectionState,
   x as Connection,
   y as LifecycleJobPushOptions
-} from "../capability-runner-DBAnGr6L.js";
+} from "../capability-runner-O5VbQzqg.js";
 import {
   n as LifecycleOptions,
   t as Lifecycle
-} from "../durable-object-lifecycle-HhgOMWq9.js";
+} from "../durable-object-lifecycle-DRqp475_.js";
 import {
   a as getCurrentAgent,
   n as CurrentAgentContext,
   r as LifecycleObject
-} from "../current-agent-vAk_5JMt.js";
+} from "../current-agent-C07C5o5Y.js";
 export {
   type CapabilityRequestContext,
   type CapabilityStartContext,

package/dist/mcp/client/do-oauth-client-provider.d.ts

@@ -2,7 +2,7 @@ import {
   n as AgentsOAuthProvider,
   r as DurableObjectOAuthClientProvider,
   t as AgentMcpOAuthProvider
-} from "../../do-oauth-client-provider-Tmf1vgKz.js";
+} from "../../do-oauth-client-provider-DfsUcpc3.js";
 export {
   AgentMcpOAuthProvider,
   AgentsOAuthProvider,

package/dist/mcp/client/do-oauth-client-provider.js

@@ -186,6 +186,15 @@ var DurableObjectOAuthClientProvider = class {
 		}
 		if (deleteKeys.length > 0) await this.storage.delete([...new Set(deleteKeys)]);
 	}
+	/**
+	* Delete every key this provider stores for its server: tokens and client
+	* info for any client ID, verifiers, pending states and discovery state.
+	* Used when the server is removed. Other servers' keys are untouched.
+	*/
+	async clearServerStorage() {
+		const keys = [...(await this.storage.list({ prefix: `/${this.clientName}/${this.serverId}/` })).keys()];
+		for (let i = 0; i < keys.length; i += 128) await this.storage.delete(keys.slice(i, i + 128));
+	}
 	codeVerifierKey(clientId) {
 		return `${this.keyPrefix(clientId)}/code_verifier`;
 	}

