editmamei 1.9.6 → 1.9.7

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth.js

@@ -1,1046 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UnauthorizedError = void 0;
-exports.selectClientAuthMethod = selectClientAuthMethod;
-exports.parseErrorResponse = parseErrorResponse;
-exports.auth = auth;
-exports.isHttpsUrl = isHttpsUrl;
-exports.selectResourceURL = selectResourceURL;
-exports.extractWWWAuthenticateParams = extractWWWAuthenticateParams;
-exports.extractResourceMetadataUrl = extractResourceMetadataUrl;
-exports.discoverOAuthProtectedResourceMetadata = discoverOAuthProtectedResourceMetadata;
-exports.discoverOAuthMetadata = discoverOAuthMetadata;
-exports.buildDiscoveryUrls = buildDiscoveryUrls;
-exports.discoverAuthorizationServerMetadata = discoverAuthorizationServerMetadata;
-exports.discoverOAuthServerInfo = discoverOAuthServerInfo;
-exports.startAuthorization = startAuthorization;
-exports.prepareAuthorizationCodeRequest = prepareAuthorizationCodeRequest;
-exports.exchangeAuthorization = exchangeAuthorization;
-exports.refreshAuthorization = refreshAuthorization;
-exports.fetchToken = fetchToken;
-exports.registerClient = registerClient;
-const pkce_challenge_1 = __importDefault(require("pkce-challenge"));
-const types_js_1 = require("../types.js");
-const auth_js_1 = require("../shared/auth.js");
-const auth_js_2 = require("../shared/auth.js");
-const auth_utils_js_1 = require("../shared/auth-utils.js");
-const errors_js_1 = require("../server/auth/errors.js");
-const transport_js_1 = require("../shared/transport.js");
-class UnauthorizedError extends Error {
-    constructor(message) {
-        super(message ?? 'Unauthorized');
-    }
-}
-exports.UnauthorizedError = UnauthorizedError;
-function isClientAuthMethod(method) {
-    return ['client_secret_basic', 'client_secret_post', 'none'].includes(method);
-}
-const AUTHORIZATION_CODE_RESPONSE_TYPE = 'code';
-const AUTHORIZATION_CODE_CHALLENGE_METHOD = 'S256';
-/**
- * Determines the best client authentication method to use based on server support and client configuration.
- *
- * Priority order (highest to lowest):
- * 1. client_secret_basic (if client secret is available)
- * 2. client_secret_post (if client secret is available)
- * 3. none (for public clients)
- *
- * @param clientInformation - OAuth client information containing credentials
- * @param supportedMethods - Authentication methods supported by the authorization server
- * @returns The selected authentication method
- */
-function selectClientAuthMethod(clientInformation, supportedMethods) {
-    const hasClientSecret = clientInformation.client_secret !== undefined;
-    // Prefer the method returned by the server during client registration, if valid.
-    // When server metadata is present we also require the method to be listed as supported;
-    // when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
-    if ('token_endpoint_auth_method' in clientInformation &&
-        clientInformation.token_endpoint_auth_method &&
-        isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
-        (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
-        return clientInformation.token_endpoint_auth_method;
-    }
-    // If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
-    // default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
-    // Basic authentication for clients with a secret, making it the safest default.
-    if (supportedMethods.length === 0) {
-        return hasClientSecret ? 'client_secret_basic' : 'none';
-    }
-    // Try methods in priority order (most secure first)
-    if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
-        return 'client_secret_basic';
-    }
-    if (hasClientSecret && supportedMethods.includes('client_secret_post')) {
-        return 'client_secret_post';
-    }
-    if (supportedMethods.includes('none')) {
-        return 'none';
-    }
-    // Fallback: use what we have
-    return hasClientSecret ? 'client_secret_post' : 'none';
-}
-/**
- * Applies client authentication to the request based on the specified method.
- *
- * Implements OAuth 2.1 client authentication methods:
- * - client_secret_basic: HTTP Basic authentication (RFC 6749 Section 2.3.1)
- * - client_secret_post: Credentials in request body (RFC 6749 Section 2.3.1)
- * - none: Public client authentication (RFC 6749 Section 2.1)
- *
- * @param method - The authentication method to use
- * @param clientInformation - OAuth client information containing credentials
- * @param headers - HTTP headers object to modify
- * @param params - URL search parameters to modify
- * @throws {Error} When required credentials are missing
- */
-function applyClientAuthentication(method, clientInformation, headers, params) {
-    const { client_id, client_secret } = clientInformation;
-    switch (method) {
-        case 'client_secret_basic':
-            applyBasicAuth(client_id, client_secret, headers);
-            return;
-        case 'client_secret_post':
-            applyPostAuth(client_id, client_secret, params);
-            return;
-        case 'none':
-            applyPublicAuth(client_id, params);
-            return;
-        default:
-            throw new Error(`Unsupported client authentication method: ${method}`);
-    }
-}
-/**
- * Applies HTTP Basic authentication (RFC 6749 Section 2.3.1)
- */
-function applyBasicAuth(clientId, clientSecret, headers) {
-    if (!clientSecret) {
-        throw new Error('client_secret_basic authentication requires a client_secret');
-    }
-    const credentials = btoa(`${clientId}:${clientSecret}`);
-    headers.set('Authorization', `Basic ${credentials}`);
-}
-/**
- * Applies POST body authentication (RFC 6749 Section 2.3.1)
- */
-function applyPostAuth(clientId, clientSecret, params) {
-    params.set('client_id', clientId);
-    if (clientSecret) {
-        params.set('client_secret', clientSecret);
-    }
-}
-/**
- * Applies public client authentication (RFC 6749 Section 2.1)
- */
-function applyPublicAuth(clientId, params) {
-    params.set('client_id', clientId);
-}
-/**
- * Parses an OAuth error response from a string or Response object.
