align-mcp-remote 0.1.38 → 0.1.40

package/dist/{chunk-MMS4PSEI.js → chunk-X7AWYUMO.js}

@@ -15632,7 +15632,7 @@ var Client = class extends Protocol {
 };
 
 // package.json
-var version2 = "0.1.38";
+var version2 = "0.1.39";
 
 // node_modules/pkce-challenge/dist/index.node.js
 var crypto;
@@ -16410,6 +16410,17 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   }
   return OAuthTokensSchema.parse(await response.json());
 }
+async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
+  const tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri);
+  return executeTokenRequest(authorizationServerUrl, {
+    metadata,
+    tokenRequestParams,
+    clientInformation,
+    addClientAuthentication,
+    resource,
+    fetchFn
+  });
+}
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
     grant_type: "refresh_token",
@@ -18072,41 +18083,109 @@ async function discoverOAuthServerInfo2(serverUrl, headers = {}) {
     debugLog("No Protected Resource Metadata found, falling back to server URL as authorization server");
   }
   const authorizationServerMetadata = await fetchAuthorizationServerMetadata(authorizationServerUrl);
+  const downstreamTokenHeader = protectedResourceMetadata?.x_downstream_resource?.token_header ?? "X-Downstream-Authorization";
   return {
     authorizationServerUrl,
     authorizationServerMetadata,
     protectedResourceMetadata,
-    wwwAuthenticateScope
+    wwwAuthenticateScope,
+    downstreamTokenHeader: protectedResourceMetadata?.x_downstream_resource ? downstreamTokenHeader : void 0
   };
 }
-async function connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy = "http-first", recursionReasons = /* @__PURE__ */ new Set()) {
+async function performDownstreamAuth(authProvider, downstreamResource, callbackPort) {
+  debugLog("Starting downstream OAuth flow", { downstreamResource });
+  const downstreamAs = downstreamResource.authorization_servers[0];
+  if (!downstreamAs) {
+    throw new Error("x_downstream_resource.authorization_servers is empty");
+  }
+  const downstreamServerMetadata = await fetchAuthorizationServerMetadata(downstreamAs);
+  if (!downstreamServerMetadata) {
+    throw new Error(`Failed to fetch downstream authorization server metadata from ${downstreamAs}`);
+  }
+  const downstreamCallbackPort = await findAvailablePort(callbackPort + 1);
+  const downstreamEvents = new (await import("events")).EventEmitter();
+  const { server: downstreamServer, waitForAuthCode: waitForDownstreamCode } = setupOAuthCallbackServerWithLongPoll({
+    port: downstreamCallbackPort,
+    path: "/oauth/callback",
+    events: downstreamEvents,
+    authTimeoutMs: 3e5
+  });
+  const host = authProvider.options.host || "localhost";
+  const redirectUrl = `http://${host}:${downstreamCallbackPort}/oauth/callback`;
+  const scope = downstreamResource.scopes_required?.join(" ") ?? "";
+  const { authorizationUrl, codeVerifier } = await startAuthorization(downstreamAs, {
+    metadata: downstreamServerMetadata,
+    clientInformation: await authProvider.clientInformation(),
+    redirectUrl,
+    scope,
+    resource: new URL(downstreamResource.resource)
+  });
+  log(`
+Please authorize the downstream resource by visiting:
+${authorizationUrl.toString()}
+`);
+  try {
+    const { default: open2 } = await import("open");
+    await open2(authorizationUrl.toString());
+    log("Browser opened automatically for downstream authorization.");
+  } catch {
+    log("Could not open browser automatically. Please copy and paste the URL above.");
+  }
+  try {
+    const code = await waitForDownstreamCode();
+    const tokens = await exchangeAuthorization(downstreamAs, {
+      metadata: downstreamServerMetadata,
+      clientInformation: await authProvider.clientInformation(),
+      authorizationCode: code,
+      codeVerifier,
+      redirectUri: redirectUrl
+    });
+    await authProvider.saveDownstreamTokens(tokens);
+    debugLog("Downstream OAuth flow completed, tokens saved");
+  } finally {
+    downstreamServer.close();
+  }
+}
+async function connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy = "http-first", downstreamTokenHeader, recursionReasons = /* @__PURE__ */ new Set()) {
   log(`[${pid}] Connecting to remote server: ${serverUrl}`);
   const url2 = new URL(serverUrl);
+  const resolveDownstreamHeader = async () => {
+    if (!downstreamTokenHeader) return {};
+    const provider = authProvider;
+    if (typeof provider.downstreamTokens !== "function") return {};
+    const downstreamTokens = await provider.downstreamTokens();