package/dist/mcp/client/do-oauth-client-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"do-oauth-client-provider.js","names":[],"sources":["../../../src/mcp/client/do-oauth-client-provider.ts"],"sourcesContent":["import type {\n  OAuthClientInformationContext,\n  OAuthClientMetadata,\n  OAuthClientProvider,\n  OAuthDiscoveryState,\n  StoredOAuthClientInformation,\n  StoredOAuthTokens\n} from \"@modelcontextprotocol/client\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { nanoid } from \"nanoid\";\n\nconst STATE_EXPIRATION_MS = 10 * 60 * 1000; // 10 minutes\n\nconst codeVerifierStateStorage = new AsyncLocalStorage<{\n  state: string;\n  servedKey?: string;\n}>();\n\ninterface StoredState {\n  nonce: string;\n  serverId: string;\n  createdAt: number;\n}\n\ninterface StoredCodeVerifier {\n  verifier: string;\n  createdAt: number;\n}\n\n// A slight extension to the standard OAuthClientProvider interface because `redirectToAuthorization` doesn't give us the interface we need\n// This allows us to track authentication for a specific server and associated dynamic client registration\nexport interface AgentMcpOAuthProvider extends OAuthClientProvider {\n  authUrl: string | undefined;\n  clientId: string | undefined;\n  serverId: string | undefined;\n  checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }>;\n  consumeState(state: string): Promise<void>;\n  runWithCodeVerifierState?<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T>;\n  deleteCodeVerifier(): Promise<void>;\n}\n\nfunction parseOAuthState(\n  state: string\n): { nonce: string; serverId: string } | undefined {\n  const parts = state.split(\".\");\n  if (parts.length !== 2) {\n    return undefined;\n  }\n\n  const [nonce, serverId] = parts;\n  if (!nonce || !serverId) {\n    return undefined;\n  }\n\n  return { nonce, serverId };\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function createCodeChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier)\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction isExpired(createdAt: number): boolean {\n  return Date.now() - createdAt > STATE_EXPIRATION_MS;\n}\n\n/**\n * @deprecated Use {@link AgentMcpOAuthProvider} instead.\n */\nexport type AgentsOAuthProvider = AgentMcpOAuthProvider;\n\nexport class DurableObjectOAuthClientProvider implements AgentMcpOAuthProvider {\n  private _authUrl_: string | undefined;\n  private _serverId_: string | undefined;\n  private _clientId_: string | undefined;\n\n  constructor(\n    public storage: DurableObjectStorage,\n    public clientName: string,\n    public baseRedirectUrl: string\n  ) {\n    if (!storage) {\n      throw new Error(\n        \"DurableObjectOAuthClientProvider requires a valid DurableObjectStorage instance\"\n      );\n    }\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return {\n      client_name: this.clientName,\n      client_uri: this.clientUri,\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      redirect_uris: [this.redirectUrl],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\"\n    };\n  }\n\n  get clientUri() {\n    return new URL(this.redirectUrl).origin;\n  }\n\n  get redirectUrl() {\n    return this.baseRedirectUrl;\n  }\n\n  get clientId() {\n    if (!this._clientId_) {\n      throw new Error(\"Trying to access clientId before it was set\");\n    }\n    return this._clientId_;\n  }\n\n  set clientId(clientId_: string) {\n    this._clientId_ = clientId_;\n  }\n\n  get serverId() {\n    if (!this._serverId_) {\n      throw new Error(\"Trying to access serverId before it was set\");\n    }\n    return this._serverId_;\n  }\n\n  set serverId(serverId_: string) {\n    this._serverId_ = serverId_;\n  }\n\n  keyPrefix(clientId: string) {\n    return `/${this.clientName}/${this.serverId}/${clientId}`;\n  }\n\n  clientInfoKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/client_info/`;\n  }\n\n  discoveryStateKey() {\n    return `/${this.clientName}/${this.serverId}/oauth_discovery`;\n  }\n\n  async saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {\n    await this.storage.put(this.discoveryStateKey(), state);\n  }\n\n  async discoveryState(): Promise<OAuthDiscoveryState | undefined> {\n    return (\n      (await this.storage.get<OAuthDiscoveryState>(this.discoveryStateKey())) ??\n      undefined\n    );\n  }\n\n  async clientInformation(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthClientInformation | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthClientInformation>(\n        this.clientInfoKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveClientInformation(\n    clientInformation: StoredOAuthClientInformation,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    this.clientId = clientInformation.client_id;\n    // Round-trip the SDK's issuer stamp verbatim. The SDK treats a credential\n    // stamped for another issuer as absent, so one durable slot per MCP server\n    // is both sufficient and safer than maintaining our own issuer index.\n    await this.storage.put(\n      this.clientInfoKey(clientInformation.client_id),\n      clientInformation\n    );\n  }\n\n  tokenKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/token`;\n  }\n\n  async tokens(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthTokens | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthTokens>(\n        this.tokenKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveTokens(\n    tokens: StoredOAuthTokens,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    // Keep the SDK-owned issuer stamp intact for SEP-2352 validation. Discovery\n    // is needed across the browser redirect, but once token issuance succeeds\n    // it must not pin later re-authorization to this AS: a subsequent 401 must\n    // re-read PRM so an authorization-server migration can be observed.\n    await this.storage.put(this.tokenKey(this.clientId), tokens);\n    await this.storage.delete(this.discoveryStateKey());\n  }\n\n  get authUrl() {\n    return this._authUrl_;\n  }\n\n  stateKey(nonce: string) {\n    return `/${this.clientName}/${this.serverId}/state/${nonce}`;\n  }\n\n  async state(): Promise<string> {\n    const nonce = nanoid();\n    const state = `${nonce}.${this.serverId}`;\n    const storedState: StoredState = {\n      nonce,\n      serverId: this.serverId,\n      createdAt: Date.now()\n    };\n    await this.storage.put(this.stateKey(nonce), storedState);\n    return state;\n  }\n\n  async checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      return { valid: false, error: \"Invalid state format\" };\n    }\n\n    const { nonce, serverId } = parsed;\n    const key = this.stateKey(nonce);\n    const storedState = await this.storage.get<StoredState>(key);\n\n    if (!storedState) {\n      return { valid: false, error: \"State not found or already used\" };\n    }\n\n    if (storedState.serverId !== serverId) {\n      await this.storage.delete(key);\n      return { valid: false, error: \"State serverId mismatch\" };\n    }\n\n    if (isExpired(storedState.createdAt)) {\n      const deleteKeys = [key];\n      if (this._clientId_) {\n        deleteKeys.push(this.stateCodeVerifierKey(this.clientId, nonce));\n      }\n      await this.storage.delete(deleteKeys);\n      return { valid: false, error: \"State expired\" };\n    }\n\n    return { valid: true, serverId };\n  }\n\n  async consumeState(state: string): Promise<void> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      // This should never happen since checkState validates format first.\n      // Log for debugging but don't throw - state consumption is best-effort.\n      console.warn(`[OAuth] consumeState called with invalid state format`);\n      return;\n    }\n    await this.storage.delete(this.stateKey(parsed.nonce));\n  }\n\n  async redirectToAuthorization(authUrl: URL): Promise<void> {\n    this._authUrl_ = authUrl.toString();\n\n    const clientId = this._clientId_;\n    const serverId = this._serverId_;\n    if (!clientId || !serverId) {\n      return;\n    }\n\n    const state = authUrl.searchParams.get(\"state\");\n    const codeChallenge = authUrl.searchParams.get(\"code_challenge\");\n    if (!state || !codeChallenge) {\n      return;\n    }\n\n    const parsed = parseOAuthState(state);\n    if (!parsed || parsed.serverId !== serverId) {\n      return;\n    }\n\n    const challengeKey = this.challengeCodeVerifierKey(clientId, codeChallenge);\n    const pendingVerifier =\n      await this.storage.get<StoredCodeVerifier>(challengeKey);\n    if (!pendingVerifier) {\n      return;\n    }\n\n    if (isExpired(pendingVerifier.createdAt)) {\n      await this.storage.delete(challengeKey);\n      return;\n    }\n\n    await this.storage.put(\n      this.stateCodeVerifierKey(clientId, parsed.nonce),\n      pendingVerifier\n    );\n    await this.storage.delete(challengeKey);\n  }\n\n  async invalidateCredentials(\n    scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"\n  ): Promise<void> {\n    const deleteKeys: string[] = [];\n\n    if (scope === \"all\" || scope === \"discovery\") {\n      deleteKeys.push(this.discoveryStateKey());\n    }\n\n    if (this._clientId_) {\n      const clientId = this.clientId;\n      if (scope === \"all\" || scope === \"client\") {\n        deleteKeys.push(this.clientInfoKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"tokens\") {\n        deleteKeys.push(this.tokenKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"verifier\") {\n        deleteKeys.push(\n          ...(await this.codeVerifierKeys(clientId, {\n            includeChallengeKeys: true\n          }))\n        );\n      }\n    }\n\n    if (deleteKeys.length > 0) {\n      await this.storage.delete([...new Set(deleteKeys)]);\n    }\n  }\n\n  codeVerifierKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier`;\n  }\n\n  stateCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier/`;\n  }\n\n  stateCodeVerifierKey(clientId: string, nonce: string) {\n    return `${this.stateCodeVerifierPrefix(clientId)}${nonce}`;\n  }\n\n  challengeCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier_challenge/`;\n  }\n\n  challengeCodeVerifierKey(clientId: string, codeChallenge: string) {\n    return `${this.challengeCodeVerifierPrefix(clientId)}${codeChallenge}`;\n  }\n\n  async codeVerifierKeys(\n    clientId: string,\n    options: { includeChallengeKeys?: boolean } = {}\n  ): Promise<string[]> {\n    const legacyKey = this.codeVerifierKey(clientId);\n    const keys: string[] = [];\n\n    if (await this.storage.get(legacyKey)) {\n      keys.push(legacyKey);\n    }\n\n    const stateKeys = await this.storage.list({\n      prefix: this.stateCodeVerifierPrefix(clientId)\n    });\n    keys.push(...stateKeys.keys());\n\n    if (options.includeChallengeKeys) {\n      const challengeKeys = await this.storage.list({\n        prefix: this.challengeCodeVerifierPrefix(clientId)\n      });\n      keys.push(...challengeKeys.keys());\n    }\n\n    return keys;\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.deleteExpiredChallengeCodeVerifiers(this.clientId);\n\n    const codeChallenge = await createCodeChallenge(verifier);\n    const storedVerifier: StoredCodeVerifier = {\n      verifier,\n      createdAt: Date.now()\n    };\n\n    await this.storage.put(\n      this.challengeCodeVerifierKey(this.clientId, codeChallenge),\n      storedVerifier\n    );\n  }\n\n  private async deleteExpiredChallengeCodeVerifiers(\n    clientId: string\n  ): Promise<void> {\n    const challengeVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.challengeCodeVerifierPrefix(clientId)\n    });\n    const expiredKeys = [...challengeVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n  }\n\n  async codeVerifier(): Promise<string> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context) {\n      const stateVerifier = await this.codeVerifierForState(context.state);\n      if (stateVerifier) {\n        context.servedKey = stateVerifier.key;\n        return stateVerifier.verifier;\n      }\n    }\n\n    const legacyVerifier = await this.storage.get<string>(\n      this.codeVerifierKey(this.clientId)\n    );\n    if (legacyVerifier) {\n      if (context) {\n        context.servedKey = this.codeVerifierKey(this.clientId);\n      }\n      return legacyVerifier;\n    }\n\n    if (context) {\n      throw new Error(\"No code verifier found for OAuth state\");\n    }\n\n    const pendingVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.stateCodeVerifierPrefix(this.clientId)\n    });\n    const unexpiredPendingVerifiers = [...pendingVerifiers.entries()].filter(\n      ([, storedVerifier]) => !isExpired(storedVerifier.createdAt)\n    );\n    const expiredKeys = [...pendingVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n\n    if (unexpiredPendingVerifiers.length === 1) {\n      const [[, storedVerifier]] = unexpiredPendingVerifiers;\n      return storedVerifier.verifier;\n    }\n\n    if (unexpiredPendingVerifiers.length > 1) {\n      throw new Error(\n        \"Multiple OAuth code verifiers are pending; complete authorization with the callback state\"\n      );\n    }\n\n    throw new Error(\"No code verifier found\");\n  }\n\n  private async codeVerifierForState(\n    state: string\n  ): Promise<{ key: string; verifier: string } | undefined> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      throw new Error(\"Invalid state format\");\n    }\n\n    const key = this.stateCodeVerifierKey(this.clientId, parsed.nonce);\n    const storedVerifier = await this.storage.get<StoredCodeVerifier>(key);\n    if (!storedVerifier) {\n      return undefined;\n    }\n\n    if (isExpired(storedVerifier.createdAt)) {\n      await this.storage.delete(key);\n      throw new Error(\"Code verifier expired\");\n    }\n\n    return { key, verifier: storedVerifier.verifier };\n  }\n\n  async runWithCodeVerifierState<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T> {\n    return codeVerifierStateStorage.run({ state }, callback);\n  }\n\n  async deleteCodeVerifier(): Promise<void> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context?.servedKey) {\n      await this.storage.delete(context.servedKey);\n      return;\n    }\n\n    if (context) {\n      const parsed = parseOAuthState(context.state);\n      if (parsed) {\n        await this.storage.delete(\n          this.stateCodeVerifierKey(this.clientId, parsed.nonce)\n        );\n        return;\n      }\n    }\n\n    const keys = await this.codeVerifierKeys(this.clientId);\n    if (keys.length > 0) {\n      await this.storage.delete(keys);\n    }\n  }\n}\n"],"mappings":";;;AAWA,MAAM,sBAAsB,MAAU;AAEtC,MAAM,2BAA2B,IAAI,kBAGlC;AA8BH,SAAS,gBACP,OACiD;CACjD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB;CAGF,MAAM,CAAC,OAAO,YAAY;CAC1B,IAAI,CAAC,SAAS,CAAC,UACb;CAGF,OAAO;EAAE;EAAO;CAAS;AAC3B;AAEA,SAAS,gBAAgB,OAA2B;CAClD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAChB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,oBAAoB,UAAmC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CACnC;CACA,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,UAAU,WAA4B;CAC7C,OAAO,KAAK,IAAI,IAAI,YAAY;AAClC;AAOA,IAAa,mCAAb,MAA+E;CAK7E,YACE,SACA,YACA,iBACA;EAHO,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,kBAAA;EAEP,IAAI,CAAC,SACH,MAAM,IAAI,MACR,iFACF;CAEJ;CAEA,IAAI,iBAAsC;EACxC,OAAO;GACL,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,aAAa,CAAC,sBAAsB,eAAe;GACnD,eAAe,CAAC,KAAK,WAAW;GAChC,gBAAgB,CAAC,MAAM;GACvB,4BAA4B;EAC9B;CACF;CAEA,IAAI,YAAY;EACd,OAAO,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC;CACnC;CAEA,IAAI,cAAc;EAChB,OAAO,KAAK;CACd;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,UAAU,UAAkB;EAC1B,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,GAAG;CACjD;CAEA,cAAc,UAAkB;EAC9B,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,oBAAoB;EAClB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS;CAC9C;CAEA,MAAM,mBAAmB,OAA2C;EAClE,MAAM,KAAK,QAAQ,IAAI,KAAK,kBAAkB,GAAG,KAAK;CACxD;CAEA,MAAM,iBAA2D;EAC/D,OACG,MAAM,KAAK,QAAQ,IAAyB,KAAK,kBAAkB,CAAC,KACrE,KAAA;CAEJ;CAEA,MAAM,kBACJ,UACmD;EACnD,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,cAAc,KAAK,QAAQ,CAClC,KAAM,KAAA;CAEV;CAEA,MAAM,sBACJ,mBACA,UACe;EACf,KAAK,WAAW,kBAAkB;EAIlC,MAAM,KAAK,QAAQ,IACjB,KAAK,cAAc,kBAAkB,SAAS,GAC9C,iBACF;CACF;CAEA,SAAS,UAAkB;EACzB,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,MAAM,OACJ,UACwC;EACxC,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,SAAS,KAAK,QAAQ,CAC7B,KAAM,KAAA;CAEV;CAEA,MAAM,WACJ,QACA,UACe;EAKf,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,GAAG,MAAM;EAC3D,MAAM,KAAK,QAAQ,OAAO,KAAK,kBAAkB,CAAC;CACpD;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;CAEA,SAAS,OAAe;EACtB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,SAAS;CACvD;CAEA,MAAM,QAAyB;EAC7B,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK;EAC/B,MAAM,cAA2B;GAC/B;GACA,UAAU,KAAK;GACf,WAAW,KAAK,IAAI;EACtB;EACA,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,WAAW;EACxD,OAAO;CACT;CAEA,MAAM,WACJ,OACgE;EAChE,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAuB;EAGvD,MAAM,EAAE,OAAO,aAAa;EAC5B,MAAM,MAAM,KAAK,SAAS,KAAK;EAC/B,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAiB,GAAG;EAE3D,IAAI,CAAC,aACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAkC;EAGlE,IAAI,YAAY,aAAa,UAAU;GACrC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,OAAO;IAAE,OAAO;IAAO,OAAO;GAA0B;EAC1D;EAEA,IAAI,UAAU,YAAY,SAAS,GAAG;GACpC,MAAM,aAAa,CAAC,GAAG;GACvB,IAAI,KAAK,YACP,WAAW,KAAK,KAAK,qBAAqB,KAAK,UAAU,KAAK,CAAC;GAEjE,MAAM,KAAK,QAAQ,OAAO,UAAU;GACpC,OAAO;IAAE,OAAO;IAAO,OAAO;GAAgB;EAChD;EAEA,OAAO;GAAE,OAAO;GAAM;EAAS;CACjC;CAEA,MAAM,aAAa,OAA8B;EAC/C,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QAAQ;GAGX,QAAQ,KAAK,uDAAuD;GACpE;EACF;EACA,MAAM,KAAK,QAAQ,OAAO,KAAK,SAAS,OAAO,KAAK,CAAC;CACvD;CAEA,MAAM,wBAAwB,SAA6B;EACzD,KAAK,YAAY,QAAQ,SAAS;EAElC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,YAAY,CAAC,UAChB;EAGF,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO;EAC9C,MAAM,gBAAgB,QAAQ,aAAa,IAAI,gBAAgB;EAC/D,IAAI,CAAC,SAAS,CAAC,eACb;EAGF,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC;EAGF,MAAM,eAAe,KAAK,yBAAyB,UAAU,aAAa;EAC1E,MAAM,kBACJ,MAAM,KAAK,QAAQ,IAAwB,YAAY;EACzD,IAAI,CAAC,iBACH;EAGF,IAAI,UAAU,gBAAgB,SAAS,GAAG;GACxC,MAAM,KAAK,QAAQ,OAAO,YAAY;GACtC;EACF;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,qBAAqB,UAAU,OAAO,KAAK,GAChD,eACF;EACA,MAAM,KAAK,QAAQ,OAAO,YAAY;CACxC;CAEA,MAAM,sBACJ,OACe;EACf,MAAM,aAAuB,CAAC;EAE9B,IAAI,UAAU,SAAS,UAAU,aAC/B,WAAW,KAAK,KAAK,kBAAkB,CAAC;EAG1C,IAAI,KAAK,YAAY;GACnB,MAAM,WAAW,KAAK;GACtB,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,cAAc,QAAQ,CAAC;GAE9C,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,SAAS,QAAQ,CAAC;GAEzC,IAAI,UAAU,SAAS,UAAU,YAC/B,WAAW,KACT,GAAI,MAAM,KAAK,iBAAiB,UAAU,EACxC,sBAAsB,KACxB,CAAC,CACH;EAEJ;EAEA,IAAI,WAAW,SAAS,GACtB,MAAM,KAAK,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC;CAEtD;CAEA,gBAAgB,UAAkB;EAChC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,wBAAwB,UAAkB;EACxC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,qBAAqB,UAAkB,OAAe;EACpD,OAAO,GAAG,KAAK,wBAAwB,QAAQ,IAAI;CACrD;CAEA,4BAA4B,UAAkB;EAC5C,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,yBAAyB,UAAkB,eAAuB;EAChE,OAAO,GAAG,KAAK,4BAA4B,QAAQ,IAAI;CACzD;CAEA,MAAM,iBACJ,UACA,UAA8C,CAAC,GAC5B;EACnB,MAAM,YAAY,KAAK,gBAAgB,QAAQ;EAC/C,MAAM,OAAiB,CAAC;EAExB,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,GAClC,KAAK,KAAK,SAAS;EAGrB,MAAM,YAAY,MAAM,KAAK,QAAQ,KAAK,EACxC,QAAQ,KAAK,wBAAwB,QAAQ,EAC/C,CAAC;EACD,KAAK,KAAK,GAAG,UAAU,KAAK,CAAC;EAE7B,IAAI,QAAQ,sBAAsB;GAChC,MAAM,gBAAgB,MAAM,KAAK,QAAQ,KAAK,EAC5C,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC;GACD,KAAK,KAAK,GAAG,cAAc,KAAK,CAAC;EACnC;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,UAAiC;EACtD,MAAM,KAAK,oCAAoC,KAAK,QAAQ;EAE5D,MAAM,gBAAgB,MAAM,oBAAoB,QAAQ;EACxD,MAAM,iBAAqC;GACzC;GACA,WAAW,KAAK,IAAI;EACtB;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,yBAAyB,KAAK,UAAU,aAAa,GAC1D,cACF;CACF;CAEA,MAAc,oCACZ,UACe;EAIf,MAAM,cAAc,CAAC,IAAG,MAHS,KAAK,QAAQ,KAAyB,EACrE,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC,EAAA,CAC0C,QAAQ,CAAC,CAAC,CAClD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;CAEzC;CAEA,MAAM,eAAgC;EACpC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS;GACX,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,QAAQ,KAAK;GACnE,IAAI,eAAe;IACjB,QAAQ,YAAY,cAAc;IAClC,OAAO,cAAc;GACvB;EACF;EAEA,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IACxC,KAAK,gBAAgB,KAAK,QAAQ,CACpC;EACA,IAAI,gBAAgB;GAClB,IAAI,SACF,QAAQ,YAAY,KAAK,gBAAgB,KAAK,QAAQ;GAExD,OAAO;EACT;EAEA,IAAI,SACF,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,mBAAmB,MAAM,KAAK,QAAQ,KAAyB,EACnE,QAAQ,KAAK,wBAAwB,KAAK,QAAQ,EACpD,CAAC;EACD,MAAM,4BAA4B,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAAC,QAC/D,GAAG,oBAAoB,CAAC,UAAU,eAAe,SAAS,CAC7D;EACA,MAAM,cAAc,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAChD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;EAGvC,IAAI,0BAA0B,WAAW,GAAG;GAC1C,MAAM,CAAC,GAAG,mBAAmB;GAC7B,OAAO,eAAe;EACxB;EAEA,IAAI,0BAA0B,SAAS,GACrC,MAAM,IAAI,MACR,2FACF;EAGF,MAAM,IAAI,MAAM,wBAAwB;CAC1C;CAEA,MAAc,qBACZ,OACwD;EACxD,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sBAAsB;EAGxC,MAAM,MAAM,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK;EACjE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IAAwB,GAAG;EACrE,IAAI,CAAC,gBACH;EAGF,IAAI,UAAU,eAAe,SAAS,GAAG;GACvC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,MAAM,IAAI,MAAM,uBAAuB;EACzC;EAEA,OAAO;GAAE;GAAK,UAAU,eAAe;EAAS;CAClD;CAEA,MAAM,yBACJ,OACA,UACY;EACZ,OAAO,yBAAyB,IAAI,EAAE,MAAM,GAAG,QAAQ;CACzD;CAEA,MAAM,qBAAoC;EACxC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS,WAAW;GACtB,MAAM,KAAK,QAAQ,OAAO,QAAQ,SAAS;GAC3C;EACF;EAEA,IAAI,SAAS;GACX,MAAM,SAAS,gBAAgB,QAAQ,KAAK;GAC5C,IAAI,QAAQ;IACV,MAAM,KAAK,QAAQ,OACjB,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK,CACvD;IACA;GACF;EACF;EAEA,MAAM,OAAO,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACtD,IAAI,KAAK,SAAS,GAChB,MAAM,KAAK,QAAQ,OAAO,IAAI;CAElC;AACF"}