- *
- * If the input is a standard OAuth2.0 error response, it will be parsed according to the spec
- * and an instance of the appropriate OAuthError subclass will be returned.
- * If parsing fails, it falls back to a generic ServerError that includes
- * the response status (if available) and original content.
- *
- * @param input - A Response object or string containing the error response
- * @returns A Promise that resolves to an OAuthError instance
- */
-async function parseErrorResponse(input) {
-    const statusCode = input instanceof Response ? input.status : undefined;
-    const body = input instanceof Response ? await input.text() : input;
-    try {
-        const result = auth_js_1.OAuthErrorResponseSchema.parse(JSON.parse(body));
-        const { error, error_description, error_uri } = result;
-        const errorClass = errors_js_1.OAUTH_ERRORS[error] || errors_js_1.ServerError;
-        return new errorClass(error_description || '', error_uri);
-    }
-    catch (error) {
-        // Not a valid OAuth error response, but try to inform the user of the raw data anyway
-        const redirect = input instanceof Response ? (0, transport_js_1.unfollowedRedirect)(input, input.url) : undefined;
-        const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ''}${redirect ?? `Invalid OAuth error response: ${error}. Raw body: ${body}`}`;
-        return new errors_js_1.ServerError(errorMessage);
-    }
-}
-/**
- * Compares two authorization server identifiers, tolerating a single trailing `/`
- * difference (`String(new URL(...))` is slash-suffixed, advertised values often are not).
- */
-function issuersMatch(a, b) {
-    let [x, y] = [a, b];
-    try {
-        // Two URLs are compared as parsed, so the spelling of scheme, host or default port does not matter.
-        [x, y] = [new URL(a).href, new URL(b).href];
-    }
-    catch {
-        // Not two URLs: compared as written.
-    }
-    return x === y || (x.endsWith('/') && x.slice(0, -1) === y) || (y.endsWith('/') && y.slice(0, -1) === x);
-}
-/**
- * {@linkcode auth} stamps everything it passes to `saveClientInformation` / `saveTokens` with
- * `issuer`, the authorization server URL used for discovery. This returns `stored` unless its
- * stamp names a different authorization server, in which case the caller behaves as if nothing
- * were stored. A value without a stamp (saved by an earlier version) is returned as-is, and
- * is stamped once this authorization server has accepted it.
- */
-function discardIfIssuerMismatch(stored, issuer) {
-    // `null`: a `JSON.parse(storage.getItem(...))`-style getter with nothing stored.
-    if (!stored)
-        return undefined;
-    // A stamp that is not a string (raw storage) counts as no stamp.
-    if (typeof stored.issuer !== 'string')
-        return stored.issuer == null ? stored : { ...stored, issuer: undefined };
-    return issuersMatch(stored.issuer, issuer) ? stored : undefined;
-}
-// `issuer` is added by the client when it stores a value; authorization server responses are parsed without it.
-const TokenResponseSchema = auth_js_2.OAuthTokensSchema.omit({ issuer: true });
-const RegistrationResponseSchema = auth_js_2.OAuthClientInformationFullSchema.omit({ issuer: true });
-function boundElsewhereError(stored, issuer) {
-    return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. ` +
-        'Clear the stored client information, or correct `expectedIssuer`, if the authorization server has moved.');
-}
-/**
- * Orchestrates the full auth flow with a server.
- *
- * This can be used as a single entry point for all authorization functionality,
- * instead of linking together the other lower-level functions in this module.