+    if (downstreamTokens?.access_token) {
+      return { [downstreamTokenHeader]: `Bearer ${downstreamTokens.access_token}` };
+    }
+    return {};
+  };
   const eventSourceInit = {
-    fetch: (url3, init) => {
-      return Promise.resolve(authProvider?.tokens?.()).then(
-        (tokens) => fetch2(url3, {
-          ...init,
-          headers: {
-            ...init?.headers instanceof Headers2 ? Object.fromEntries(init?.headers.entries()) : init?.headers || {},
-            ...headers,
-            ...tokens?.access_token ? { Authorization: `Bearer ${tokens.access_token}` } : {},
-            Accept: "text/event-stream"
-          }
-        })
-      );
+    fetch: async (url3, init) => {
+      const [tokens, downstreamHeader2] = await Promise.all([authProvider?.tokens?.(), resolveDownstreamHeader()]);
+      return fetch2(url3, {
+        ...init,
+        headers: {
+          ...init?.headers instanceof Headers2 ? Object.fromEntries(init?.headers.entries()) : init?.headers || {},
+          ...headers,
+          ...tokens?.access_token ? { Authorization: `Bearer ${tokens.access_token}` } : {},
+          ...downstreamHeader2,
+          Accept: "text/event-stream"
+        }
+      });
     }
   };
   log(`Using transport strategy: ${transportStrategy}`);
   const shouldAttemptFallback2 = transportStrategy === "http-first" || transportStrategy === "sse-first";
   const sseTransport = transportStrategy === "sse-only" || transportStrategy === "sse-first";
+  const downstreamHeader = await resolveDownstreamHeader();
+  const mergedHeaders = { ...headers, ...downstreamHeader };
   const transport = sseTransport ? new SSEClientTransport(url2, {
     authProvider,
-    requestInit: { headers },
+    requestInit: { headers: mergedHeaders },
     eventSourceInit
   }) : new StreamableHTTPClientTransport(url2, {
     authProvider,
-    requestInit: { headers }
+    requestInit: { headers: mergedHeaders }
   });
   try {
     debugLog("Attempting to connect to remote server", { sseTransport });
@@ -18145,6 +18224,7 @@ async function connectToRemoteServer(client, serverUrl, authProvider, headers, a
         headers,
         authInitializer,
         sseTransport ? "http-only" : "sse-only",
+        downstreamTokenHeader,
         recursionReasons
       );
     } else if (error2 instanceof UnauthorizedError || error2 instanceof Error && error2.message.includes("Unauthorized")) {
@@ -18179,7 +18259,7 @@ async function connectToRemoteServer(client, serverUrl, authProvider, headers, a
         recursionReasons.add(REASON_AUTH_NEEDED);
         log(`Recursively reconnecting for reason: ${REASON_AUTH_NEEDED}`);
         debugLog("Recursively reconnecting after auth", { recursionReasons: Array.from(recursionReasons) });
-        return connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy, recursionReasons);
+        return connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy, downstreamTokenHeader, recursionReasons);
       } catch (authError) {
         log("Authorization error:", authError);
         debugLog("Authorization error during finishAuth", {
@@ -18759,6 +18839,20 @@ ${authorizationUrl.toString()}
     debugLog("Code verifier found:", !!verifier);
     return verifier;
   }
+  /**
+   * Gets the downstream OAuth tokens (Layer 2) if they exist
+   */
+  async downstreamTokens() {
+    debugLog("Reading downstream OAuth tokens");
+    return readJsonFile(this.serverUrlHash, "downstream_tokens.json", OAuthTokensSchema);
+  }
+  /**
+   * Saves downstream OAuth tokens (Layer 2)
+   */
+  async saveDownstreamTokens(tokens) {
+    debugLog("Saving downstream tokens", { hasAccessToken: !!tokens.access_token });
+    await writeJsonFile(this.serverUrlHash, "downstream_tokens.json", tokens);
+  }
   /**
    * Invalidates the specified credentials
    * @param scope The scope of credentials to invalidate
@@ -18770,6 +18864,7 @@ ${authorizationUrl.toString()}
         await Promise.all([
           deleteConfigFile(this.serverUrlHash, "client_info.json"),
           deleteConfigFile(this.serverUrlHash, "tokens.json"),
+          deleteConfigFile(this.serverUrlHash, "downstream_tokens.json"),
           deleteConfigFile(this.serverUrlHash, "code_verifier.txt")
         ]);
         this._clientInfo = void 0;
@@ -18990,6 +19085,7 @@ export {
   log,
   mcpProxy,
   discoverOAuthServerInfo2 as discoverOAuthServerInfo,
+  performDownstreamAuth,
   connectToRemoteServer,
   parseCommandLineArgs,
   setupSignalHandlers,