+{"version":3,"file":"do-oauth-client-provider.js","names":[],"sources":["../../../src/mcp/client/do-oauth-client-provider.ts"],"sourcesContent":["import type {\n  OAuthClientInformationContext,\n  OAuthClientMetadata,\n  OAuthClientProvider,\n  OAuthDiscoveryState,\n  StoredOAuthClientInformation,\n  StoredOAuthTokens\n} from \"@modelcontextprotocol/client\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { nanoid } from \"nanoid\";\n\nconst STATE_EXPIRATION_MS = 10 * 60 * 1000; // 10 minutes\n\nconst codeVerifierStateStorage = new AsyncLocalStorage<{\n  state: string;\n  servedKey?: string;\n}>();\n\ninterface StoredState {\n  nonce: string;\n  serverId: string;\n  createdAt: number;\n}\n\ninterface StoredCodeVerifier {\n  verifier: string;\n  createdAt: number;\n}\n\n// A slight extension to the standard OAuthClientProvider interface because `redirectToAuthorization` doesn't give us the interface we need\n// This allows us to track authentication for a specific server and associated dynamic client registration\nexport interface AgentMcpOAuthProvider extends OAuthClientProvider {\n  authUrl: string | undefined;\n  clientId: string | undefined;\n  serverId: string | undefined;\n  checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }>;\n  consumeState(state: string): Promise<void>;\n  runWithCodeVerifierState?<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T>;\n  deleteCodeVerifier(): Promise<void>;\n}\n\nfunction parseOAuthState(\n  state: string\n): { nonce: string; serverId: string } | undefined {\n  const parts = state.split(\".\");\n  if (parts.length !== 2) {\n    return undefined;\n  }\n\n  const [nonce, serverId] = parts;\n  if (!nonce || !serverId) {\n    return undefined;\n  }\n\n  return { nonce, serverId };\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary)\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/, \"\");\n}\n\nasync function createCodeChallenge(verifier: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\n    \"SHA-256\",\n    new TextEncoder().encode(verifier)\n  );\n  return base64UrlEncode(new Uint8Array(digest));\n}\n\nfunction isExpired(createdAt: number): boolean {\n  return Date.now() - createdAt > STATE_EXPIRATION_MS;\n}\n\n/**\n * @deprecated Use {@link AgentMcpOAuthProvider} instead.\n */\nexport type AgentsOAuthProvider = AgentMcpOAuthProvider;\n\nexport class DurableObjectOAuthClientProvider implements AgentMcpOAuthProvider {\n  private _authUrl_: string | undefined;\n  private _serverId_: string | undefined;\n  private _clientId_: string | undefined;\n\n  constructor(\n    public storage: DurableObjectStorage,\n    public clientName: string,\n    public baseRedirectUrl: string\n  ) {\n    if (!storage) {\n      throw new Error(\n        \"DurableObjectOAuthClientProvider requires a valid DurableObjectStorage instance\"\n      );\n    }\n  }\n\n  get clientMetadata(): OAuthClientMetadata {\n    return {\n      client_name: this.clientName,\n      client_uri: this.clientUri,\n      grant_types: [\"authorization_code\", \"refresh_token\"],\n      redirect_uris: [this.redirectUrl],\n      response_types: [\"code\"],\n      token_endpoint_auth_method: \"none\"\n    };\n  }\n\n  get clientUri() {\n    return new URL(this.redirectUrl).origin;\n  }\n\n  get redirectUrl() {\n    return this.baseRedirectUrl;\n  }\n\n  get clientId() {\n    if (!this._clientId_) {\n      throw new Error(\"Trying to access clientId before it was set\");\n    }\n    return this._clientId_;\n  }\n\n  set clientId(clientId_: string) {\n    this._clientId_ = clientId_;\n  }\n\n  get serverId() {\n    if (!this._serverId_) {\n      throw new Error(\"Trying to access serverId before it was set\");\n    }\n    return this._serverId_;\n  }\n\n  set serverId(serverId_: string) {\n    this._serverId_ = serverId_;\n  }\n\n  keyPrefix(clientId: string) {\n    return `/${this.clientName}/${this.serverId}/${clientId}`;\n  }\n\n  clientInfoKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/client_info/`;\n  }\n\n  discoveryStateKey() {\n    return `/${this.clientName}/${this.serverId}/oauth_discovery`;\n  }\n\n  async saveDiscoveryState(state: OAuthDiscoveryState): Promise<void> {\n    await this.storage.put(this.discoveryStateKey(), state);\n  }\n\n  async discoveryState(): Promise<OAuthDiscoveryState | undefined> {\n    return (\n      (await this.storage.get<OAuthDiscoveryState>(this.discoveryStateKey())) ??\n      undefined\n    );\n  }\n\n  async clientInformation(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthClientInformation | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthClientInformation>(\n        this.clientInfoKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveClientInformation(\n    clientInformation: StoredOAuthClientInformation,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    this.clientId = clientInformation.client_id;\n    // Round-trip the SDK's issuer stamp verbatim. The SDK treats a credential\n    // stamped for another issuer as absent, so one durable slot per MCP server\n    // is both sufficient and safer than maintaining our own issuer index.\n    await this.storage.put(\n      this.clientInfoKey(clientInformation.client_id),\n      clientInformation\n    );\n  }\n\n  tokenKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/token`;\n  }\n\n  async tokens(\n    _context?: OAuthClientInformationContext\n  ): Promise<StoredOAuthTokens | undefined> {\n    if (!this._clientId_) return undefined;\n    return (\n      (await this.storage.get<StoredOAuthTokens>(\n        this.tokenKey(this.clientId)\n      )) ?? undefined\n    );\n  }\n\n  async saveTokens(\n    tokens: StoredOAuthTokens,\n    _context?: OAuthClientInformationContext\n  ): Promise<void> {\n    // Keep the SDK-owned issuer stamp intact for SEP-2352 validation. Discovery\n    // is needed across the browser redirect, but once token issuance succeeds\n    // it must not pin later re-authorization to this AS: a subsequent 401 must\n    // re-read PRM so an authorization-server migration can be observed.\n    await this.storage.put(this.tokenKey(this.clientId), tokens);\n    await this.storage.delete(this.discoveryStateKey());\n  }\n\n  get authUrl() {\n    return this._authUrl_;\n  }\n\n  stateKey(nonce: string) {\n    return `/${this.clientName}/${this.serverId}/state/${nonce}`;\n  }\n\n  async state(): Promise<string> {\n    const nonce = nanoid();\n    const state = `${nonce}.${this.serverId}`;\n    const storedState: StoredState = {\n      nonce,\n      serverId: this.serverId,\n      createdAt: Date.now()\n    };\n    await this.storage.put(this.stateKey(nonce), storedState);\n    return state;\n  }\n\n  async checkState(\n    state: string\n  ): Promise<{ valid: boolean; serverId?: string; error?: string }> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      return { valid: false, error: \"Invalid state format\" };\n    }\n\n    const { nonce, serverId } = parsed;\n    const key = this.stateKey(nonce);\n    const storedState = await this.storage.get<StoredState>(key);\n\n    if (!storedState) {\n      return { valid: false, error: \"State not found or already used\" };\n    }\n\n    if (storedState.serverId !== serverId) {\n      await this.storage.delete(key);\n      return { valid: false, error: \"State serverId mismatch\" };\n    }\n\n    if (isExpired(storedState.createdAt)) {\n      const deleteKeys = [key];\n      if (this._clientId_) {\n        deleteKeys.push(this.stateCodeVerifierKey(this.clientId, nonce));\n      }\n      await this.storage.delete(deleteKeys);\n      return { valid: false, error: \"State expired\" };\n    }\n\n    return { valid: true, serverId };\n  }\n\n  async consumeState(state: string): Promise<void> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      // This should never happen since checkState validates format first.\n      // Log for debugging but don't throw - state consumption is best-effort.\n      console.warn(`[OAuth] consumeState called with invalid state format`);\n      return;\n    }\n    await this.storage.delete(this.stateKey(parsed.nonce));\n  }\n\n  async redirectToAuthorization(authUrl: URL): Promise<void> {\n    this._authUrl_ = authUrl.toString();\n\n    const clientId = this._clientId_;\n    const serverId = this._serverId_;\n    if (!clientId || !serverId) {\n      return;\n    }\n\n    const state = authUrl.searchParams.get(\"state\");\n    const codeChallenge = authUrl.searchParams.get(\"code_challenge\");\n    if (!state || !codeChallenge) {\n      return;\n    }\n\n    const parsed = parseOAuthState(state);\n    if (!parsed || parsed.serverId !== serverId) {\n      return;\n    }\n\n    const challengeKey = this.challengeCodeVerifierKey(clientId, codeChallenge);\n    const pendingVerifier =\n      await this.storage.get<StoredCodeVerifier>(challengeKey);\n    if (!pendingVerifier) {\n      return;\n    }\n\n    if (isExpired(pendingVerifier.createdAt)) {\n      await this.storage.delete(challengeKey);\n      return;\n    }\n\n    await this.storage.put(\n      this.stateCodeVerifierKey(clientId, parsed.nonce),\n      pendingVerifier\n    );\n    await this.storage.delete(challengeKey);\n  }\n\n  async invalidateCredentials(\n    scope: \"all\" | \"client\" | \"tokens\" | \"verifier\" | \"discovery\"\n  ): Promise<void> {\n    const deleteKeys: string[] = [];\n\n    if (scope === \"all\" || scope === \"discovery\") {\n      deleteKeys.push(this.discoveryStateKey());\n    }\n\n    if (this._clientId_) {\n      const clientId = this.clientId;\n      if (scope === \"all\" || scope === \"client\") {\n        deleteKeys.push(this.clientInfoKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"tokens\") {\n        deleteKeys.push(this.tokenKey(clientId));\n      }\n      if (scope === \"all\" || scope === \"verifier\") {\n        deleteKeys.push(\n          ...(await this.codeVerifierKeys(clientId, {\n            includeChallengeKeys: true\n          }))\n        );\n      }\n    }\n\n    if (deleteKeys.length > 0) {\n      await this.storage.delete([...new Set(deleteKeys)]);\n    }\n  }\n\n  /**\n   * Delete every key this provider stores for its server: tokens and client\n   * info for any client ID, verifiers, pending states and discovery state.\n   * Used when the server is removed. Other servers' keys are untouched.\n   */\n  async clearServerStorage(): Promise<void> {\n    const keys = [\n      ...(\n        await this.storage.list({\n          prefix: `/${this.clientName}/${this.serverId}/`\n        })\n      ).keys()\n    ];\n    // DO storage caps a multi-key delete at 128 keys.\n    for (let i = 0; i < keys.length; i += 128) {\n      await this.storage.delete(keys.slice(i, i + 128));\n    }\n  }\n\n  codeVerifierKey(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier`;\n  }\n\n  stateCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier/`;\n  }\n\n  stateCodeVerifierKey(clientId: string, nonce: string) {\n    return `${this.stateCodeVerifierPrefix(clientId)}${nonce}`;\n  }\n\n  challengeCodeVerifierPrefix(clientId: string) {\n    return `${this.keyPrefix(clientId)}/code_verifier_challenge/`;\n  }\n\n  challengeCodeVerifierKey(clientId: string, codeChallenge: string) {\n    return `${this.challengeCodeVerifierPrefix(clientId)}${codeChallenge}`;\n  }\n\n  async codeVerifierKeys(\n    clientId: string,\n    options: { includeChallengeKeys?: boolean } = {}\n  ): Promise<string[]> {\n    const legacyKey = this.codeVerifierKey(clientId);\n    const keys: string[] = [];\n\n    if (await this.storage.get(legacyKey)) {\n      keys.push(legacyKey);\n    }\n\n    const stateKeys = await this.storage.list({\n      prefix: this.stateCodeVerifierPrefix(clientId)\n    });\n    keys.push(...stateKeys.keys());\n\n    if (options.includeChallengeKeys) {\n      const challengeKeys = await this.storage.list({\n        prefix: this.challengeCodeVerifierPrefix(clientId)\n      });\n      keys.push(...challengeKeys.keys());\n    }\n\n    return keys;\n  }\n\n  async saveCodeVerifier(verifier: string): Promise<void> {\n    await this.deleteExpiredChallengeCodeVerifiers(this.clientId);\n\n    const codeChallenge = await createCodeChallenge(verifier);\n    const storedVerifier: StoredCodeVerifier = {\n      verifier,\n      createdAt: Date.now()\n    };\n\n    await this.storage.put(\n      this.challengeCodeVerifierKey(this.clientId, codeChallenge),\n      storedVerifier\n    );\n  }\n\n  private async deleteExpiredChallengeCodeVerifiers(\n    clientId: string\n  ): Promise<void> {\n    const challengeVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.challengeCodeVerifierPrefix(clientId)\n    });\n    const expiredKeys = [...challengeVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n  }\n\n  async codeVerifier(): Promise<string> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context) {\n      const stateVerifier = await this.codeVerifierForState(context.state);\n      if (stateVerifier) {\n        context.servedKey = stateVerifier.key;\n        return stateVerifier.verifier;\n      }\n    }\n\n    const legacyVerifier = await this.storage.get<string>(\n      this.codeVerifierKey(this.clientId)\n    );\n    if (legacyVerifier) {\n      if (context) {\n        context.servedKey = this.codeVerifierKey(this.clientId);\n      }\n      return legacyVerifier;\n    }\n\n    if (context) {\n      throw new Error(\"No code verifier found for OAuth state\");\n    }\n\n    const pendingVerifiers = await this.storage.list<StoredCodeVerifier>({\n      prefix: this.stateCodeVerifierPrefix(this.clientId)\n    });\n    const unexpiredPendingVerifiers = [...pendingVerifiers.entries()].filter(\n      ([, storedVerifier]) => !isExpired(storedVerifier.createdAt)\n    );\n    const expiredKeys = [...pendingVerifiers.entries()]\n      .filter(([, storedVerifier]) => isExpired(storedVerifier.createdAt))\n      .map(([key]) => key);\n    if (expiredKeys.length > 0) {\n      await this.storage.delete(expiredKeys);\n    }\n\n    if (unexpiredPendingVerifiers.length === 1) {\n      const [[, storedVerifier]] = unexpiredPendingVerifiers;\n      return storedVerifier.verifier;\n    }\n\n    if (unexpiredPendingVerifiers.length > 1) {\n      throw new Error(\n        \"Multiple OAuth code verifiers are pending; complete authorization with the callback state\"\n      );\n    }\n\n    throw new Error(\"No code verifier found\");\n  }\n\n  private async codeVerifierForState(\n    state: string\n  ): Promise<{ key: string; verifier: string } | undefined> {\n    const parsed = parseOAuthState(state);\n    if (!parsed) {\n      throw new Error(\"Invalid state format\");\n    }\n\n    const key = this.stateCodeVerifierKey(this.clientId, parsed.nonce);\n    const storedVerifier = await this.storage.get<StoredCodeVerifier>(key);\n    if (!storedVerifier) {\n      return undefined;\n    }\n\n    if (isExpired(storedVerifier.createdAt)) {\n      await this.storage.delete(key);\n      throw new Error(\"Code verifier expired\");\n    }\n\n    return { key, verifier: storedVerifier.verifier };\n  }\n\n  async runWithCodeVerifierState<T>(\n    state: string,\n    callback: () => Promise<T>\n  ): Promise<T> {\n    return codeVerifierStateStorage.run({ state }, callback);\n  }\n\n  async deleteCodeVerifier(): Promise<void> {\n    const context = codeVerifierStateStorage.getStore();\n    if (context?.servedKey) {\n      await this.storage.delete(context.servedKey);\n      return;\n    }\n\n    if (context) {\n      const parsed = parseOAuthState(context.state);\n      if (parsed) {\n        await this.storage.delete(\n          this.stateCodeVerifierKey(this.clientId, parsed.nonce)\n        );\n        return;\n      }\n    }\n\n    const keys = await this.codeVerifierKeys(this.clientId);\n    if (keys.length > 0) {\n      await this.storage.delete(keys);\n    }\n  }\n}\n"],"mappings":";;;AAWA,MAAM,sBAAsB,MAAU;AAEtC,MAAM,2BAA2B,IAAI,kBAGlC;AA8BH,SAAS,gBACP,OACiD;CACjD,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,GACnB;CAGF,MAAM,CAAC,OAAO,YAAY;CAC1B,IAAI,CAAC,SAAS,CAAC,UACb;CAGF,OAAO;EAAE;EAAO;CAAS;AAC3B;AAEA,SAAS,gBAAgB,OAA2B;CAClD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OACjB,UAAU,OAAO,aAAa,IAAI;CAEpC,OAAO,KAAK,MAAM,CAAC,CAChB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAe,oBAAoB,UAAmC;CACpE,MAAM,SAAS,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CACnC;CACA,OAAO,gBAAgB,IAAI,WAAW,MAAM,CAAC;AAC/C;AAEA,SAAS,UAAU,WAA4B;CAC7C,OAAO,KAAK,IAAI,IAAI,YAAY;AAClC;AAOA,IAAa,mCAAb,MAA+E;CAK7E,YACE,SACA,YACA,iBACA;EAHO,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,kBAAA;EAEP,IAAI,CAAC,SACH,MAAM,IAAI,MACR,iFACF;CAEJ;CAEA,IAAI,iBAAsC;EACxC,OAAO;GACL,aAAa,KAAK;GAClB,YAAY,KAAK;GACjB,aAAa,CAAC,sBAAsB,eAAe;GACnD,eAAe,CAAC,KAAK,WAAW;GAChC,gBAAgB,CAAC,MAAM;GACvB,4BAA4B;EAC9B;CACF;CAEA,IAAI,YAAY;EACd,OAAO,IAAI,IAAI,KAAK,WAAW,CAAC,CAAC;CACnC;CAEA,IAAI,cAAc;EAChB,OAAO,KAAK;CACd;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,IAAI,WAAW;EACb,IAAI,CAAC,KAAK,YACR,MAAM,IAAI,MAAM,6CAA6C;EAE/D,OAAO,KAAK;CACd;CAEA,IAAI,SAAS,WAAmB;EAC9B,KAAK,aAAa;CACpB;CAEA,UAAU,UAAkB;EAC1B,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,GAAG;CACjD;CAEA,cAAc,UAAkB;EAC9B,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,oBAAoB;EAClB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS;CAC9C;CAEA,MAAM,mBAAmB,OAA2C;EAClE,MAAM,KAAK,QAAQ,IAAI,KAAK,kBAAkB,GAAG,KAAK;CACxD;CAEA,MAAM,iBAA2D;EAC/D,OACG,MAAM,KAAK,QAAQ,IAAyB,KAAK,kBAAkB,CAAC,KACrE,KAAA;CAEJ;CAEA,MAAM,kBACJ,UACmD;EACnD,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,cAAc,KAAK,QAAQ,CAClC,KAAM,KAAA;CAEV;CAEA,MAAM,sBACJ,mBACA,UACe;EACf,KAAK,WAAW,kBAAkB;EAIlC,MAAM,KAAK,QAAQ,IACjB,KAAK,cAAc,kBAAkB,SAAS,GAC9C,iBACF;CACF;CAEA,SAAS,UAAkB;EACzB,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,MAAM,OACJ,UACwC;EACxC,IAAI,CAAC,KAAK,YAAY,OAAO,KAAA;EAC7B,OACG,MAAM,KAAK,QAAQ,IAClB,KAAK,SAAS,KAAK,QAAQ,CAC7B,KAAM,KAAA;CAEV;CAEA,MAAM,WACJ,QACA,UACe;EAKf,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,QAAQ,GAAG,MAAM;EAC3D,MAAM,KAAK,QAAQ,OAAO,KAAK,kBAAkB,CAAC;CACpD;CAEA,IAAI,UAAU;EACZ,OAAO,KAAK;CACd;CAEA,SAAS,OAAe;EACtB,OAAO,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,SAAS;CACvD;CAEA,MAAM,QAAyB;EAC7B,MAAM,QAAQ,OAAO;EACrB,MAAM,QAAQ,GAAG,MAAM,GAAG,KAAK;EAC/B,MAAM,cAA2B;GAC/B;GACA,UAAU,KAAK;GACf,WAAW,KAAK,IAAI;EACtB;EACA,MAAM,KAAK,QAAQ,IAAI,KAAK,SAAS,KAAK,GAAG,WAAW;EACxD,OAAO;CACT;CAEA,MAAM,WACJ,OACgE;EAChE,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAuB;EAGvD,MAAM,EAAE,OAAO,aAAa;EAC5B,MAAM,MAAM,KAAK,SAAS,KAAK;EAC/B,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAiB,GAAG;EAE3D,IAAI,CAAC,aACH,OAAO;GAAE,OAAO;GAAO,OAAO;EAAkC;EAGlE,IAAI,YAAY,aAAa,UAAU;GACrC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,OAAO;IAAE,OAAO;IAAO,OAAO;GAA0B;EAC1D;EAEA,IAAI,UAAU,YAAY,SAAS,GAAG;GACpC,MAAM,aAAa,CAAC,GAAG;GACvB,IAAI,KAAK,YACP,WAAW,KAAK,KAAK,qBAAqB,KAAK,UAAU,KAAK,CAAC;GAEjE,MAAM,KAAK,QAAQ,OAAO,UAAU;GACpC,OAAO;IAAE,OAAO;IAAO,OAAO;GAAgB;EAChD;EAEA,OAAO;GAAE,OAAO;GAAM;EAAS;CACjC;CAEA,MAAM,aAAa,OAA8B;EAC/C,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QAAQ;GAGX,QAAQ,KAAK,uDAAuD;GACpE;EACF;EACA,MAAM,KAAK,QAAQ,OAAO,KAAK,SAAS,OAAO,KAAK,CAAC;CACvD;CAEA,MAAM,wBAAwB,SAA6B;EACzD,KAAK,YAAY,QAAQ,SAAS;EAElC,MAAM,WAAW,KAAK;EACtB,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,YAAY,CAAC,UAChB;EAGF,MAAM,QAAQ,QAAQ,aAAa,IAAI,OAAO;EAC9C,MAAM,gBAAgB,QAAQ,aAAa,IAAI,gBAAgB;EAC/D,IAAI,CAAC,SAAS,CAAC,eACb;EAGF,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,UAAU,OAAO,aAAa,UACjC;EAGF,MAAM,eAAe,KAAK,yBAAyB,UAAU,aAAa;EAC1E,MAAM,kBACJ,MAAM,KAAK,QAAQ,IAAwB,YAAY;EACzD,IAAI,CAAC,iBACH;EAGF,IAAI,UAAU,gBAAgB,SAAS,GAAG;GACxC,MAAM,KAAK,QAAQ,OAAO,YAAY;GACtC;EACF;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,qBAAqB,UAAU,OAAO,KAAK,GAChD,eACF;EACA,MAAM,KAAK,QAAQ,OAAO,YAAY;CACxC;CAEA,MAAM,sBACJ,OACe;EACf,MAAM,aAAuB,CAAC;EAE9B,IAAI,UAAU,SAAS,UAAU,aAC/B,WAAW,KAAK,KAAK,kBAAkB,CAAC;EAG1C,IAAI,KAAK,YAAY;GACnB,MAAM,WAAW,KAAK;GACtB,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,cAAc,QAAQ,CAAC;GAE9C,IAAI,UAAU,SAAS,UAAU,UAC/B,WAAW,KAAK,KAAK,SAAS,QAAQ,CAAC;GAEzC,IAAI,UAAU,SAAS,UAAU,YAC/B,WAAW,KACT,GAAI,MAAM,KAAK,iBAAiB,UAAU,EACxC,sBAAsB,KACxB,CAAC,CACH;EAEJ;EAEA,IAAI,WAAW,SAAS,GACtB,MAAM,KAAK,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,CAAC;CAEtD;;;;;;CAOA,MAAM,qBAAoC;EACxC,MAAM,OAAO,CACX,IACE,MAAM,KAAK,QAAQ,KAAK,EACtB,QAAQ,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,GAC/C,CAAC,EAAA,CACD,KAAK,CACT;EAEA,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,KACpC,MAAM,KAAK,QAAQ,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC;CAEpD;CAEA,gBAAgB,UAAkB;EAChC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,wBAAwB,UAAkB;EACxC,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,qBAAqB,UAAkB,OAAe;EACpD,OAAO,GAAG,KAAK,wBAAwB,QAAQ,IAAI;CACrD;CAEA,4BAA4B,UAAkB;EAC5C,OAAO,GAAG,KAAK,UAAU,QAAQ,EAAE;CACrC;CAEA,yBAAyB,UAAkB,eAAuB;EAChE,OAAO,GAAG,KAAK,4BAA4B,QAAQ,IAAI;CACzD;CAEA,MAAM,iBACJ,UACA,UAA8C,CAAC,GAC5B;EACnB,MAAM,YAAY,KAAK,gBAAgB,QAAQ;EAC/C,MAAM,OAAiB,CAAC;EAExB,IAAI,MAAM,KAAK,QAAQ,IAAI,SAAS,GAClC,KAAK,KAAK,SAAS;EAGrB,MAAM,YAAY,MAAM,KAAK,QAAQ,KAAK,EACxC,QAAQ,KAAK,wBAAwB,QAAQ,EAC/C,CAAC;EACD,KAAK,KAAK,GAAG,UAAU,KAAK,CAAC;EAE7B,IAAI,QAAQ,sBAAsB;GAChC,MAAM,gBAAgB,MAAM,KAAK,QAAQ,KAAK,EAC5C,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC;GACD,KAAK,KAAK,GAAG,cAAc,KAAK,CAAC;EACnC;EAEA,OAAO;CACT;CAEA,MAAM,iBAAiB,UAAiC;EACtD,MAAM,KAAK,oCAAoC,KAAK,QAAQ;EAE5D,MAAM,gBAAgB,MAAM,oBAAoB,QAAQ;EACxD,MAAM,iBAAqC;GACzC;GACA,WAAW,KAAK,IAAI;EACtB;EAEA,MAAM,KAAK,QAAQ,IACjB,KAAK,yBAAyB,KAAK,UAAU,aAAa,GAC1D,cACF;CACF;CAEA,MAAc,oCACZ,UACe;EAIf,MAAM,cAAc,CAAC,IAAG,MAHS,KAAK,QAAQ,KAAyB,EACrE,QAAQ,KAAK,4BAA4B,QAAQ,EACnD,CAAC,EAAA,CAC0C,QAAQ,CAAC,CAAC,CAClD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;CAEzC;CAEA,MAAM,eAAgC;EACpC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS;GACX,MAAM,gBAAgB,MAAM,KAAK,qBAAqB,QAAQ,KAAK;GACnE,IAAI,eAAe;IACjB,QAAQ,YAAY,cAAc;IAClC,OAAO,cAAc;GACvB;EACF;EAEA,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IACxC,KAAK,gBAAgB,KAAK,QAAQ,CACpC;EACA,IAAI,gBAAgB;GAClB,IAAI,SACF,QAAQ,YAAY,KAAK,gBAAgB,KAAK,QAAQ;GAExD,OAAO;EACT;EAEA,IAAI,SACF,MAAM,IAAI,MAAM,wCAAwC;EAG1D,MAAM,mBAAmB,MAAM,KAAK,QAAQ,KAAyB,EACnE,QAAQ,KAAK,wBAAwB,KAAK,QAAQ,EACpD,CAAC;EACD,MAAM,4BAA4B,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAAC,QAC/D,GAAG,oBAAoB,CAAC,UAAU,eAAe,SAAS,CAC7D;EACA,MAAM,cAAc,CAAC,GAAG,iBAAiB,QAAQ,CAAC,CAAC,CAChD,QAAQ,GAAG,oBAAoB,UAAU,eAAe,SAAS,CAAC,CAAC,CACnE,KAAK,CAAC,SAAS,GAAG;EACrB,IAAI,YAAY,SAAS,GACvB,MAAM,KAAK,QAAQ,OAAO,WAAW;EAGvC,IAAI,0BAA0B,WAAW,GAAG;GAC1C,MAAM,CAAC,GAAG,mBAAmB;GAC7B,OAAO,eAAe;EACxB;EAEA,IAAI,0BAA0B,SAAS,GACrC,MAAM,IAAI,MACR,2FACF;EAGF,MAAM,IAAI,MAAM,wBAAwB;CAC1C;CAEA,MAAc,qBACZ,OACwD;EACxD,MAAM,SAAS,gBAAgB,KAAK;EACpC,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,sBAAsB;EAGxC,MAAM,MAAM,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK;EACjE,MAAM,iBAAiB,MAAM,KAAK,QAAQ,IAAwB,GAAG;EACrE,IAAI,CAAC,gBACH;EAGF,IAAI,UAAU,eAAe,SAAS,GAAG;GACvC,MAAM,KAAK,QAAQ,OAAO,GAAG;GAC7B,MAAM,IAAI,MAAM,uBAAuB;EACzC;EAEA,OAAO;GAAE;GAAK,UAAU,eAAe;EAAS;CAClD;CAEA,MAAM,yBACJ,OACA,UACY;EACZ,OAAO,yBAAyB,IAAI,EAAE,MAAM,GAAG,QAAQ;CACzD;CAEA,MAAM,qBAAoC;EACxC,MAAM,UAAU,yBAAyB,SAAS;EAClD,IAAI,SAAS,WAAW;GACtB,MAAM,KAAK,QAAQ,OAAO,QAAQ,SAAS;GAC3C;EACF;EAEA,IAAI,SAAS;GACX,MAAM,SAAS,gBAAgB,QAAQ,KAAK;GAC5C,IAAI,QAAQ;IACV,MAAM,KAAK,QAAQ,OACjB,KAAK,qBAAqB,KAAK,UAAU,OAAO,KAAK,CACvD;IACA;GACF;EACF;EAEA,MAAM,OAAO,MAAM,KAAK,iBAAiB,KAAK,QAAQ;EACtD,IAAI,KAAK,SAAS,GAChB,MAAM,KAAK,QAAQ,OAAO,IAAI;CAElC;AACF"}