- */
-async function auth(provider, options) {
-    try {
-        return await authInternal(provider, options);
-    }
-    catch (error) {
-        // Handle recoverable error types by invalidating credentials and retrying
-        if (error instanceof errors_js_1.InvalidClientError || error instanceof errors_js_1.UnauthorizedClientError) {
-            await provider.invalidateCredentials?.('all');
-            return await authInternal(provider, options);
-        }
-        else if (error instanceof errors_js_1.InvalidGrantError) {
-            await provider.invalidateCredentials?.('tokens');
-            return await authInternal(provider, options);
-        }
-        // Throw otherwise
-        throw error;
-    }
-}
-async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
-    // Check if the provider has cached discovery state to skip discovery
-    const cachedState = await provider.discoveryState?.();
-    let resourceMetadata;
-    let authorizationServerUrl;
-    let metadata;
-    // If resourceMetadataUrl is not provided, try to load it from cached state
-    // This handles browser redirects where the URL was saved before navigation
-    let effectiveResourceMetadataUrl = resourceMetadataUrl;
-    if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
-        effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
-    }
-    if (cachedState?.authorizationServerUrl) {
-        // Restore discovery state from cache
-        authorizationServerUrl = cachedState.authorizationServerUrl;
-        resourceMetadata = cachedState.resourceMetadata;
-        metadata =
-            cachedState.authorizationServerMetadata ?? (await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn }));
-        // If resource metadata wasn't cached, try to fetch it for selectResourceURL
-        if (!resourceMetadata) {
-            try {
-                resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
-            }
-            catch {
-                // RFC 9728 not available — selectResourceURL will handle undefined
-            }
-        }
-        // Re-save if we enriched the cached state with missing metadata
-        if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
-            await provider.saveDiscoveryState?.({
-                authorizationServerUrl: String(authorizationServerUrl),
-                resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-                resourceMetadata,
-                authorizationServerMetadata: metadata
-            });
-        }
-    }
-    else {
-        // Full discovery via RFC 9728
-        const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
-        authorizationServerUrl = serverInfo.authorizationServerUrl;
-        metadata = serverInfo.authorizationServerMetadata;
-        resourceMetadata = serverInfo.resourceMetadata;
-        // Persist discovery state for future use
-        // TODO: resourceMetadataUrl is only populated when explicitly provided via options
-        // or loaded from cached state. The URL derived internally by
-        // discoverOAuthProtectedResourceMetadata() is not captured back here.
-        await provider.saveDiscoveryState?.({
-            authorizationServerUrl: String(authorizationServerUrl),
-            resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-            resourceMetadata,
-            authorizationServerMetadata: metadata
-        });
-    }
-    // Binding key for stored credentials: the authorization server URL that discovery used
-    // (advertised by the resource server, restored from discoveryState(), or the legacy
-    // resource-origin fallback). `metadata.issuer` is deliberately not used: this version does
-    // not check that the metadata document echoes the URL it was fetched from.
-    const issuer = String(authorizationServerUrl);
-    // Send the metadata's resource indicator verbatim: `selectResourceURL` returns a parsed
-    // `URL`, and `URL.href` appends "/" to a pathless indicator such as `https://example.com`,
-    // which exact-match authorization servers reject (#1968). A URL returned by the
-    // provider's own `validateResourceURL` is used as returned.
-    const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-    const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
-    // Apply scope selection strategy (SEP-835):
-    // 1. WWW-Authenticate scope (passed via `scope` param)
-    // 2. PRM scopes_supported
-    // 3. Client metadata scope (user-configured fallback)
-    // The resolved scope is used consistently for both DCR and the authorization request.
-    const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
-    // Handle client registration if needed. Client information stamped for a different
-    // authorization server reads back as `undefined`, so the flow re-registers exactly as if
-    // nothing were stored.
-    const storedClientInformation = await Promise.resolve(provider.clientInformation());
-    let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
-    const canRegisterAgain = provider.saveClientInformation !== undefined && !!provider.redirectUrl;
-    if (storedClientInformation && !clientInformation && !canRegisterAgain) {
-        // Pre-registered credentials, or a non-interactive client running on configured
-        // credentials: neither can be re-created by registering with this authorization server.
-        throw boundElsewhereError(storedClientInformation, issuer);
-    }
-    // Saved by an earlier version: bound to the first authorization server that accepts it.
-    const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : undefined;
-    const bindClientInformation = async () => {
-        try {
-            if (unstampedClientInformation)
-                await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
-        }
-        catch {
-            // A provider that only expects this call after a registration keeps working, unbound.
-        }
-    };
-    if (!clientInformation) {
-        if (authorizationCode !== undefined) {
-            throw new Error('Existing OAuth client information is required when exchanging an authorization code');
-        }
-        const supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === true;
-        const clientMetadataUrl = provider.clientMetadataUrl;
-        if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) {
-            throw new errors_js_1.InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
-        }
-        const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
-        if (shouldUseUrlBasedClientId) {
-            // SEP-991: URL-based Client IDs
-            clientInformation = { client_id: clientMetadataUrl, issuer };
-            await provider.saveClientInformation?.(clientInformation);
-        }
-        else {
-            // Fallback to dynamic registration
-            if (!provider.saveClientInformation) {
-                throw new Error('OAuth client information must be saveable for dynamic registration');
-            }
-            const fullInformation = await registerClient(authorizationServerUrl, {
-                metadata,
-                clientMetadata: provider.clientMetadata,
-                scope: resolvedScope,
-                fetchFn
-            });
-            clientInformation = { ...fullInformation, issuer };
-            await provider.saveClientInformation(clientInformation);
-        }
-    }
-    // Non-interactive flows (e.g., client_credentials, jwt-bearer) don't need a redirect URL
-    const nonInteractiveFlow = !provider.redirectUrl;
-    // Exchange authorization code for tokens, or fetch tokens directly for non-interactive flows
-    if (authorizationCode !== undefined || nonInteractiveFlow) {
-        const tokens = await fetchToken(provider, authorizationServerUrl, {
-            metadata,
-            resource,
-            authorizationCode,
-            fetchFn
-        });
-        await bindClientInformation();
-        await provider.saveTokens({ ...tokens, issuer });
-        return 'AUTHORIZED';
-    }
-    // A refresh token stamped for a different authorization server reads back as `undefined`,
-    // so it is never posted to this one's token endpoint.