package/dist/client.js

@@ -10,9 +10,10 @@ import {
   discoverOAuthServerInfo,
   log,
   parseCommandLineArgs,
+  performDownstreamAuth,
   setupSignalHandlers,
   version
-} from "./chunk-MMS4PSEI.js";
+} from "./chunk-X7AWYUMO.js";
 
 // src/client.ts
 import { EventEmitter } from "events";
@@ -52,6 +53,7 @@ async function runClient(serverUrl, callbackPort, headers, transportStrategy = "
       capabilities: {}
     }
   );
+  const downstreamResource = discoveryResult.protectedResourceMetadata?.x_downstream_resource;
   let server = null;
   const authInitializer = async () => {
     const authState = await authCoordinator.initializeAuth();
@@ -61,12 +63,28 @@ async function runClient(serverUrl, callbackPort, headers, transportStrategy = "
       await new Promise((res) => setTimeout(res, 1e3));
     }
     return {
-      waitForAuthCode: authState.waitForAuthCode,
+      waitForAuthCode: async () => {
+        const code = await authState.waitForAuthCode();
+        if (downstreamResource && !authState.skipBrowserAuth) {
+          log("Layer 1 auth complete. Starting downstream (Layer 2) OAuth flow...");
+          await performDownstreamAuth(authProvider, downstreamResource, callbackPort);
+          log("Layer 2 auth complete.");
+        }
+        return code;
+      },
       skipBrowserAuth: authState.skipBrowserAuth
     };
   };
   try {
-    const transport = await connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy);
+    const transport = await connectToRemoteServer(
+      client,
+      serverUrl,
+      authProvider,
+      headers,
+      authInitializer,
+      transportStrategy,
+      discoveryResult.downstreamTokenHeader
+    );
     transport.onmessage = (message) => {
       log("Received message:", JSON.stringify(message, null, 2));
     };

package/dist/proxy.js

@@ -9,8 +9,9 @@ import {
   log,
   mcpProxy,
   parseCommandLineArgs,
+  performDownstreamAuth,
   setupSignalHandlers
-} from "./chunk-MMS4PSEI.js";
+} from "./chunk-X7AWYUMO.js";
 
 // src/proxy.ts
 import { EventEmitter } from "events";
@@ -138,6 +139,7 @@ async function runProxy(serverUrl, callbackPort, headers, transportStrategy = "h
   });
   const localTransport = new StdioServerTransport();
   let server = null;
+  const downstreamResource = discoveryResult.protectedResourceMetadata?.x_downstream_resource;
   const authInitializer = async () => {
     const authState = await authCoordinator.initializeAuth();
     server = authState.server;
@@ -146,12 +148,28 @@ async function runProxy(serverUrl, callbackPort, headers, transportStrategy = "h
       await new Promise((res) => setTimeout(res, 1e3));
     }
     return {
-      waitForAuthCode: authState.waitForAuthCode,
+      waitForAuthCode: async () => {
+        const code = await authState.waitForAuthCode();
+        if (downstreamResource && !authState.skipBrowserAuth) {
+          log("Layer 1 auth complete. Starting downstream (Layer 2) OAuth flow...");
+          await performDownstreamAuth(authProvider, downstreamResource, callbackPort);
+          log("Layer 2 auth complete.");
+        }
+        return code;
+      },
       skipBrowserAuth: authState.skipBrowserAuth
     };
   };
   try {
-    const remoteTransport = await connectToRemoteServer(null, serverUrl, authProvider, headers, authInitializer, transportStrategy);
+    const remoteTransport = await connectToRemoteServer(
+      null,
+      serverUrl,
+      authProvider,
+      headers,
+      authInitializer,
+      transportStrategy,
+      discoveryResult.downstreamTokenHeader
+    );
     mcpProxy({
       transportToClient: localTransport,
       transportToServer: remoteTransport,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "align-mcp-remote",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Remote proxy for Model Context Protocol, allowing local-only clients to connect to remote servers using oAuth",
   "keywords": [
     "mcp",