package/dist/mcp/client/index.d.ts

@@ -18,7 +18,7 @@ import {
   jt as ElicitResult,
   qt as getNamespacedData,
   zt as MCPClientOAuthResult
-} from "../../agent-routing-0DR0Tk2v.js";
+} from "../../agent-routing-Bhdbvf7s.js";
 export {
   type ElicitRequest,
   type ElicitResult,

package/dist/mcp/client/index.js

@@ -1,2 +1,2 @@
-import { i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, r as getNamespacedData, t as MCPClientManager } from "../../client-fyQrLGkD.js";
+import { i as normalizeServerId, n as MCP_SERVER_ID_MAX_LENGTH, r as getNamespacedData, t as MCPClientManager } from "../../client-1tEQ1Oqz.js";
 export { MCPClientManager, MCP_SERVER_ID_MAX_LENGTH, getNamespacedData, normalizeServerId };

package/dist/mcp/client/x402.d.ts

@@ -2,7 +2,7 @@ import {
   n as LegacyCallToolResultSchema,
   t as CompatibleMcpClient
 } from "../../invoker-CG0_p_Wq.js";
-import { ZodRawShape } from "zod";
+import { ZodRawShape, z } from "zod";
 import {
   CallToolRequest,
   CallToolRequestOptions
@@ -12,8 +12,14 @@ import {
   ToolAnnotations
 } from "@modelcontextprotocol/sdk/types.js";
 import {
+  CallToolResult as CallToolResult$1,
   McpServer,
   RegisteredTool,
+  ServerContext
+} from "@modelcontextprotocol/server";
+import {
+  McpServer as McpServer$1,
+  RegisteredTool as RegisteredTool$1,
   ToolCallback
 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import {
@@ -48,19 +54,43 @@ type X402Config = {
   facilitator?: FacilitatorConfig$1 /** @deprecated No longer used in v2. The protocol version is determined automatically. */;
   version?: number;
 };
-interface X402AugmentedServer {
+/**
+ * The tool body passed to `paidTool`. On an SDK v1 server it is the v1
+ * `ToolCallback`; on an SDK v2 server it receives the v2 `ServerContext`.
+ */
+type PaidToolCallback<
+  Args extends ZodRawShape,
+  Server extends McpServer$1 | McpServer = McpServer$1
+> = Server extends McpServer
+  ? (
+      args: z.infer<z.ZodObject<Args>>,
+      ctx: ServerContext
+    ) => CallToolResult$1 | Promise<CallToolResult$1>
+  : ToolCallback<Args>;
+interface X402AugmentedServer<
+  Server extends McpServer$1 | McpServer = McpServer$1
+> {
   paidTool<Args extends ZodRawShape>(
     name: string,
     description: string,
     priceUSD: number,
     paramsSchema: Args,
     annotations: ToolAnnotations,
-    cb: ToolCallback<Args>
-  ): RegisteredTool;
+    cb: PaidToolCallback<Args, Server>
+  ): Server extends McpServer ? RegisteredTool : RegisteredTool$1;
 }
+/**
+ * Add `paidTool` to an MCP server. Accepts an SDK v1 `McpServer`
+ * (`@modelcontextprotocol/sdk`) or an SDK v2 `McpServer`
+ * (`@modelcontextprotocol/server`).
+ */
 declare function withX402<T extends McpServer>(
   server: T,
   cfg: X402Config
+): T & X402AugmentedServer<McpServer>;
+declare function withX402<T extends McpServer$1>(
+  server: T,
+  cfg: X402Config
 ): T & X402AugmentedServer;
 interface X402AugmentedClient {
   callTool(
@@ -109,6 +139,7 @@ export {
   type ClientEvmSigner,
   type FacilitatorConfig,
   type Network,
+  PaidToolCallback,
   type PaymentRequired,
   type PaymentRequirements,
   X402AugmentedClient,

package/dist/mcp/client/x402.js

@@ -21,6 +21,27 @@ const LEGACY_NETWORK_MAP = {
 function normalizeNetwork(network) {
 	return LEGACY_NETWORK_MAP[network] ?? network;
 }
+function readHeader(headers, name) {
+	if (!headers) return void 0;
+	if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+	const wanted = name.toLowerCase();
+	for (const [key, value] of Object.entries(headers)) {
+		if (key.toLowerCase() !== wanted) continue;
+		const first = Array.isArray(value) ? value[0] : value;
+		if (typeof first === "string") return first;
+	}
+}
+/**
+* Read the x402 payment token from a tool handler context of either SDK
+* generation. Request `_meta` wins over headers, and header names match
+* case-insensitively. `PAYMENT-SIGNATURE` is x402 v2; `X-PAYMENT` is v1.
+*/
+function readPaymentToken(extra) {
+	const ctx = extra ?? {};
+	const meta = ctx.mcpReq?._meta ?? ctx._meta;
+	const headers = ctx.http?.req?.headers ?? ctx.requestInfo?.headers;
+	return meta?.["x402/payment"] ?? readHeader(headers, "PAYMENT-SIGNATURE") ?? readHeader(headers, "X-PAYMENT");
+}
 function withX402(server, cfg) {
 	const network = normalizeNetwork(cfg.network);
 	const resourceServer = new x402ResourceServer(new HTTPFacilitatorClient(cfg.facilitator ?? { url: "https://x402.org/facilitator" }));
@@ -33,7 +54,8 @@ function withX402(server, cfg) {
 		});
 		return initPromise;
 	}
-	function paidTool(name, description, priceUSD, paramsSchema, annotations, cb) {
+	function paidTool(name, description, priceUSD, paramsSchema, annotations, toolCb) {
+		const cb = toolCb;
 		return server.registerTool(name, {
 			description,
 			inputSchema: paramsSchema,
@@ -73,8 +95,7 @@ function withX402(server, cfg) {
 				description,
 				mimeType: "application/json"
 			};
-			const headers = extra?.requestInfo?.headers ?? {};
-			const token = extra?._meta?.["x402/payment"] ?? headers["PAYMENT-SIGNATURE"] ?? headers["X-PAYMENT"];
+			const token = readPaymentToken(extra);
 			const paymentRequired = (reason = "PAYMENT_REQUIRED", extraFields = {}) => {
 				const payload = {
 					x402Version: 2,