-    const tokens = discardIfIssuerMismatch(await provider.tokens(), issuer);
-    if (tokens?.refresh_token && tokens.issuer == null) {
-        // eslint-disable-next-line no-console
-        console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that " +
-            'does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and ' +
-            'saveClientInformation() receive unchanged.');
-    }
-    // Handle token refresh or new authorization
-    if (tokens?.refresh_token) {
-        try {
-            // Attempt to refresh the token
-            const newTokens = await refreshAuthorization(authorizationServerUrl, {
-                metadata,
-                clientInformation,
-                refreshToken: tokens.refresh_token,
-                resource,
-                addClientAuthentication: provider.addClientAuthentication,
-                fetchFn
-            });
-            await bindClientInformation();
-            await provider.saveTokens({ ...newTokens, issuer });
-            return 'AUTHORIZED';
-        }
-        catch (error) {
-            // If this is a ServerError, or an unknown type, log it out and try to continue. Otherwise, escalate so we can fix things and retry.
-            if (!(error instanceof errors_js_1.OAuthError) || error instanceof errors_js_1.ServerError) {
-                // Could not refresh OAuth tokens
-            }
-            else {
-                // Refresh failed for another reason, re-throw
-                throw error;
-            }
-        }
-    }
-    const state = provider.state ? await provider.state() : undefined;
-    // Start new authorization flow
-    const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
-        metadata,
-        clientInformation,
-        state,
-        redirectUrl: provider.redirectUrl,
-        scope: resolvedScope,
-        resource
-    });
-    await provider.saveCodeVerifier(codeVerifier);
-    await provider.redirectToAuthorization(authorizationUrl);
-    return 'REDIRECT';
-}
-/**
- * SEP-991: URL-based Client IDs
- * Validate that the client_id is a valid URL with https scheme
- */
-function isHttpsUrl(value) {
-    if (!value)
-        return false;
-    try {
-        const url = new URL(value);
-        return url.protocol === 'https:' && url.pathname !== '/';
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Selects the RFC 8707 resource indicator for an MCP server: the provider's
- * {@linkcode OAuthClientProvider.validateResourceURL | validateResourceURL} result when
- * implemented, otherwise the protected resource metadata's `resource` (checked against the
- * server URL with `checkResourceAllowed`), or `undefined` when there is no metadata.
- *
- * The result is a parsed `URL`, so a pathless indicator such as `https://example.com` has
- * the `href` `https://example.com/`. {@linkcode auth} therefore sends the metadata string
- * verbatim instead of this URL's `href` (#1968); callers that emit the `resource`
- * parameter themselves should do the same.
- */
-async function selectResourceURL(serverUrl, provider, resourceMetadata) {
-    const defaultResource = (0, auth_utils_js_1.resourceUrlFromServerUrl)(serverUrl);
-    // If provider has custom validation, delegate to it
-    if (provider.validateResourceURL) {
-        return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
-    }
-    // Only include resource parameter when Protected Resource Metadata is present
-    if (!resourceMetadata) {
-        return undefined;
-    }
-    // Validate that the metadata's resource is compatible with our request
-    if (!(0, auth_utils_js_1.checkResourceAllowed)({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource })) {
-        throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
-    }
-    // Prefer the resource from metadata since it's what the server is telling us to request
-    return new URL(resourceMetadata.resource);
-}
-/**
- * Extract resource_metadata, scope, and error from WWW-Authenticate header.
- */
-function extractWWWAuthenticateParams(res) {
-    const authenticateHeader = res.headers.get('WWW-Authenticate');
-    if (!authenticateHeader) {
-        return {};
-    }
-    const [type, scheme] = authenticateHeader.split(' ');
-    if (type.toLowerCase() !== 'bearer' || !scheme) {
-        return {};
-    }
-    const resourceMetadataMatch = extractFieldFromWwwAuth(res, 'resource_metadata') || undefined;
-    let resourceMetadataUrl;
-    if (resourceMetadataMatch) {
-        try {
-            resourceMetadataUrl = new URL(resourceMetadataMatch);
-        }
-        catch {
-            // Ignore invalid URL
-        }
-    }
-    const scope = extractFieldFromWwwAuth(res, 'scope') || undefined;
-    const error = extractFieldFromWwwAuth(res, 'error') || undefined;
-    return {
-        resourceMetadataUrl,
-        scope,
-        error
-    };
-}
-/**
- * Extracts a specific field's value from the WWW-Authenticate header string.
