align-mcp-remote 0.1.39 → 0.1.41

package/dist/{chunk-V2QU44UI.js → chunk-YCBPOVTL.js}

@@ -15632,7 +15632,7 @@ var Client = class extends Protocol {
 };
 
 // package.json
-var version2 = "0.1.38";
+var version2 = "0.1.40";
 
 // node_modules/pkce-challenge/dist/index.node.js
 var crypto;
@@ -18092,23 +18092,51 @@ async function discoverOAuthServerInfo2(serverUrl, headers = {}) {
     downstreamTokenHeader: protectedResourceMetadata?.x_downstream_resource ? downstreamTokenHeader : void 0
   };
 }
-async function performDownstreamAuth(authProvider, downstreamResource, callbackPort, waitForAuthCode) {
+async function performDownstreamAuth(authProvider, downstreamResource, callbackPort) {
   debugLog("Starting downstream OAuth flow", { downstreamResource });
-  const downstreamServerMetadata = await fetchAuthorizationServerMetadata(downstreamResource.authorization_server);
+  const downstreamAs = downstreamResource.authorization_servers[0];
+  if (!downstreamAs) {
+    throw new Error("x_downstream_resource.authorization_servers is empty");
+  }
+  const downstreamServerMetadata = await fetchAuthorizationServerMetadata(downstreamAs);
   if (!downstreamServerMetadata) {
-    throw new Error(`Failed to fetch downstream authorization server metadata from ${downstreamResource.authorization_server}`);
+    throw new Error(`Failed to fetch downstream authorization server metadata from ${downstreamAs}`);
   }
-  const redirectUrl = `http://${authProvider.options.host || "localhost"}:${callbackPort}/oauth/callback`;
+  const downstreamCallbackPort = await findAvailablePort(callbackPort + 1);
+  const downstreamEvents = new (await import("events")).EventEmitter();
+  const { server: downstreamServer, waitForAuthCode: waitForDownstreamCode } = setupOAuthCallbackServerWithLongPoll({
+    port: downstreamCallbackPort,
+    path: "/oauth/callback",
+    events: downstreamEvents,
+    authTimeoutMs: 3e5
+  });
+  const host = authProvider.options.host || "localhost";
+  const redirectUrl = `http://${host}:${downstreamCallbackPort}/oauth/callback`;
   const scope = downstreamResource.scopes_required?.join(" ") ?? "";
-  const { authorizationUrl, codeVerifier } = await startAuthorization(downstreamResource.authorization_server, {
+  const downstreamClientMetadata = {
+    redirect_uris: [redirectUrl],
+    token_endpoint_auth_method: "none",
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    client_name: authProvider.options.clientName || "MCP CLI Client",
+    scope
+  };
+  const downstreamClientInfo = await registerClient(downstreamAs, {
+    metadata: downstreamServerMetadata,
+    clientMetadata: downstreamClientMetadata
+  });
+  debugLog("Registered downstream client", { client_id: downstreamClientInfo.client_id });
+  const downstreamHash = crypto2.createHash("md5").update(downstreamAs).digest("hex");
+  await writeJsonFile(downstreamHash, "downstream_client_info.json", downstreamClientInfo);
+  const { authorizationUrl, codeVerifier } = await startAuthorization(downstreamAs, {
     metadata: downstreamServerMetadata,
-    clientInformation: await authProvider.clientInformation(),
+    clientInformation: downstreamClientInfo,
     redirectUrl,
     scope,
     resource: new URL(downstreamResource.resource)
   });
   log(`
-Please authorize downstream resource by visiting:
+Please authorize the downstream resource by visiting:
 ${authorizationUrl.toString()}
 `);
   try {
@@ -18118,16 +18146,20 @@ ${authorizationUrl.toString()}
   } catch {
     log("Could not open browser automatically. Please copy and paste the URL above.");
   }
-  const code = await waitForAuthCode();
-  const tokens = await exchangeAuthorization(downstreamResource.authorization_server, {
-    metadata: downstreamServerMetadata,
-    clientInformation: await authProvider.clientInformation(),
-    authorizationCode: code,
-    codeVerifier,
-    redirectUri: redirectUrl
-  });
-  await authProvider.saveDownstreamTokens(tokens);
-  debugLog("Downstream OAuth flow completed, tokens saved");
+  try {
+    const code = await waitForDownstreamCode();
+    const tokens = await exchangeAuthorization(downstreamAs, {
+      metadata: downstreamServerMetadata,
+      clientInformation: downstreamClientInfo,
+      authorizationCode: code,
+      codeVerifier,
+      redirectUri: redirectUrl
+    });
+    await authProvider.saveDownstreamTokens(tokens);
+    debugLog("Downstream OAuth flow completed, tokens saved");
+  } finally {
+    downstreamServer.close();
+  }
 }
 async function connectToRemoteServer(client, serverUrl, authProvider, headers, authInitializer, transportStrategy = "http-first", downstreamTokenHeader, recursionReasons = /* @__PURE__ */ new Set()) {
   log(`[${pid}] Connecting to remote server: ${serverUrl}`);

package/dist/client.js

@@ -13,7 +13,7 @@ import {
   performDownstreamAuth,
   setupSignalHandlers,
   version
-} from "./chunk-V2QU44UI.js";
+} from "./chunk-YCBPOVTL.js";
 
 // src/client.ts
 import { EventEmitter } from "events";
@@ -67,7 +67,7 @@ async function runClient(serverUrl, callbackPort, headers, transportStrategy = "
         const code = await authState.waitForAuthCode();
         if (downstreamResource && !authState.skipBrowserAuth) {
           log("Layer 1 auth complete. Starting downstream (Layer 2) OAuth flow...");
-          await performDownstreamAuth(authProvider, downstreamResource, callbackPort, authState.waitForAuthCode);
+          await performDownstreamAuth(authProvider, downstreamResource, callbackPort);
           log("Layer 2 auth complete.");
         }
         return code;

package/dist/proxy.js

@@ -11,7 +11,7 @@ import {
   parseCommandLineArgs,
   performDownstreamAuth,
   setupSignalHandlers
-} from "./chunk-V2QU44UI.js";
+} from "./chunk-YCBPOVTL.js";
 
 // src/proxy.ts
 import { EventEmitter } from "events";
@@ -152,7 +152,7 @@ async function runProxy(serverUrl, callbackPort, headers, transportStrategy = "h
         const code = await authState.waitForAuthCode();
         if (downstreamResource && !authState.skipBrowserAuth) {
           log("Layer 1 auth complete. Starting downstream (Layer 2) OAuth flow...");
-          await performDownstreamAuth(authProvider, downstreamResource, callbackPort, authState.waitForAuthCode);
+          await performDownstreamAuth(authProvider, downstreamResource, callbackPort);
           log("Layer 2 auth complete.");
         }
         return code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "align-mcp-remote",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Remote proxy for Model Context Protocol, allowing local-only clients to connect to remote servers using oAuth",
   "keywords": [
     "mcp",