package/dist/mcp/client/x402.js.map

@@ -1 +1 @@
-{"version":3,"file":"x402.js","names":[],"sources":["../../../src/mcp/client/x402.ts"],"sourcesContent":["/**\n * X402 MCP Integration (v2)\n *\n * Based on:\n * - Coinbase's x402 (Apache 2.0): https://github.com/coinbase/x402\n * - @ethanniser and his work at https://github.com/ethanniser/x402-mcp\n */\n\nimport type {\n  McpServer,\n  RegisteredTool,\n  ToolCallback\n} from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  CallToolRequest,\n  CallToolRequestOptions,\n  Client as MCPClient\n} from \"@modelcontextprotocol/client\";\nimport type {\n  CallToolResult,\n  ToolAnnotations\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport {\n  bindMcpClient,\n  type CallToolSchemaOrOptions,\n  type CompatibleMcpClient,\n  type LegacyCallToolResultSchema\n} from \"./invoker\";\nimport type { ZodRawShape } from \"zod\";\n\n// v2 imports from @x402/core\nimport { x402ResourceServer, HTTPFacilitatorClient } from \"@x402/core/server\";\nimport type { FacilitatorConfig, ResourceConfig } from \"@x402/core/server\";\nimport { x402Client } from \"@x402/core/client\";\nimport type {\n  PaymentPayload,\n  PaymentRequirements,\n  PaymentRequired,\n  Network\n} from \"@x402/core/types\";\n\n// v2 imports from @x402/evm\nimport { registerExactEvmScheme as registerServerEvmScheme } from \"@x402/evm/exact/server\";\nimport { registerExactEvmScheme as registerClientEvmScheme } from \"@x402/evm/exact/client\";\nimport type { ClientEvmSigner } from \"@x402/evm\";\n\n// Re-export commonly used types for consumer convenience\nexport type {\n  PaymentRequirements,\n  PaymentRequired,\n  Network\n} from \"@x402/core/types\";\nexport type { FacilitatorConfig } from \"@x402/core/server\";\nexport type { ClientEvmSigner } from \"@x402/evm\";\n\n/**\n * Map of legacy v1 network names to CAIP-2 identifiers.\n * Allows backward compatibility with v1 config.\n */\nconst LEGACY_NETWORK_MAP: Record<string, string> = {\n  \"base-sepolia\": \"eip155:84532\",\n  base: \"eip155:8453\",\n  ethereum: \"eip155:1\",\n  sepolia: \"eip155:11155111\"\n};\n\n/**\n * Normalize a network identifier to CAIP-2 format.\n * Accepts both legacy v1 names (\"base-sepolia\") and CAIP-2 (\"eip155:84532\").\n */\nexport function normalizeNetwork(network: string): Network {\n  return (LEGACY_NETWORK_MAP[network] ?? network) as Network;\n}\n\n/*\n  ======= SERVER SIDE =======\n*/\n\nexport type X402Config = {\n  /**\n   * Network identifier.\n   * Accepts both legacy names (\"base-sepolia\") and CAIP-2 format (\"eip155:84532\").\n   */\n  network: string;\n  /** Payment recipient address */\n  recipient: `0x${string}`;\n  /** Facilitator configuration. Defaults to https://x402.org/facilitator */\n  facilitator?: FacilitatorConfig;\n  /** @deprecated No longer used in v2. The protocol version is determined automatically. */\n  version?: number;\n};\n\nexport interface X402AugmentedServer {\n  paidTool<Args extends ZodRawShape>(\n    name: string,\n    description: string,\n    priceUSD: number,\n    paramsSchema: Args,\n    annotations: ToolAnnotations,\n    cb: ToolCallback<Args>\n  ): RegisteredTool;\n}\n\nexport function withX402<T extends McpServer>(\n  server: T,\n  cfg: X402Config\n): T & X402AugmentedServer {\n  const network = normalizeNetwork(cfg.network);\n  const facilitatorConfig: FacilitatorConfig = cfg.facilitator ?? {\n    url: \"https://x402.org/facilitator\"\n  };\n\n  // Create v2 resource server with facilitator client\n  const facilitatorClient = new HTTPFacilitatorClient(facilitatorConfig);\n  const resourceServer = new x402ResourceServer(facilitatorClient);\n  registerServerEvmScheme(resourceServer);\n\n  // Lazy initialization: fetch supported kinds from facilitator on first use\n  let initPromise: Promise<void> | null = null;\n  function ensureInitialized(): Promise<void> {\n    if (!initPromise) {\n      initPromise = resourceServer.initialize().catch((err) => {\n        initPromise = null; // allow retry on failure\n        throw err;\n      });\n    }\n    return initPromise;\n  }\n\n  function paidTool<Args extends ZodRawShape>(\n    name: string,\n    description: string,\n    priceUSD: number,\n    paramsSchema: Args,\n    annotations: ToolAnnotations,\n    cb: ToolCallback<Args>\n  ): RegisteredTool {\n    return server.registerTool(\n      name,\n      {\n        description,\n        inputSchema: paramsSchema,\n        annotations,\n        _meta: {\n          \"agents-x402/paymentRequired\": true,\n          \"agents-x402/priceUSD\": priceUSD\n        }\n      },\n      (async (args, extra) => {\n        await ensureInitialized();\n\n        // Build v2 payment requirements for this tool call\n        const resourceConfig: ResourceConfig = {\n          scheme: \"exact\",\n          payTo: cfg.recipient,\n          price: priceUSD,\n          network,\n          maxTimeoutSeconds: 300\n        };\n\n        let requirements: PaymentRequirements[];\n        try {\n          requirements =\n            await resourceServer.buildPaymentRequirements(resourceConfig);\n        } catch {\n          const payload = { x402Version: 2, error: \"PRICE_COMPUTE_FAILED\" };\n          return {\n            isError: true,\n            _meta: { \"x402/error\": payload },\n            content: [{ type: \"text\", text: JSON.stringify(payload) }]\n          } as const;\n        }\n\n        const resourceInfo = {\n          url: `x402://${name}`,\n          description,\n          mimeType: \"application/json\"\n        };\n\n        // Get payment token from MCP _meta or HTTP headers\n        // Support both v2 (PAYMENT-SIGNATURE) and v1 (X-PAYMENT) header names\n        const headers = extra?.requestInfo?.headers ?? {};\n        const token =\n          (extra?._meta?.[\"x402/payment\"] as string | undefined) ??\n          headers[\"PAYMENT-SIGNATURE\"] ??\n          headers[\"X-PAYMENT\"];\n\n        const paymentRequired = (\n          reason = \"PAYMENT_REQUIRED\",\n          extraFields: Record<string, unknown> = {}\n        ) => {\n          const payload = {\n            x402Version: 2,\n            error: reason,\n            resource: resourceInfo,\n            accepts: requirements,\n            ...extraFields\n          };\n          return {\n            isError: true,\n            _meta: { \"x402/error\": payload },\n            content: [{ type: \"text\", text: JSON.stringify(payload) }]\n          } as const;\n        };\n\n        if (!token || typeof token !== \"string\") return paymentRequired();\n\n        // Decode the payment payload (base64-encoded JSON)\n        let paymentPayload: PaymentPayload;\n        try {\n          paymentPayload = JSON.parse(atob(token));\n        } catch {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Find matching requirements for this payment\n        const matchingReq = resourceServer.findMatchingRequirements(\n          requirements,\n          paymentPayload\n        );\n        if (!matchingReq) {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Verify payment with facilitator\n        try {\n          const vr = await resourceServer.verifyPayment(\n            paymentPayload,\n            matchingReq\n          );\n          if (!vr.isValid) {\n            return paymentRequired(vr.invalidReason ?? \"INVALID_PAYMENT\", {\n              payer: vr.payer\n            });\n          }\n        } catch {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Execute the tool callback\n        let result: CallToolResult;\n        let failed = false;\n        try {\n          result = await cb(args, extra);\n          if (\n            result &&\n            typeof result === \"object\" &&\n            \"isError\" in result &&\n            result.isError\n          ) {\n            failed = true;\n          }\n        } catch (e) {\n          failed = true;\n          result = {\n            isError: true,\n            content: [\n              { type: \"text\", text: `Tool execution failed: ${String(e)}` }\n            ]\n          };\n        }\n\n        // Settle payment only on success\n        if (!failed) {\n          try {\n            const s = await resourceServer.settlePayment(\n              paymentPayload,\n              matchingReq\n            );\n            if (s.success) {\n              result._meta ??= {};\n              result._meta[\"x402/payment-response\"] = {\n                success: true,\n                transaction: s.transaction,\n                network: s.network,\n                payer: s.payer\n              };\n            } else {\n              return paymentRequired(s.errorReason ?? \"SETTLEMENT_FAILED\");\n            }\n          } catch {\n            return paymentRequired(\"SETTLEMENT_FAILED\");\n          }\n        }\n\n        return result;\n      }) as ToolCallback<Args>\n    );\n  }\n\n  Object.defineProperty(server, \"paidTool\", {\n    value: paidTool,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n\n  // Tell TS the object now also has the paidTool method\n  return server as T & X402AugmentedServer;\n}\n\n/*\n  ======= CLIENT SIDE =======\n*/\n\nexport interface X402AugmentedClient {\n  callTool(\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    options?: CallToolRequestOptions\n  ): Promise<CallToolResult>;\n  /**\n   * @deprecated Prefer the request-options overload. Explicit legacy result\n   * schemas remain honored through the SDK v2 request funnel.\n   */\n  callTool(\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    resultSchema: LegacyCallToolResultSchema,\n    options?: CallToolRequestOptions\n  ): Promise<CallToolResult>;\n}\n\nexport type X402ClientConfig = {\n  /**\n   * EVM account/signer for signing payment authorizations.\n   * Use `privateKeyToAccount()` from viem/accounts to create one.\n   */\n  account: ClientEvmSigner;\n  /**\n   * Preferred network identifier (optional).\n   * Accepts both legacy names (\"base-sepolia\") and CAIP-2 format (\"eip155:84532\").\n   * When set, the client prefers payment requirements matching this network.\n   * If omitted, the client automatically selects from available requirements.\n   */\n  network?: string;\n  /** Maximum payment value in atomic units (default: 0.10 USDC = 100000) */\n  maxPaymentValue?: bigint;\n  /** @deprecated No longer used in v2. The protocol version is determined automatically. */\n  version?: number;\n  /** Confirmation callback for payment approval */\n  confirmationCallback?: (payment: PaymentRequirements[]) => Promise<boolean>;\n};\n\nclass PaymentCapError extends Error {}\n// Thrown when the selected requirement cannot be cap-checked; the caller\n// returns the server's original 402 result, as before the hook existed.\nclass PaymentPassthroughError extends Error {}\n\nexport function withX402Client<T extends CompatibleMcpClient>(\n  client: T,\n  x402Config: X402ClientConfig\n): X402AugmentedClient & T {\n  const invoker = bindMcpClient(client);\n  const { account } = x402Config;\n\n  const maxPaymentValue = x402Config.maxPaymentValue ?? BigInt(100_000); // 0.10 USDC\n\n  // Create v2 x402 payment client with EVM scheme support\n  const paymentClient = new x402Client();\n  registerClientEvmScheme(paymentClient, { signer: account });\n\n  // Payment requests whose selection reached the hook below. x402 selects a\n  // requirement before it runs any hook, so a request that failed without\n  // getting here offered nothing this client can sign.\n  const selected = new WeakSet<PaymentRequired>();\n\n  // Selection applies scheme support and network preference before this hook.\n  // Enforce the cap on the requirement that will actually be signed. We throw\n  // rather than return `{ abort: true }` because @x402/core rewraps an abort in\n  // a plain Error, which would lose the typed errors the catch below relies on.\n  paymentClient.onBeforePaymentCreation(\n    async ({ paymentRequired, selectedRequirements }) => {\n      selected.add(paymentRequired);\n      const { scheme, amount } = selectedRequirements;\n      if (scheme !== \"exact\") throw new PaymentPassthroughError();\n      let value: bigint;\n      try {\n        value = BigInt(amount);\n      } catch {\n        throw new PaymentPassthroughError(); // malformed amount\n      }\n      if (value < 0n) throw new PaymentPassthroughError();\n      if (value > maxPaymentValue) {\n        throw new PaymentCapError(\n          `Payment exceeds client cap: ${value} > ${maxPaymentValue}`\n        );\n      }\n    }\n  );\n\n  // If a preferred network is specified, register a policy to prefer it\n  if (x402Config.network) {\n    const preferredNetwork = normalizeNetwork(x402Config.network);\n    paymentClient.registerPolicy((_version, reqs) => {\n      const matching = reqs.filter((r) => r.network === preferredNetwork);\n      return matching.length > 0 ? matching : reqs;\n    });\n  }\n\n  const listTools = async (\n    params?: Parameters<MCPClient[\"listTools\"]>[0],\n    options?: Parameters<MCPClient[\"listTools\"]>[1]\n  ) => {\n    const toolsRes = await invoker.listTools(params, options);\n    return {\n      ...toolsRes,\n      tools: toolsRes.tools.map((tool) => {\n        let description = tool.description;\n        // Check _meta for payment information (agents-x402/ is our extension for pre-advertising prices)\n        if (tool._meta?.[\"agents-x402/paymentRequired\"]) {\n          const cost = tool._meta?.[\"agents-x402/priceUSD\"]\n            ? `$${tool._meta?.[\"agents-x402/priceUSD\"]}`\n            : \"an unknown amount\";\n          description += ` (This is a paid tool, you will be charged ${cost} for its execution)`;\n        }\n        return {\n          ...tool,\n          description\n        };\n      })\n    };\n  };\n\n  const callToolWithPayment = async (\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    schemaOrOptions?: CallToolSchemaOrOptions,\n    options?: CallToolRequestOptions\n  ): ReturnType<MCPClient[\"callTool\"]> => {\n    const invoke = (callParams: CallToolRequest[\"params\"]) =>\n      invoker.callTool(callParams, schemaOrOptions, options);\n    const res = await invoke(params);\n\n    // Check for x402 payment required error in response metadata\n    const maybeX402Error = res._meta?.[\"x402/error\"] as\n      | (PaymentRequired & Record<string, unknown>)\n      | undefined;\n\n    if (\n      res.isError &&\n      maybeX402Error &&\n      maybeX402Error.accepts &&\n      Array.isArray(maybeX402Error.accepts) &&\n      maybeX402Error.accepts.length > 0\n    ) {\n      // Snapshot the requirements: what is cap-checked and signed below is\n      // this copy, not the server's result object or anything aliasing it.\n      const accepts = structuredClone(\n        maybeX402Error.accepts\n      ) as PaymentRequirements[];\n      const confirmationCallback =\n        x402ConfirmationCallback ?? x402Config.confirmationCallback;\n\n      // Use the confirmation callback if provided. It receives deep copies\n      // so a retained reference cannot alter what is cap-checked and signed.\n      if (\n        confirmationCallback &&\n        !(await confirmationCallback(\n          accepts.map((req) => structuredClone(req))\n        ))\n      ) {\n        return {\n          isError: true,\n          content: [{ type: \"text\", text: \"User declined payment\" }]\n        };\n      }\n\n      // Reconstruct the PaymentRequired response for the v2 x402 client\n      const paymentRequiredResponse: PaymentRequired = {\n        x402Version: (maybeX402Error.x402Version as number) ?? 2,\n        resource: (maybeX402Error.resource as PaymentRequired[\"resource\"]) ?? {\n          url: \"\",\n          description: \"\",\n          mimeType: \"application/json\"\n        },\n        accepts,\n        extensions: maybeX402Error.extensions as\n          | Record<string, unknown>\n          | undefined\n      };\n\n      // Create the payment payload using the v2 x402 client\n      let paymentPayload: PaymentPayload;\n      try {\n        paymentPayload = await paymentClient.createPaymentPayload(\n          paymentRequiredResponse\n        );\n      } catch (error) {\n        // Nothing this client can sign, or a selection it cannot cap-check:\n        // return the server's 402 with its payment options, as before.