- *
- * @param response The HTTP response object containing the headers.
- * @param fieldName The name of the field to extract (e.g., "realm", "nonce").
- * @returns The field value
- */
-function extractFieldFromWwwAuth(response, fieldName) {
-    const wwwAuthHeader = response.headers.get('WWW-Authenticate');
-    if (!wwwAuthHeader) {
-        return null;
-    }
-    const pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`);
-    const match = wwwAuthHeader.match(pattern);
-    if (match) {
-        // Pattern matches: field_name="value" or field_name=value (unquoted)
-        return match[1] || match[2];
-    }
-    return null;
-}
-/**
- * Extract resource_metadata from response header.
- * @deprecated Use `extractWWWAuthenticateParams` instead.
- */
-function extractResourceMetadataUrl(res) {
-    const authenticateHeader = res.headers.get('WWW-Authenticate');
-    if (!authenticateHeader) {
-        return undefined;
-    }
-    const [type, scheme] = authenticateHeader.split(' ');
-    if (type.toLowerCase() !== 'bearer' || !scheme) {
-        return undefined;
-    }
-    const regex = /resource_metadata="([^"]*)"/;
-    const match = regex.exec(authenticateHeader);
-    if (!match) {
-        return undefined;
-    }
-    try {
-        return new URL(match[1]);
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Looks up RFC 9728 OAuth 2.0 Protected Resource Metadata.
- *
- * If the server returns a 404 for the well-known endpoint, this function will
- * return `undefined`. Any other errors will be thrown as exceptions.
- */
-async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
-    const response = await discoverMetadataWithFallback(serverUrl, 'oauth-protected-resource', fetchFn, {
-        protocolVersion: opts?.protocolVersion,
-        metadataUrl: opts?.resourceMetadataUrl
-    });
-    if (!response || response.status === 404) {
-        await response?.body?.cancel();
-        throw new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`);
-    }
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
-    }
-    return auth_js_2.OAuthProtectedResourceMetadataSchema.parse(await response.json());
-}
-/**
- * Helper function to handle fetch with CORS retry logic
- */
-async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
-    try {
-        return await (0, transport_js_1.fetchWithinOrigin)(fetchFn)(url, { headers });
-    }
-    catch (error) {
-        if (error instanceof TypeError) {
-            if (headers) {
-                // CORS errors come back as TypeError, retry without headers
-                return fetchWithCorsRetry(url, undefined, fetchFn);
-            }
-            else {
-                // We're getting CORS errors on retry too, return undefined
-                return undefined;
-            }
-        }
-        throw error;
-    }
-}
-/**
- * Constructs the well-known path for auth-related metadata discovery
- */
-function buildWellKnownPath(wellKnownPrefix, pathname = '', options = {}) {
-    // Strip trailing slash from pathname to avoid double slashes
-    if (pathname.endsWith('/')) {
-        pathname = pathname.slice(0, -1);
-    }
-    return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
-}
-/**
- * Tries to discover OAuth metadata at a specific URL
- */
-async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
-    const headers = {
-        'MCP-Protocol-Version': protocolVersion
-    };
-    return await fetchWithCorsRetry(url, headers, fetchFn);
-}
-/**
- * Determines if fallback to root discovery should be attempted
- */
-function shouldAttemptFallback(response, pathname) {
-    return !response || (!response.ok && response.status < 500 && pathname !== '/');
-}
-/**
- * Generic function for discovering OAuth metadata with fallback support
- */
-async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
-    const issuer = new URL(serverUrl);
-    const protocolVersion = opts?.protocolVersion ?? types_js_1.LATEST_PROTOCOL_VERSION;
-    let url;
-    if (opts?.metadataUrl) {
-        url = new URL(opts.metadataUrl);
-    }
-    else {
-        // Try path-aware discovery first
-        const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
-        url = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
-        url.search = issuer.search;
-    }
-    let response = await tryMetadataDiscovery(url, protocolVersion, fetchFn);
-    // If path-aware discovery fails with 404 and we're not already at root, try fallback to root discovery
-    if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
-        const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
-        response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
-    }
-    return response;
-}
-/**
- * Looks up RFC 8414 OAuth 2.0 Authorization Server Metadata.
- *
- * If the server returns a 404 for the well-known endpoint, this function will
- * return `undefined`. Any other errors will be thrown as exceptions.
- *
- * @deprecated This function is deprecated in favor of `discoverAuthorizationServerMetadata`.