\n        if (\n          error instanceof PaymentPassthroughError ||\n          !selected.has(paymentRequiredResponse)\n        ) {\n          return res;\n        }\n        return {\n          isError: true,\n          content: [\n            {\n              type: \"text\",\n              text:\n                error instanceof PaymentCapError\n                  ? error.message\n                  : \"Failed to create payment payload\"\n            }\n          ]\n        };\n      }\n\n      // Encode the payment payload as a base64 JSON token for MCP transport\n      const token = btoa(JSON.stringify(paymentPayload));\n\n      // Retry the tool call with the payment token\n      return invoke({\n        ...params,\n        _meta: {\n          ...params._meta,\n          \"x402/payment\": token\n        }\n      });\n    }\n\n    return res;\n  };\n\n  const _client = client as X402AugmentedClient & T;\n  Object.defineProperty(_client, \"listTools\", {\n    value: listTools,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n  Object.defineProperty(_client, \"callTool\", {\n    value: callToolWithPayment,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n\n  return _client;\n}\n"],"mappings":";;;;;;;;;;AA2DA,MAAM,qBAA6C;CACjD,gBAAgB;CAChB,MAAM;CACN,UAAU;CACV,SAAS;AACX;;;;;AAMA,SAAgB,iBAAiB,SAA0B;CACzD,OAAQ,mBAAmB,YAAY;AACzC;AA+BA,SAAgB,SACd,QACA,KACyB;CACzB,MAAM,UAAU,iBAAiB,IAAI,OAAO;CAO5C,MAAM,iBAAiB,IAAI,mBAAmB,IADhB,sBALe,IAAI,eAAe,EAC9D,KAAK,+BACP,CAI8D,CAAC;CAC/D,uBAAwB,cAAc;CAGtC,IAAI,cAAoC;CACxC,SAAS,oBAAmC;EAC1C,IAAI,CAAC,aACH,cAAc,eAAe,WAAW,CAAC,CAAC,OAAO,QAAQ;GACvD,cAAc;GACd,MAAM;EACR,CAAC;EAEH,OAAO;CACT;CAEA,SAAS,SACP,MACA,aACA,UACA,cACA,aACA,IACgB;EAChB,OAAO,OAAO,aACZ,MACA;GACE;GACA,aAAa;GACb;GACA,OAAO;IACL,+BAA+B;IAC/B,wBAAwB;GAC1B;EACF,IACC,OAAO,MAAM,UAAU;GACtB,MAAM,kBAAkB;GAGxB,MAAM,iBAAiC;IACrC,QAAQ;IACR,OAAO,IAAI;IACX,OAAO;IACP;IACA,mBAAmB;GACrB;GAEA,IAAI;GACJ,IAAI;IACF,eACE,MAAM,eAAe,yBAAyB,cAAc;GAChE,QAAQ;IACN,MAAM,UAAU;KAAE,aAAa;KAAG,OAAO;IAAuB;IAChE,OAAO;KACL,SAAS;KACT,OAAO,EAAE,cAAc,QAAQ;KAC/B,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,KAAK,UAAU,OAAO;KAAE,CAAC;IAC3D;GACF;GAEA,MAAM,eAAe;IACnB,KAAK,UAAU;IACf;IACA,UAAU;GACZ;GAIA,MAAM,UAAU,OAAO,aAAa,WAAW,CAAC;GAChD,MAAM,QACH,OAAO,QAAQ,mBAChB,QAAQ,wBACR,QAAQ;GAEV,MAAM,mBACJ,SAAS,oBACT,cAAuC,CAAC,MACrC;IACH,MAAM,UAAU;KACd,aAAa;KACb,OAAO;KACP,UAAU;KACV,SAAS;KACT,GAAG;IACL;IACA,OAAO;KACL,SAAS;KACT,OAAO,EAAE,cAAc,QAAQ;KAC/B,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,KAAK,UAAU,OAAO;KAAE,CAAC;IAC3D;GACF;GAEA,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,gBAAgB;GAGhE,IAAI;GACJ,IAAI;IACF,iBAAiB,KAAK,MAAM,KAAK,KAAK,CAAC;GACzC,QAAQ;IACN,OAAO,gBAAgB,iBAAiB;GAC1C;GAGA,MAAM,cAAc,eAAe,yBACjC,cACA,cACF;GACA,IAAI,CAAC,aACH,OAAO,gBAAgB,iBAAiB;GAI1C,IAAI;IACF,MAAM,KAAK,MAAM,eAAe,cAC9B,gBACA,WACF;IACA,IAAI,CAAC,GAAG,SACN,OAAO,gBAAgB,GAAG,iBAAiB,mBAAmB,EAC5D,OAAO,GAAG,MACZ,CAAC;GAEL,QAAQ;IACN,OAAO,gBAAgB,iBAAiB;GAC1C;GAGA,IAAI;GACJ,IAAI,SAAS;GACb,IAAI;IACF,SAAS,MAAM,GAAG,MAAM,KAAK;IAC7B,IACE,UACA,OAAO,WAAW,YAClB,aAAa,UACb,OAAO,SAEP,SAAS;GAEb,SAAS,GAAG;IACV,SAAS;IACT,SAAS;KACP,SAAS;KACT,SAAS,CACP;MAAE,MAAM;MAAQ,MAAM,0BAA0B,OAAO,CAAC;KAAI,CAC9D;IACF;GACF;GAGA,IAAI,CAAC,QACH,IAAI;IACF,MAAM,IAAI,MAAM,eAAe,cAC7B,gBACA,WACF;IACA,IAAI,EAAE,SAAS;KACb,OAAO,UAAU,CAAC;KAClB,OAAO,MAAM,2BAA2B;MACtC,SAAS;MACT,aAAa,EAAE;MACf,SAAS,EAAE;MACX,OAAO,EAAE;KACX;IACF,OACE,OAAO,gBAAgB,EAAE,eAAe,mBAAmB;GAE/D,QAAQ;IACN,OAAO,gBAAgB,mBAAmB;GAC5C;GAGF,OAAO;EACT,EACF;CACF;CAEA,OAAO,eAAe,QAAQ,YAAY;EACxC,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CAGD,OAAO;AACT;AAiDA,IAAM,kBAAN,cAA8B,MAAM,CAAC;AAGrC,IAAM,0BAAN,cAAsC,MAAM,CAAC;AAE7C,SAAgB,eACd,QACA,YACyB;CACzB,MAAM,UAAU,cAAc,MAAM;CACpC,MAAM,EAAE,YAAY;CAEpB,MAAM,kBAAkB,WAAW,mBAAmB,OAAO,GAAO;CAGpE,MAAM,gBAAgB,IAAI,WAAW;CACrC,yBAAwB,eAAe,EAAE,QAAQ,QAAQ,CAAC;CAK1D,MAAM,2BAAW,IAAI,QAAyB;CAM9C,cAAc,wBACZ,OAAO,EAAE,iBAAiB,2BAA2B;EACnD,SAAS,IAAI,eAAe;EAC5B,MAAM,EAAE,QAAQ,WAAW;EAC3B,IAAI,WAAW,SAAS,MAAM,IAAI,wBAAwB;EAC1D,IAAI;EACJ,IAAI;GACF,QAAQ,OAAO,MAAM;EACvB,QAAQ;GACN,MAAM,IAAI,wBAAwB;EACpC;EACA,IAAI,QAAQ,IAAI,MAAM,IAAI,wBAAwB;EAClD,IAAI,QAAQ,iBACV,MAAM,IAAI,gBACR,+BAA+B,MAAM,KAAK,iBAC5C;CAEJ,CACF;CAGA,IAAI,WAAW,SAAS;EACtB,MAAM,mBAAmB,iBAAiB,WAAW,OAAO;EAC5D,cAAc,gBAAgB,UAAU,SAAS;GAC/C,MAAM,WAAW,KAAK,QAAQ,MAAM,EAAE,YAAY,gBAAgB;GAClE,OAAO,SAAS,SAAS,IAAI,WAAW;EAC1C,CAAC;CACH;CAEA,MAAM,YAAY,OAChB,QACA,YACG;EACH,MAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,OAAO;EACxD,OAAO;GACL,GAAG;GACH,OAAO,SAAS,MAAM,KAAK,SAAS;IAClC,IAAI,cAAc,KAAK;IAEvB,IAAI,KAAK,QAAQ,gCAAgC;KAC/C,MAAM,OAAO,KAAK,QAAQ,0BACtB,IAAI,KAAK,QAAQ,4BACjB;KACJ,eAAe,8CAA8C,KAAK;IACpE;IACA,OAAO;KACL,GAAG;KACH;IACF;GACF,CAAC;EACH;CACF;CAEA,MAAM,sBAAsB,OAC1B,0BAGA,QACA,iBACA,YACsC;EACtC,MAAM,UAAU,eACd,QAAQ,SAAS,YAAY,iBAAiB,OAAO;EACvD,MAAM,MAAM,MAAM,OAAO,MAAM;EAG/B,MAAM,iBAAiB,IAAI,QAAQ;EAInC,IACE,IAAI,WACJ,kBACA,eAAe,WACf,MAAM,QAAQ,eAAe,OAAO,KACpC,eAAe,QAAQ,SAAS,GAChC;GAGA,MAAM,UAAU,gBACd,eAAe,OACjB;GACA,MAAM,uBACJ,4BAA4B,WAAW;GAIzC,IACE,wBACA,CAAE,MAAM,qBACN,QAAQ,KAAK,QAAQ,gBAAgB,GAAG,CAAC,CAC3C,GAEA,OAAO;IACL,SAAS;IACT,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;IAAwB,CAAC;GAC3D;GAIF,MAAM,0BAA2C;IAC/C,aAAc,eAAe,eAA0B;IACvD,UAAW,eAAe,YAA4C;KACpE,KAAK;KACL,aAAa;KACb,UAAU;IACZ;IACA;IACA,YAAY,eAAe;GAG7B;GAGA,IAAI;GACJ,IAAI;IACF,iBAAiB,MAAM,cAAc,qBACnC,uBACF;GACF,SAAS,OAAO;IAGd,IACE,iBAAiB,2BACjB,CAAC,SAAS,IAAI,uBAAuB,GAErC,OAAO;IAET,OAAO;KACL,SAAS;KACT,SAAS,CACP;MACE,MAAM;MACN,MACE,iBAAiB,kBACb,MAAM,UACN;KACR,CACF;IACF;GACF;GAGA,MAAM,QAAQ,KAAK,KAAK,UAAU,cAAc,CAAC;GAGjD,OAAO,OAAO;IACZ,GAAG;IACH,OAAO;KACL,GAAG,OAAO;KACV,gBAAgB;IAClB;GACF,CAAC;EACH;EAEA,OAAO;CACT;CAEA,MAAM,UAAU;CAChB,OAAO,eAAe,SAAS,aAAa;EAC1C,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,SAAS,YAAY;EACzC,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"x402.js","names":[],"sources":["../../../src/mcp/client/x402.ts"],"sourcesContent":["/**\n * X402 MCP Integration (v2)\n *\n * Based on:\n * - Coinbase's x402 (Apache 2.0): https://github.com/coinbase/x402\n * - @ethanniser and his work at https://github.com/ethanniser/x402-mcp\n */\n\nimport type {\n  McpServer,\n  RegisteredTool,\n  ToolCallback\n} from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport type {\n  CallToolRequest,\n  CallToolRequestOptions,\n  Client as MCPClient\n} from \"@modelcontextprotocol/client\";\nimport type {\n  CallToolResult as V2CallToolResult,\n  McpServer as V2McpServer,\n  RegisteredTool as V2RegisteredTool,\n  ServerContext as V2ServerContext\n} from \"@modelcontextprotocol/server\";\nimport type {\n  CallToolResult,\n  ToolAnnotations\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport {\n  bindMcpClient,\n  type CallToolSchemaOrOptions,\n  type CompatibleMcpClient,\n  type LegacyCallToolResultSchema\n} from \"./invoker\";\nimport type { z, ZodRawShape } from \"zod\";\n\n// v2 imports from @x402/core\nimport { x402ResourceServer, HTTPFacilitatorClient } from \"@x402/core/server\";\nimport type { FacilitatorConfig, ResourceConfig } from \"@x402/core/server\";\nimport { x402Client } from \"@x402/core/client\";\nimport type {\n  PaymentPayload,\n  PaymentRequirements,\n  PaymentRequired,\n  Network\n} from \"@x402/core/types\";\n\n// v2 imports from @x402/evm\nimport { registerExactEvmScheme as registerServerEvmScheme } from \"@x402/evm/exact/server\";\nimport { registerExactEvmScheme as registerClientEvmScheme } from \"@x402/evm/exact/client\";\nimport type { ClientEvmSigner } from \"@x402/evm\";\n\n// Re-export commonly used types for consumer convenience\nexport type {\n  PaymentRequirements,\n  PaymentRequired,\n  Network\n} from \"@x402/core/types\";\nexport type { FacilitatorConfig } from \"@x402/core/server\";\nexport type { ClientEvmSigner } from \"@x402/evm\";\n\n/**\n * Map of legacy v1 network names to CAIP-2 identifiers.\n * Allows backward compatibility with v1 config.\n */\nconst LEGACY_NETWORK_MAP: Record<string, string> = {\n  \"base-sepolia\": \"eip155:84532\",\n  base: \"eip155:8453\",\n  ethereum: \"eip155:1\",\n  sepolia: \"eip155:11155111\"\n};\n\n/**\n * Normalize a network identifier to CAIP-2 format.\n * Accepts both legacy v1 names (\"base-sepolia\") and CAIP-2 (\"eip155:84532\").\n */\nexport function normalizeNetwork(network: string): Network {\n  return (LEGACY_NETWORK_MAP[network] ?? network) as Network;\n}\n\n/*\n  ======= SERVER SIDE =======\n*/\n\nexport type X402Config = {\n  /**\n   * Network identifier.\n   * Accepts both legacy names (\"base-sepolia\") and CAIP-2 format (\"eip155:84532\").\n   */\n  network: string;\n  /** Payment recipient address */\n  recipient: `0x${string}`;\n  /** Facilitator configuration. Defaults to https://x402.org/facilitator */\n  facilitator?: FacilitatorConfig;\n  /** @deprecated No longer used in v2. The protocol version is determined automatically. */\n  version?: number;\n};\n\n/**\n * The tool body passed to `paidTool`. On an SDK v1 server it is the v1\n * `ToolCallback`; on an SDK v2 server it receives the v2 `ServerContext`.\n */\nexport type PaidToolCallback<\n  Args extends ZodRawShape,\n  Server extends McpServer | V2McpServer = McpServer\n> = Server extends V2McpServer\n  ? (\n      args: z.infer<z.ZodObject<Args>>,\n      ctx: V2ServerContext\n    ) => V2CallToolResult | Promise<V2CallToolResult>\n  : ToolCallback<Args>;\n\nexport interface X402AugmentedServer<\n  Server extends McpServer | V2McpServer = McpServer\n> {\n  paidTool<Args extends ZodRawShape>(\n    name: string,\n    description: string,\n    priceUSD: number,\n    paramsSchema: Args,\n    annotations: ToolAnnotations,\n    cb: PaidToolCallback<Args, Server>\n  ): Server extends V2McpServer ? V2RegisteredTool : RegisteredTool;\n}\n\ntype RequestMeta = Record<string, unknown>;\ntype HeaderGetter = { get(name: string): string | null };\ntype HeaderRecord = Record<string, string | string[] | undefined>;\n\n/**\n * The parts of a tool handler's second argument that x402 reads. SDK v1\n * passes `{ _meta, requestInfo: { headers } }`, where headers is a plain\n * object (every SDK v1 transport lowercases the keys). SDK v2 passes\n * `{ mcpReq: { _meta }, http: { req } }`, where `req` is the web `Request`.\n */\ntype ToolHandlerContext = {\n  _meta?: RequestMeta;\n  requestInfo?: { headers?: HeaderGetter | HeaderRecord };\n  mcpReq?: { _meta?: RequestMeta };\n  http?: { req?: { headers?: HeaderGetter } };\n};\n\nfunction readHeader(\n  headers: HeaderGetter | HeaderRecord | undefined,\n  name: string\n): string | undefined {\n  if (!headers) return undefined;\n  if (typeof headers.get === \"function\") {\n    return (headers as HeaderGetter).get(name) ?? undefined;\n  }\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers as HeaderRecord)) {\n    if (key.toLowerCase() !== wanted) continue;\n    const first = Array.isArray(value) ? value[0] : value;\n    if (typeof first === \"string\") return first;\n  }\n  return undefined;\n}\n\n/**\n * Read the x402 payment token from a tool handler context of either SDK\n * generation. Request `_meta` wins over headers, and header names match\n * case-insensitively. `PAYMENT-SIGNATURE` is x402 v2; `X-PAYMENT` is v1.\n */\nfunction readPaymentToken(extra: unknown): unknown {\n  const ctx = (extra ?? {}) as ToolHandlerContext;\n  const meta = ctx.mcpReq?._meta ?? ctx._meta;\n  const headers = ctx.http?.req?.headers ?? ctx.requestInfo?.headers;\n  return (\n    meta?.[\"x402/payment\"] ??\n    readHeader(headers, \"PAYMENT-SIGNATURE\") ??\n    readHeader(headers, \"X-PAYMENT\")\n  );\n}\n\n/**\n * Add `paidTool` to an MCP server. Accepts an SDK v1 `McpServer`\n * (`@modelcontextprotocol/sdk`) or an SDK v2 `McpServer`\n * (`@modelcontextprotocol/server`).\n */\nexport function withX402<T extends V2McpServer>(\n  server: T,\n  cfg: X402Config\n): T & X402AugmentedServer<V2McpServer>;\n// The SDK v1 overload is last so `ReturnType<typeof withX402>` and generic\n// v1 callers resolve to exactly the pre-v2 types.\nexport function withX402<T extends McpServer>(\n  server: T,\n  cfg: X402Config\n): T & X402AugmentedServer;\nexport function withX402(\n  server: McpServer | V2McpServer,\n  cfg: X402Config\n): (McpServer | V2McpServer) & X402AugmentedServer<McpServer | V2McpServer> {\n  const network = normalizeNetwork(cfg.network);\n  const facilitatorConfig: FacilitatorConfig = cfg.facilitator ?? {\n    url: \"https://x402.org/facilitator\"\n  };\n\n  // Create v2 resource server with facilitator client\n  const facilitatorClient = new HTTPFacilitatorClient(facilitatorConfig);\n  const resourceServer = new x402ResourceServer(facilitatorClient);\n  registerServerEvmScheme(resourceServer);\n\n  // Lazy initialization: fetch supported kinds from facilitator on first use\n  let initPromise: Promise<void> | null = null;\n  function ensureInitialized(): Promise<void> {\n    if (!initPromise) {\n      initPromise = resourceServer.initialize().catch((err) => {\n        initPromise = null; // allow retry on failure\n        throw err;\n      });\n    }\n    return initPromise;\n  }\n\n  function paidTool<Args extends ZodRawShape>(\n    name: string,\n    description: string,\n    priceUSD: number,\n    paramsSchema: Args,\n    annotations: ToolAnnotations,\n    toolCb: PaidToolCallback<Args, McpServer | V2McpServer>\n  ) {\n    // Both SDK generations accept a raw Zod shape and call the handler as\n    // (args, ctx), so one registration serves either server. The public\n    // callback type is enforced by X402AugmentedServer; internally the\n    // context is opaque and forwarded to the tool body unchanged.\n    const cb = toolCb as unknown as (\n      args: unknown,\n      extra: unknown\n    ) => CallToolResult | Promise<CallToolResult>;\n    return (server as McpServer).registerTool(\n      name,\n      {\n        description,\n        inputSchema: paramsSchema,\n        annotations,\n        _meta: {\n          \"agents-x402/paymentRequired\": true,\n          \"agents-x402/priceUSD\": priceUSD\n        }\n      },\n      (async (args, extra) => {\n        await ensureInitialized();\n\n        // Build v2 payment requirements for this tool call\n        const resourceConfig: ResourceConfig = {\n          scheme: \"exact\",\n          payTo: cfg.recipient,\n          price: priceUSD,\n          network,\n          maxTimeoutSeconds: 300\n        };\n\n        let requirements: PaymentRequirements[];\n        try {\n          requirements =\n            await resourceServer.buildPaymentRequirements(resourceConfig);\n        } catch {\n          const payload = { x402Version: 2, error: \"PRICE_COMPUTE_FAILED\" };\n          return {\n            isError: true,\n            _meta: { \"x402/error\": payload },\n            content: [{ type: \"text\", text: JSON.stringify(payload) }]\n          } as const;\n        }\n\n        const resourceInfo = {\n          url: `x402://${name}`,\n          description,\n          mimeType: \"application/json\"\n        };\n\n        const token = readPaymentToken(extra);\n\n        const paymentRequired = (\n          reason = \"PAYMENT_REQUIRED\",\n          extraFields: Record<string, unknown> = {}\n        ) => {\n          const payload = {\n            x402Version: 2,\n            error: reason,\n            resource: resourceInfo,\n            accepts: requirements,\n            ...extraFields\n          };\n          return {\n            isError: true,\n            _meta: { \"x402/error\": payload },\n            content: [{ type: \"text\", text: JSON.stringify(payload) }]\n          } as const;\n        };\n\n        if (!token || typeof token !== \"string\") return paymentRequired();\n\n        // Decode the payment payload (base64-encoded JSON)\n        let paymentPayload: PaymentPayload;\n        try {\n          paymentPayload = JSON.parse(atob(token));\n        } catch {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Find matching requirements for this payment\n        const matchingReq = resourceServer.findMatchingRequirements(\n          requirements,\n          paymentPayload\n        );\n        if (!matchingReq) {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Verify payment with facilitator\n        try {\n          const vr = await resourceServer.verifyPayment(\n            paymentPayload,\n            matchingReq\n          );\n          if (!vr.isValid) {\n            return paymentRequired(vr.invalidReason ?? \"INVALID_PAYMENT\", {\n              payer: vr.payer\n            });\n          }\n        } catch {\n          return paymentRequired(\"INVALID_PAYMENT\");\n        }\n\n        // Execute the tool callback\n        let result: CallToolResult;\n        let failed = false;\n        try {\n          result = await cb(args, extra);\n          if (\n            result &&\n            typeof result === \"object\" &&\n            \"isError\" in result &&\n            result.isError\n          ) {\n            failed = true;\n          }\n        } catch (e) {\n          failed = true;\n          result = {\n            isError: true,\n            content: [\n              { type: \"text\", text: `Tool execution failed: ${String(e)}` }\n            ]\n          };\n        }\n\n        // Settle payment only on success\n        if (!failed) {\n          try {\n            const s = await resourceServer.settlePayment(\n              paymentPayload,\n              matchingReq\n            );\n            if (s.success) {\n              result._meta ??= {};\n              result._meta[\"x402/payment-response\"] = {\n                success: true,\n                transaction: s.transaction,\n                network: s.network,\n                payer: s.payer\n              };\n            } else {\n              return paymentRequired(s.errorReason ?? \"SETTLEMENT_FAILED\");\n            }\n          } catch {\n            return paymentRequired(\"SETTLEMENT_FAILED\");\n          }\n        }\n\n        return result;\n      }) as ToolCallback<Args>\n    );\n  }\n\n  Object.defineProperty(server, \"paidTool\", {\n    value: paidTool,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n\n  // Tell TS the object now also has the paidTool method\n  return server as (McpServer | V2McpServer) &\n    X402AugmentedServer<McpServer | V2McpServer>;\n}\n\n/*\n  ======= CLIENT SIDE =======\n*/\n\nexport interface X402AugmentedClient {\n  callTool(\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    options?: CallToolRequestOptions\n  ): Promise<CallToolResult>;\n  /**\n   * @deprecated Prefer the request-options overload. Explicit legacy result\n   * schemas remain honored through the SDK v2 request funnel.\n   */\n  callTool(\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    resultSchema: LegacyCallToolResultSchema,\n    options?: CallToolRequestOptions\n  ): Promise<CallToolResult>;\n}\n\nexport type X402ClientConfig = {\n  /**\n   * EVM account/signer for signing payment authorizations.\n   * Use `privateKeyToAccount()` from viem/accounts to create one.\n   */\n  account: ClientEvmSigner;\n  /**\n   * Preferred network identifier (optional).\n   * Accepts both legacy names (\"base-sepolia\") and CAIP-2 format (\"eip155:84532\").\n   * When set, the client prefers payment requirements matching this network.\n   * If omitted, the client automatically selects from available requirements.\n   */\n  network?: string;\n  /** Maximum payment value in atomic units (default: 0.10 USDC = 100000) */\n  maxPaymentValue?: bigint;\n  /** @deprecated No longer used in v2. The protocol version is determined automatically. */\n  version?: number;\n  /** Confirmation callback for payment approval */\n  confirmationCallback?: (payment: PaymentRequirements[]) => Promise<boolean>;\n};\n\nclass PaymentCapError extends Error {}\n// Thrown when the selected requirement cannot be cap-checked; the caller\n// returns the server's original 402 result, as before the hook existed.\nclass PaymentPassthroughError extends Error {}\n\nexport function withX402Client<T extends CompatibleMcpClient>(\n  client: T,\n  x402Config: X402ClientConfig\n): X402AugmentedClient & T {\n  const invoker = bindMcpClient(client);\n  const { account } = x402Config;\n\n  const maxPaymentValue = x402Config.maxPaymentValue ?? BigInt(100_000); // 0.10 USDC\n\n  // Create v2 x402 payment client with EVM scheme support\n  const paymentClient = new x402Client();\n  registerClientEvmScheme(paymentClient, { signer: account });\n\n  // Payment requests whose selection reached the hook below. x402 selects a\n  // requirement before it runs any hook, so a request that failed without\n  // getting here offered nothing this client can sign.\n  const selected = new WeakSet<PaymentRequired>();\n\n  // Selection applies scheme support and network preference before this hook.\n  // Enforce the cap on the requirement that will actually be signed. We throw\n  // rather than return `{ abort: true }` because @x402/core rewraps an abort in\n  // a plain Error, which would lose the typed errors the catch below relies on.\n  paymentClient.onBeforePaymentCreation(\n    async ({ paymentRequired, selectedRequirements }) => {\n      selected.add(paymentRequired);\n      const { scheme, amount } = selectedRequirements;\n      if (scheme !== \"exact\") throw new PaymentPassthroughError();\n      let value: bigint;\n      try {\n        value = BigInt(amount);\n      } catch {\n        throw new PaymentPassthroughError(); // malformed amount\n      }\n      if (value < 0n) throw new PaymentPassthroughError();\n      if (value > maxPaymentValue) {\n        throw new PaymentCapError(\n          `Payment exceeds client cap: ${value} > ${maxPaymentValue}`\n        );\n      }\n    }\n  );\n\n  // If a preferred network is specified, register a policy to prefer it\n  if (x402Config.network) {\n    const preferredNetwork = normalizeNetwork(x402Config.network);\n    paymentClient.registerPolicy((_version, reqs) => {\n      const matching = reqs.filter((r) => r.network === preferredNetwork);\n      return matching.length > 0 ? matching : reqs;\n    });\n  }\n\n  const listTools = async (\n    params?: Parameters<MCPClient[\"listTools\"]>[0],\n    options?: Parameters<MCPClient[\"listTools\"]>[1]\n  ) => {\n    const toolsRes = await invoker.listTools(params, options);\n    return {\n      ...toolsRes,\n      tools: toolsRes.tools.map((tool) => {\n        let description = tool.description;\n        // Check _meta for payment information (agents-x402/ is our extension for pre-advertising prices)\n        if (tool._meta?.[\"agents-x402/paymentRequired\"]) {\n          const cost = tool._meta?.[\"agents-x402/priceUSD\"]\n            ? `$${tool._meta?.[\"agents-x402/priceUSD\"]}`\n            : \"an unknown amount\";\n          description += ` (This is a paid tool, you will be charged ${cost} for its execution)`;\n        }\n        return {\n          ...tool,\n          description\n        };\n      })\n    };\n  };\n\n  const callToolWithPayment = async (\n    x402ConfirmationCallback:\n      | ((payment: PaymentRequirements[]) => Promise<boolean>)\n      | null,\n    params: CallToolRequest[\"params\"],\n    schemaOrOptions?: CallToolSchemaOrOptions,\n    options?: CallToolRequestOptions\n  ): ReturnType<MCPClient[\"callTool\"]> => {\n    const invoke = (callParams: CallToolRequest[\"params\"]) =>\n      invoker.callTool(callParams, schemaOrOptions, options);\n    const res = await invoke(params);\n\n    // Check for x402 payment required error in response metadata\n    const maybeX402Error = res._meta?.[\"x402/error\"] as\n      | (PaymentRequired & Record<string, unknown>)\n      | undefined;\n\n    if (\n      res.isError &&\n      maybeX402Error &&\n      maybeX402Error.accepts &&\n      Array.isArray(maybeX402Error.accepts) &&\n      maybeX402Error.accepts.length > 0\n    ) {\n      // Snapshot the requirements: what is cap-checked and signed below is\n      // this copy, not the server's result object or anything aliasing it.\n      const accepts = structuredClone(\n        maybeX402Error.accepts\n      ) as PaymentRequirements[];\n      const confirmationCallback =\n        x402ConfirmationCallback ?? x402Config.confirmationCallback;\n\n      // Use the confirmation callback if provided. It receives deep copies\n      // so a retained reference cannot alter what is cap-checked and signed.\n      if (\n        confirmationCallback &&\n        !(await confirmationCallback(\n          accepts.map((req) => structuredClone(req))\n        ))\n      ) {\n        return {\n          isError: true,\n          content: [{ type: \"text\", text: \"User declined payment\" }]\n        };\n      }\n\n      // Reconstruct the PaymentRequired response for the v2 x402 client\n      const paymentRequiredResponse: PaymentRequired = {\n        x402Version: (maybeX402Error.x402Version as number) ?? 2,\n        resource: (maybeX402Error.resource as PaymentRequired[\"resource\"]) ?? {\n          url: \"\",\n          description: \"\",\n          mimeType: \"application/json\"\n        },\n        accepts,\n        extensions: maybeX402Error.extensions as\n          | Record<string, unknown>\n          | undefined\n      };\n\n      // Create the payment payload using the v2 x402 client\n      let paymentPayload: PaymentPayload;\n      try {\n        paymentPayload = await paymentClient.createPaymentPayload(\n          paymentRequiredResponse\n        );\n      } catch (error) {\n        // Nothing this client can sign, or a selection it cannot cap-check:\n        // return the server's 402 with its payment options, as before.\n        if (\n          error instanceof PaymentPassthroughError ||\n          !selected.has(paymentRequiredResponse)\n        ) {\n          return res;\n        }\n        return {\n          isError: true,\n          content: [\n            {\n              type: \"text\",\n              text:\n                error instanceof PaymentCapError\n                  ? error.message\n                  : \"Failed to create payment payload\"\n            }\n          ]\n        };\n      }\n\n      // Encode the payment payload as a base64 JSON token for MCP transport\n      const token = btoa(JSON.stringify(paymentPayload));\n\n      // Retry the tool call with the payment token\n      return invoke({\n        ...params,\n        _meta: {\n          ...params._meta,\n          \"x402/payment\": token\n        }\n      });\n    }\n\n    return res;\n  };\n\n  const _client = client as X402AugmentedClient & T;\n  Object.defineProperty(_client, \"listTools\", {\n    value: listTools,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n  Object.defineProperty(_client, \"callTool\", {\n    value: callToolWithPayment,\n    writable: false,\n    enumerable: false,\n    configurable: true\n  });\n\n  return _client;\n}\n"],"mappings":";;;;;;;;;;AAiEA,MAAM,qBAA6C;CACjD,gBAAgB;CAChB,MAAM;CACN,UAAU;CACV,SAAS;AACX;;;;;AAMA,SAAgB,iBAAiB,SAA0B;CACzD,OAAQ,mBAAmB,YAAY;AACzC;AAgEA,SAAS,WACP,SACA,MACoB;CACpB,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI,OAAO,QAAQ,QAAQ,YACzB,OAAQ,QAAyB,IAAI,IAAI,KAAK,KAAA;CAEhD,MAAM,SAAS,KAAK,YAAY;CAChC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAuB,GAAG;EAClE,IAAI,IAAI,YAAY,MAAM,QAAQ;EAClC,MAAM,QAAQ,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK;EAChD,IAAI,OAAO,UAAU,UAAU,OAAO;CACxC;AAEF;;;;;;AAOA,SAAS,iBAAiB,OAAyB;CACjD,MAAM,MAAO,SAAS,CAAC;CACvB,MAAM,OAAO,IAAI,QAAQ,SAAS,IAAI;CACtC,MAAM,UAAU,IAAI,MAAM,KAAK,WAAW,IAAI,aAAa;CAC3D,OACE,OAAO,mBACP,WAAW,SAAS,mBAAmB,KACvC,WAAW,SAAS,WAAW;AAEnC;AAiBA,SAAgB,SACd,QACA,KAC0E;CAC1E,MAAM,UAAU,iBAAiB,IAAI,OAAO;CAO5C,MAAM,iBAAiB,IAAI,mBAAmB,IADhB,sBALe,IAAI,eAAe,EAC9D,KAAK,+BACP,CAI8D,CAAC;CAC/D,uBAAwB,cAAc;CAGtC,IAAI,cAAoC;CACxC,SAAS,oBAAmC;EAC1C,IAAI,CAAC,aACH,cAAc,eAAe,WAAW,CAAC,CAAC,OAAO,QAAQ;GACvD,cAAc;GACd,MAAM;EACR,CAAC;EAEH,OAAO;CACT;CAEA,SAAS,SACP,MACA,aACA,UACA,cACA,aACA,QACA;EAKA,MAAM,KAAK;EAIX,OAAQ,OAAqB,aAC3B,MACA;GACE;GACA,aAAa;GACb;GACA,OAAO;IACL,+BAA+B;IAC/B,wBAAwB;GAC1B;EACF,IACC,OAAO,MAAM,UAAU;GACtB,MAAM,kBAAkB;GAGxB,MAAM,iBAAiC;IACrC,QAAQ;IACR,OAAO,IAAI;IACX,OAAO;IACP;IACA,mBAAmB;GACrB;GAEA,IAAI;GACJ,IAAI;IACF,eACE,MAAM,eAAe,yBAAyB,cAAc;GAChE,QAAQ;IACN,MAAM,UAAU;KAAE,aAAa;KAAG,OAAO;IAAuB;IAChE,OAAO;KACL,SAAS;KACT,OAAO,EAAE,cAAc,QAAQ;KAC/B,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,KAAK,UAAU,OAAO;KAAE,CAAC;IAC3D;GACF;GAEA,MAAM,eAAe;IACnB,KAAK,UAAU;IACf;IACA,UAAU;GACZ;GAEA,MAAM,QAAQ,iBAAiB,KAAK;GAEpC,MAAM,mBACJ,SAAS,oBACT,cAAuC,CAAC,MACrC;IACH,MAAM,UAAU;KACd,aAAa;KACb,OAAO;KACP,UAAU;KACV,SAAS;KACT,GAAG;IACL;IACA,OAAO;KACL,SAAS;KACT,OAAO,EAAE,cAAc,QAAQ;KAC/B,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,KAAK,UAAU,OAAO;KAAE,CAAC;IAC3D;GACF;GAEA,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO,gBAAgB;GAGhE,IAAI;GACJ,IAAI;IACF,iBAAiB,KAAK,MAAM,KAAK,KAAK,CAAC;GACzC,QAAQ;IACN,OAAO,gBAAgB,iBAAiB;GAC1C;GAGA,MAAM,cAAc,eAAe,yBACjC,cACA,cACF;GACA,IAAI,CAAC,aACH,OAAO,gBAAgB,iBAAiB;GAI1C,IAAI;IACF,MAAM,KAAK,MAAM,eAAe,cAC9B,gBACA,WACF;IACA,IAAI,CAAC,GAAG,SACN,OAAO,gBAAgB,GAAG,iBAAiB,mBAAmB,EAC5D,OAAO,GAAG,MACZ,CAAC;GAEL,QAAQ;IACN,OAAO,gBAAgB,iBAAiB;GAC1C;GAGA,IAAI;GACJ,IAAI,SAAS;GACb,IAAI;IACF,SAAS,MAAM,GAAG,MAAM,KAAK;IAC7B,IACE,UACA,OAAO,WAAW,YAClB,aAAa,UACb,OAAO,SAEP,SAAS;GAEb,SAAS,GAAG;IACV,SAAS;IACT,SAAS;KACP,SAAS;KACT,SAAS,CACP;MAAE,MAAM;MAAQ,MAAM,0BAA0B,OAAO,CAAC;KAAI,CAC9D;IACF;GACF;GAGA,IAAI,CAAC,QACH,IAAI;IACF,MAAM,IAAI,MAAM,eAAe,cAC7B,gBACA,WACF;IACA,IAAI,EAAE,SAAS;KACb,OAAO,UAAU,CAAC;KAClB,OAAO,MAAM,2BAA2B;MACtC,SAAS;MACT,aAAa,EAAE;MACf,SAAS,EAAE;MACX,OAAO,EAAE;KACX;IACF,OACE,OAAO,gBAAgB,EAAE,eAAe,mBAAmB;GAE/D,QAAQ;IACN,OAAO,gBAAgB,mBAAmB;GAC5C;GAGF,OAAO;EACT,EACF;CACF;CAEA,OAAO,eAAe,QAAQ,YAAY;EACxC,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CAGD,OAAO;AAET;AAiDA,IAAM,kBAAN,cAA8B,MAAM,CAAC;AAGrC,IAAM,0BAAN,cAAsC,MAAM,CAAC;AAE7C,SAAgB,eACd,QACA,YACyB;CACzB,MAAM,UAAU,cAAc,MAAM;CACpC,MAAM,EAAE,YAAY;CAEpB,MAAM,kBAAkB,WAAW,mBAAmB,OAAO,GAAO;CAGpE,MAAM,gBAAgB,IAAI,WAAW;CACrC,yBAAwB,eAAe,EAAE,QAAQ,QAAQ,CAAC;CAK1D,MAAM,2BAAW,IAAI,QAAyB;CAM9C,cAAc,wBACZ,OAAO,EAAE,iBAAiB,2BAA2B;EACnD,SAAS,IAAI,eAAe;EAC5B,MAAM,EAAE,QAAQ,WAAW;EAC3B,IAAI,WAAW,SAAS,MAAM,IAAI,wBAAwB;EAC1D,IAAI;EACJ,IAAI;GACF,QAAQ,OAAO,MAAM;EACvB,QAAQ;GACN,MAAM,IAAI,wBAAwB;EACpC;EACA,IAAI,QAAQ,IAAI,MAAM,IAAI,wBAAwB;EAClD,IAAI,QAAQ,iBACV,MAAM,IAAI,gBACR,+BAA+B,MAAM,KAAK,iBAC5C;CAEJ,CACF;CAGA,IAAI,WAAW,SAAS;EACtB,MAAM,mBAAmB,iBAAiB,WAAW,OAAO;EAC5D,cAAc,gBAAgB,UAAU,SAAS;GAC/C,MAAM,WAAW,KAAK,QAAQ,MAAM,EAAE,YAAY,gBAAgB;GAClE,OAAO,SAAS,SAAS,IAAI,WAAW;EAC1C,CAAC;CACH;CAEA,MAAM,YAAY,OAChB,QACA,YACG;EACH,MAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,OAAO;EACxD,OAAO;GACL,GAAG;GACH,OAAO,SAAS,MAAM,KAAK,SAAS;IAClC,IAAI,cAAc,KAAK;IAEvB,IAAI,KAAK,QAAQ,gCAAgC;KAC/C,MAAM,OAAO,KAAK,QAAQ,0BACtB,IAAI,KAAK,QAAQ,4BACjB;KACJ,eAAe,8CAA8C,KAAK;IACpE;IACA,OAAO;KACL,GAAG;KACH;IACF;GACF,CAAC;EACH;CACF;CAEA,MAAM,sBAAsB,OAC1B,0BAGA,QACA,iBACA,YACsC;EACtC,MAAM,UAAU,eACd,QAAQ,SAAS,YAAY,iBAAiB,OAAO;EACvD,MAAM,MAAM,MAAM,OAAO,MAAM;EAG/B,MAAM,iBAAiB,IAAI,QAAQ;EAInC,IACE,IAAI,WACJ,kBACA,eAAe,WACf,MAAM,QAAQ,eAAe,OAAO,KACpC,eAAe,QAAQ,SAAS,GAChC;GAGA,MAAM,UAAU,gBACd,eAAe,OACjB;GACA,MAAM,uBACJ,4BAA4B,WAAW;GAIzC,IACE,wBACA,CAAE,MAAM,qBACN,QAAQ,KAAK,QAAQ,gBAAgB,GAAG,CAAC,CAC3C,GAEA,OAAO;IACL,SAAS;IACT,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;IAAwB,CAAC;GAC3D;GAIF,MAAM,0BAA2C;IAC/C,aAAc,eAAe,eAA0B;IACvD,UAAW,eAAe,YAA4C;KACpE,KAAK;KACL,aAAa;KACb,UAAU;IACZ;IACA;IACA,YAAY,eAAe;GAG7B;GAGA,IAAI;GACJ,IAAI;IACF,iBAAiB,MAAM,cAAc,qBACnC,uBACF;GACF,SAAS,OAAO;IAGd,IACE,iBAAiB,2BACjB,CAAC,SAAS,IAAI,uBAAuB,GAErC,OAAO;IAET,OAAO;KACL,SAAS;KACT,SAAS,CACP;MACE,MAAM;MACN,MACE,iBAAiB,kBACb,MAAM,UACN;KACR,CACF;IACF;GACF;GAGA,MAAM,QAAQ,KAAK,KAAK,UAAU,cAAc,CAAC;GAGjD,OAAO,OAAO;IACZ,GAAG;IACH,OAAO;KACL,GAAG,OAAO;KACV,gBAAgB;IAClB;GACF,CAAC;EACH;EAEA,OAAO;CACT;CAEA,MAAM,UAAU;CAChB,OAAO,eAAe,SAAS,aAAa;EAC1C,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CACD,OAAO,eAAe,SAAS,YAAY;EACzC,OAAO;EACP,UAAU;EACV,YAAY;EACZ,cAAc;CAChB,CAAC;CAED,OAAO;AACT"}