- */
-async function discoverOAuthMetadata(issuer, { authorizationServerUrl, protocolVersion } = {}, fetchFn = fetch) {
-    if (typeof issuer === 'string') {
-        issuer = new URL(issuer);
-    }
-    if (!authorizationServerUrl) {
-        authorizationServerUrl = issuer;
-    }
-    if (typeof authorizationServerUrl === 'string') {
-        authorizationServerUrl = new URL(authorizationServerUrl);
-    }
-    protocolVersion ?? (protocolVersion = types_js_1.LATEST_PROTOCOL_VERSION);
-    const response = await discoverMetadataWithFallback(authorizationServerUrl, 'oauth-authorization-server', fetchFn, {
-        protocolVersion,
-        metadataServerUrl: authorizationServerUrl
-    });
-    if (!response || response.status === 404) {
-        await response?.body?.cancel();
-        return undefined;
-    }
-    if (!response.ok) {
-        await response.body?.cancel();
-        throw new Error(`HTTP ${response.status} trying to load well-known OAuth metadata`);
-    }
-    return auth_js_2.OAuthMetadataSchema.parse(await response.json());
-}
-/**
- * Builds a list of discovery URLs to try for authorization server metadata.
- * URLs are returned in priority order:
- * 1. OAuth metadata at the given URL
- * 2. OIDC metadata endpoints at the given URL
- */
-function buildDiscoveryUrls(authorizationServerUrl) {
-    const url = typeof authorizationServerUrl === 'string' ? new URL(authorizationServerUrl) : authorizationServerUrl;
-    const hasPath = url.pathname !== '/';
-    const urlsToTry = [];
-    if (!hasPath) {
-        // Root path: https://example.com/.well-known/oauth-authorization-server
-        urlsToTry.push({
-            url: new URL('/.well-known/oauth-authorization-server', url.origin),
-            type: 'oauth'
-        });
-        // OIDC: https://example.com/.well-known/openid-configuration
-        urlsToTry.push({
-            url: new URL(`/.well-known/openid-configuration`, url.origin),
-            type: 'oidc'
-        });
-        return urlsToTry;
-    }
-    // Strip trailing slash from pathname to avoid double slashes
-    let pathname = url.pathname;
-    if (pathname.endsWith('/')) {
-        pathname = pathname.slice(0, -1);
-    }
-    // 1. OAuth metadata at the given URL
-    // Insert well-known before the path: https://example.com/.well-known/oauth-authorization-server/tenant1
-    urlsToTry.push({
-        url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url.origin),
-        type: 'oauth'
-    });
-    // 2. OIDC metadata endpoints
-    // RFC 8414 style: Insert /.well-known/openid-configuration before the path
-    urlsToTry.push({
-        url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
-        type: 'oidc'
-    });
-    // OIDC Discovery 1.0 style: Append /.well-known/openid-configuration after the path
-    urlsToTry.push({
-        url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
-        type: 'oidc'
-    });
-    return urlsToTry;
-}
-/**
- * Discovers authorization server metadata with support for RFC 8414 OAuth 2.0 Authorization Server Metadata
- * and OpenID Connect Discovery 1.0 specifications.
- *
- * This function implements a fallback strategy for authorization server discovery:
- * 1. Attempts RFC 8414 OAuth metadata discovery first
- * 2. If OAuth discovery fails, falls back to OpenID Connect Discovery
- *
- * @param authorizationServerUrl - The authorization server URL obtained from the MCP Server's
- *                                 protected resource metadata, or the MCP server's URL if the
- *                                 metadata was not found.
- * @param options - Configuration options
- * @param options.fetchFn - Optional fetch function for making HTTP requests, defaults to global fetch
- * @param options.protocolVersion - MCP protocol version to use, defaults to LATEST_PROTOCOL_VERSION
- * @returns Promise resolving to authorization server metadata, or undefined if discovery fails
- */
-async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = types_js_1.LATEST_PROTOCOL_VERSION } = {}) {
-    const headers = {
-        'MCP-Protocol-Version': protocolVersion,
-        Accept: 'application/json'
-    };
-    // Get the list of URLs to try
-    const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
-    // Try each URL in order
-    for (const { url: endpointUrl, type } of urlsToTry) {
-        const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
-        if (!response) {
-            /**
-             * CORS error occurred - don't throw as the endpoint may not allow CORS,
-             * continue trying other possible endpoints
-             */
-            continue;
-        }
-        if (!response.ok) {
-            await response.body?.cancel();
-            // Continue looking for any 4xx response code, or a redirect that was not followed.
-            if (response.status < 500) {
-                continue; // Try next URL
-            }
-            throw new Error(`HTTP ${response.status} trying to load ${type === 'oauth' ? 'OAuth' : 'OpenID provider'} metadata from ${endpointUrl}`);
-        }
-        // Parse and validate based on type
-        if (type === 'oauth') {
-            return auth_js_2.OAuthMetadataSchema.parse(await response.json());
-        }
-        else {
-            return auth_js_1.OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
-        }
-    }
-    return undefined;
-}
-/**
- * Discovers the authorization server for an MCP server following
- * {@link https://datatracker.ietf.org/doc/html/rfc9728 | RFC 9728} (OAuth 2.0 Protected
- * Resource Metadata), with fallback to treating the server URL as the
- * authorization server.
- *
- * This function combines two discovery steps into one call:
- * 1. Probes `/.well-known/oauth-protected-resource` on the MCP server to find the
- *    authorization server URL (RFC 9728).
- * 2. Fetches authorization server metadata from that URL (RFC 8414 / OpenID Connect Discovery).
- *
- * Use this when you need the authorization server metadata for operations outside the
- * {@linkcode auth} orchestrator, such as token refresh or token revocation.
- *
- * @param serverUrl - The MCP resource server URL
- * @param opts - Optional configuration
- * @param opts.resourceMetadataUrl - Override URL for the protected resource metadata endpoint
- * @param opts.fetchFn - Custom fetch function for HTTP requests
- * @returns Authorization server URL, metadata, and resource metadata (if available)
- */
-async function discoverOAuthServerInfo(serverUrl, opts) {
-    let resourceMetadata;
-    let authorizationServerUrl;
-    try {
-        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
-        if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
-            authorizationServerUrl = resourceMetadata.authorization_servers[0];
-        }
-    }
-    catch {
-        // RFC 9728 not supported -- fall back to treating the server URL as the authorization server
-    }
-    // If we don't get a valid authorization server from protected resource metadata,
-    // fall back to the legacy MCP spec behavior: MCP server base URL acts as the authorization server
-    if (!authorizationServerUrl) {
-        authorizationServerUrl = String(new URL('/', serverUrl));
-    }
-    const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
-    return {
-        authorizationServerUrl,
-        authorizationServerMetadata,
-        resourceMetadata
-    };
-}
-function resourceIndicatorToString(resource) {
-    return typeof resource === 'string' ? resource : resource.href;
-}
-/**
- * Begins the authorization flow with the given server, by generating a PKCE challenge and constructing the authorization URL.
- */
-async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
-    let authorizationUrl;
-    if (metadata) {
-        authorizationUrl = new URL(metadata.authorization_endpoint);
-        if (!metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE)) {
-            throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
-        }
-        if (metadata.code_challenge_methods_supported &&
-            !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD)) {
-            throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
-        }
-    }
-    else {
-        authorizationUrl = new URL('/authorize', authorizationServerUrl);
-    }
-    // Generate PKCE challenge
-    const challenge = await (0, pkce_challenge_1.default)();
-    const codeVerifier = challenge.code_verifier;
-    const codeChallenge = challenge.code_challenge;
-    authorizationUrl.searchParams.set('response_type', AUTHORIZATION_CODE_RESPONSE_TYPE);
-    authorizationUrl.searchParams.set('client_id', clientInformation.client_id);
-    authorizationUrl.searchParams.set('code_challenge', codeChallenge);
-    authorizationUrl.searchParams.set('code_challenge_method', AUTHORIZATION_CODE_CHALLENGE_METHOD);
-    authorizationUrl.searchParams.set('redirect_uri', String(redirectUrl));
-    if (state) {
-        authorizationUrl.searchParams.set('state', state);
-    }
-    if (scope) {
-        authorizationUrl.searchParams.set('scope', scope);
-    }
-    if (scope?.includes('offline_access')) {
-        // if the request includes the OIDC-only "offline_access" scope,
-        // we need to set the prompt to "consent" to ensure the user is prompted to grant offline access
-        // https://openid.net/specs/openid-connect-core-1_0.html#OfflineAccess
-        authorizationUrl.searchParams.append('prompt', 'consent');
-    }
-    if (resource) {
-        authorizationUrl.searchParams.set('resource', resourceIndicatorToString(resource));
-    }
-    return { authorizationUrl, codeVerifier };
-}
-/**
- * Prepares token request parameters for an authorization code exchange.
- *
- * This is the default implementation used by fetchToken when the provider
- * doesn't implement prepareTokenRequest.
- *
- * @param authorizationCode - The authorization code received from the authorization endpoint
- * @param codeVerifier - The PKCE code verifier
- * @param redirectUri - The redirect URI used in the authorization request
- * @returns URLSearchParams for the authorization_code grant
- */
-function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
-    return new URLSearchParams({
-        grant_type: 'authorization_code',
-        code: authorizationCode,
-        code_verifier: codeVerifier,
-        redirect_uri: String(redirectUri)
-    });
-}
-/**
- * Internal helper to execute a token request with the given parameters.
- * Used by exchangeAuthorization, refreshAuthorization, and fetchToken.
- */
-async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
-    const tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL('/token', authorizationServerUrl);
-    const headers = new Headers({
-        'Content-Type': 'application/x-www-form-urlencoded',
-        Accept: 'application/json'
-    });
-    if (resource) {
-        tokenRequestParams.set('resource', resourceIndicatorToString(resource));
-    }
-    if (addClientAuthentication) {
-        await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
-    }
-    else if (clientInformation) {
-        const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
-        const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
-        applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
-    }
-    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(tokenUrl, {
-        method: 'POST',
-        headers,
-        body: tokenRequestParams
-    });
-    if (!response.ok) {
-        throw await parseErrorResponse(response);
-    }
-    return TokenResponseSchema.parse(await response.json());
-}
-/**
- * Exchanges an authorization code for an access token with the given server.