package/dist/mcp/index.d.ts

@@ -33,7 +33,7 @@ import {
   vn as SSEEdgeClientTransport,
   yn as StreamableHTTPEdgeClientTransport,
   zt as MCPClientOAuthResult
-} from "../agent-routing-0DR0Tk2v.js";
+} from "../agent-routing-Bhdbvf7s.js";
 import {
   a as McpAuthContext,
   n as StatelessMcpHandler,

package/dist/mcp/index.js

@@ -1,7 +1,7 @@
 import { getAgentByName } from "../agent-routing.js";
 import "../types.js";
-import { i as getCurrentAgent, t as Agent } from "../src-BZeu-SCD.js";
-import { c as RPCServerTransport, i as normalizeServerId, l as RPC_DO_PREFIX, n as MCP_SERVER_ID_MAX_LENGTH, s as RPCClientTransport, u as isDurableObjectNamespace } from "../client-fyQrLGkD.js";
+import { i as getCurrentAgent, t as Agent } from "../src-DgCbZtIR.js";
+import { c as RPCServerTransport, i as normalizeServerId, l as RPC_DO_PREFIX, n as MCP_SERVER_ID_MAX_LENGTH, s as RPCClientTransport, u as isDurableObjectNamespace } from "../client-1tEQ1Oqz.js";
 import { n as getMcpAuthContext, r as runWithAuthContext, t as createStatelessMcpHandler } from "../handler-stateless-VvrWSAVA.js";
 import { SSEClientTransport, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { ElicitRequestSchema, InitializeRequestSchema, JSONRPCMessageSchema, SUPPORTED_PROTOCOL_VERSIONS, isInitializeRequest, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResultResponse } from "@modelcontextprotocol/sdk/types.js";

package/dist/models/ai-sdk/index.d.ts

@@ -1,21 +1,23 @@
 import {
-  _ as KnownSpeechModelId,
+  c as CloudflareRerankingModelId,
+  d as KnownImageModelId,
+  f as KnownSpeechModelId,
+  i as ProviderGatewaySettings,
+  l as CloudflareSpeechModelId,
+  n as GatewayOptions,
+  o as CloudflareEmbeddingModelId,
+  p as WorkersAIModelId,
+  r as ModelOptions$1,
+  s as CloudflareImageModelId,
+  t as AISettings,
+  u as CloudflareTranscriptionModelId
+} from "../../settings-NgGwF7Qt.js";
+import {
   a as CloudflareAIError$1,
-  c as GatewayOptions,
-  d as CloudflareEmbeddingModelId,
-  f as CloudflareImageModelId,
-  g as KnownImageModelId,
-  h as CloudflareTranscriptionModelId,
   i as CloudflareAIAttempt,
-  l as ModelOptions$1,
-  m as CloudflareSpeechModelId,
   o as CloudflareAIErrorCode,
-  p as CloudflareRerankingModelId,
-  s as AISettings,
-  t as Transport,
-  u as ProviderGatewaySettings,
-  v as WorkersAIModelId
-} from "../../transport-PfFnt-Ld.js";
+  t as Transport
+} from "../../transport-k2mFrtL8.js";
 import {
   APICallError,
   EmbeddingModelV4,