- *
- * Supports multiple client authentication methods as specified in OAuth 2.1:
- * - Automatically selects the best authentication method based on server support
- * - Falls back to appropriate defaults when server metadata is unavailable
- *
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration object containing client info, auth code, etc.
- * @returns Promise resolving to OAuth tokens
- * @throws {Error} When token exchange fails or authentication is invalid
- */
-async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
-    const tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri);
-    return executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation,
-        addClientAuthentication,
-        resource,
-        fetchFn
-    });
-}
-/**
- * Exchange a refresh token for an updated access token.
- *
- * Supports multiple client authentication methods as specified in OAuth 2.1:
- * - Automatically selects the best authentication method based on server support
- * - Preserves the original refresh token if a new one is not returned
- *
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration object containing client info, refresh token, etc.
- * @returns Promise resolving to OAuth tokens (preserves original refresh_token if not replaced)
- * @throws {Error} When token refresh fails or authentication is invalid
- */
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
-    const tokenRequestParams = new URLSearchParams({
-        grant_type: 'refresh_token',
-        refresh_token: refreshToken
-    });
-    const tokens = await executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation,
-        addClientAuthentication,
-        resource,
-        fetchFn
-    });
-    // Preserve original refresh token if server didn't return a new one
-    return { refresh_token: refreshToken, ...tokens };
-}
-/**
- * Unified token fetching that works with any grant type via provider.prepareTokenRequest().
- *
- * This function provides a single entry point for obtaining tokens regardless of the
- * OAuth grant type. The provider's prepareTokenRequest() method determines which grant
- * to use and supplies the grant-specific parameters.
- *
- * @param provider - OAuth client provider that implements prepareTokenRequest()
- * @param authorizationServerUrl - The authorization server's base URL
- * @param options - Configuration for the token request
- * @returns Promise resolving to OAuth tokens
- * @throws {Error} When provider doesn't implement prepareTokenRequest or token fetch fails
- *
- * @example
- * // Provider for client_credentials:
- * class MyProvider implements OAuthClientProvider {
- *   prepareTokenRequest(scope) {
- *     const params = new URLSearchParams({ grant_type: 'client_credentials' });
- *     if (scope) params.set('scope', scope);
- *     return params;
- *   }
- *   // ... other methods
- * }
- *
- * const tokens = await fetchToken(provider, authServerUrl, { metadata });
- */
-async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
-    // Nothing is sent to an authorization server other than the one the client information is stamped for.
-    const readClientInformation = async () => {
-        const storedClientInformation = await provider.clientInformation();
-        const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
-        if (storedClientInformation && !checked) {
-            throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
-        }
-        return checked;
-    };
-    let clientInformation = await readClientInformation();
-    const scope = provider.clientMetadata.scope;
-    // Use provider's prepareTokenRequest if available, otherwise fall back to authorization_code
-    let tokenRequestParams;
-    if (provider.prepareTokenRequest) {
-        tokenRequestParams = await provider.prepareTokenRequest(scope);
-    }
-    // Default to authorization_code grant if no custom prepareTokenRequest
-    if (!tokenRequestParams) {
-        if (!authorizationCode) {
-            throw new Error('Either provider.prepareTokenRequest() or authorizationCode is required');
-        }
-        if (!provider.redirectUrl) {
-            throw new Error('redirectUrl is required for authorization_code flow');
-        }
-        const codeVerifier = await provider.codeVerifier();
-        tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
-    }
-    // A provider may fill in its client information while the request is prepared.
-    clientInformation ?? (clientInformation = await readClientInformation());
-    return executeTokenRequest(authorizationServerUrl, {
-        metadata,
-        tokenRequestParams,
-        clientInformation,
-        addClientAuthentication: provider.addClientAuthentication,
-        resource,
-        fetchFn
-    });
-}
-/**
- * Performs OAuth 2.0 Dynamic Client Registration according to RFC 7591.
- *
- * If `scope` is provided, it overrides `clientMetadata.scope` in the registration
- * request body. This allows callers to apply the Scope Selection Strategy (SEP-835)
- * consistently across both DCR and the subsequent authorization request.
- */
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
-    let registrationUrl;
-    if (metadata) {
-        if (!metadata.registration_endpoint) {
-            throw new Error('Incompatible auth server: does not support dynamic client registration');
-        }
-        registrationUrl = new URL(metadata.registration_endpoint);
-    }
-    else {
-        registrationUrl = new URL('/register', authorizationServerUrl);
-    }
-    const response = await (0, transport_js_1.fetchWithinOrigin)(fetchFn ?? fetch)(registrationUrl, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json'
-        },
-        body: JSON.stringify({
-            ...clientMetadata,
-            ...(scope !== undefined ? { scope } : {})
-        })
-    });
-    if (!response.ok) {
-        throw await parseErrorResponse(response);
-    }
-    return RegistrationResponseSchema.parse(await response.json());
-}
-//# sourceMappingURL=auth.js.map