maka-agent 0.2.0-dev.6.20260830 → 0.2.0-dev.64.20260929

package/node_modules/@modelcontextprotocol/client/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as legacyProtocolVersions, A as isInitializeRequest, At as SdkErrorCode, B as DiscoverResultSchema, C as HEADER_MISMATCH_ERROR_CODE, Ct as OAuthClientInformationFullSchema, D as assertCompleteRequestPrompt, Dt as OAuthTokensSchema, E as scanXMcpHeaderDeclarations, Et as OAuthProtectedResourceMetadataSchema, F as isJSONRPCRequest, Ft as stampErrorBrands, G as MissingRequiredClientCapabilityError, H as ListChangedOptionsBaseSchema, I as isJSONRPCResponse, J as UnsupportedProtocolVersionError, K as ProtocolError, L as isJSONRPCResultResponse, M as isInputRequiredResult, Mt as OAuthError, N as isJSONRPCErrorResponse, Nt as OAuthErrorCode, O as assertCompleteRequestResourceTemplate, Ot as OpenIdProviderDiscoveryMetadataSchema, P as isJSONRPCNotification, Pt as brandedHasInstance, Q as isModernProtocolVersion, R as isTaskAugmentedRequestParams, S as parseSchema, St as IdJagTokenExchangeResponseSchema, T as encodeMcpParamValue, Tt as OAuthMetadataSchema, U as MODERN_WIRE_REVISION, V as JSONRPCMessageSchema, W as codecForVersion, X as ProtocolErrorCode, Y as UrlElicitationRequiredError, Z as SUPPORTED_MODERN_PROTOCOL_VERSIONS, _ as mergeCapabilities, _t as SUPPORTED_PROTOCOL_VERSIONS, a as createFetchWithInit, at as INTERNAL_ERROR, b as resolveInputRequiredDriverConfig, bt as checkResourceAllowed, c as STDIO_DEFAULT_MAX_BUFFER_SIZE, ct as JSONRPC_VERSION, d as getDisplayName, dt as METHOD_NOT_FOUND, et as modernProtocolVersions, f as isJsonContentType, ft as PARSE_ERROR, g as Protocol, gt as SUBSCRIPTION_ID_META_KEY, h as DEFAULT_REQUEST_TIMEOUT_MSEC, ht as SERVER_INFO_META_KEY, i as UriTemplate, it as DEFAULT_NEGOTIATED_PROTOCOL_VERSION, j as isInitializedNotification, jt as SdkHttpError, k as isCallToolResult, kt as SdkError, l as deserializeMessage, lt as LATEST_PROTOCOL_VERSION, m as runInputRequiredFlow, mt as RELATED_TASK_META_KEY, n as preloadSchemas, nt as CLIENT_CAPABILITIES_META_KEY, o as normalizeHeaders, ot as INVALID_PARAMS, p as mediaTypeEssence, pt as PROTOCOL_VERSION_META_KEY, q as ResourceNotFoundError, r as InMemoryTransport, rt as CLIENT_INFO_META_KEY, s as ReadBuffer, st as INVALID_REQUEST, t as fromJsonSchema$1, tt as BAGGAGE_META_KEY, u as serializeMessage, ut as LOG_LEVEL_META_KEY, v as isSpecType, vt as TRACEPARENT_META_KEY, w as buildMcpParamHeaders, wt as OAuthErrorResponseSchema, x as withInputRequired, xt as resourceUrlFromServerUrl, y as specTypeSchemas, yt as TRACESTATE_META_KEY, z as parseJSONRPCMessage } from "./src-D_zzAWoS.mjs";
+import { $ as legacyProtocolVersions, A as isInitializeRequest, At as SdkErrorCode, B as DiscoverResultSchema, C as mcpNameSource, Ct as OAuthClientInformationFullSchema, D as assertCompleteRequestPrompt, Dt as OAuthTokensSchema, E as scanXMcpHeaderDeclarations, Et as OAuthProtectedResourceMetadataSchema, F as isJSONRPCRequest, Ft as stampErrorBrands, G as MissingRequiredClientCapabilityError, H as ListChangedOptionsBaseSchema, I as isJSONRPCResponse, J as UnsupportedProtocolVersionError, K as ProtocolError, L as isJSONRPCResultResponse, M as isInputRequiredResult, Mt as OAuthError, N as isJSONRPCErrorResponse, Nt as OAuthErrorCode, O as assertCompleteRequestResourceTemplate, Ot as OpenIdProviderDiscoveryMetadataSchema, P as isJSONRPCNotification, Pt as brandedHasInstance, Q as isModernProtocolVersion, R as isTaskAugmentedRequestParams, S as HEADER_MISMATCH_ERROR_CODE, St as IdJagTokenExchangeResponseSchema, T as encodeMcpParamValue, Tt as OAuthMetadataSchema, U as MODERN_WIRE_REVISION, V as JSONRPCMessageSchema, W as codecForVersion, X as ProtocolErrorCode, Y as UrlElicitationRequiredError, Z as SUPPORTED_MODERN_PROTOCOL_VERSIONS, _ as isSpecType, _t as SUPPORTED_PROTOCOL_VERSIONS, a as createFetchWithInit, at as INTERNAL_ERROR, b as withInputRequired, bt as checkResourceAllowed, c as deserializeMessage, ct as JSONRPC_VERSION, d as isJsonContentType, dt as METHOD_NOT_FOUND, et as modernProtocolVersions, f as mediaTypeEssence, ft as PARSE_ERROR, g as mergeCapabilities, gt as SUBSCRIPTION_ID_META_KEY, h as Protocol, ht as SERVER_INFO_META_KEY, i as UriTemplate, it as DEFAULT_NEGOTIATED_PROTOCOL_VERSION, j as isInitializedNotification, jt as SdkHttpError, k as isCallToolResult, kt as SdkError, l as serializeMessage, lt as LATEST_PROTOCOL_VERSION, m as DEFAULT_REQUEST_TIMEOUT_MSEC, mt as RELATED_TASK_META_KEY, n as preloadSchemas, nt as CLIENT_CAPABILITIES_META_KEY, o as ReadBuffer, ot as INVALID_PARAMS, p as runInputRequiredFlow, pt as PROTOCOL_VERSION_META_KEY, q as ResourceNotFoundError, r as InMemoryTransport, rt as CLIENT_INFO_META_KEY, s as STDIO_DEFAULT_MAX_BUFFER_SIZE, st as INVALID_REQUEST, t as fromJsonSchema$1, tt as BAGGAGE_META_KEY, u as getDisplayName, ut as LOG_LEVEL_META_KEY, v as specTypeSchemas, vt as TRACEPARENT_META_KEY, w as buildMcpParamHeaders, wt as OAuthErrorResponseSchema, x as parseSchema, xt as resourceUrlFromServerUrl, y as resolveInputRequiredDriverConfig, yt as TRACESTATE_META_KEY, z as parseJSONRPCMessage } from "./src-DDAAhLnO.mjs";
 import { CORS_IS_POSSIBLE, DefaultJsonSchemaValidator } from "@modelcontextprotocol/client/_shims";
 import pkceChallenge from "pkce-challenge";
 import { EventSource } from "eventsource";
@@ -266,6 +266,12 @@ async function handleOAuthUnauthorized(provider, ctx, extraAuthOptions) {
 * not in scope. Providers that key storage on `ctx.issuer` MUST treat `ctx === undefined`
 * as "return the most-recently-saved token set" (the only consumer is the resource server
 * the token was minted for); providers that round-trip a single blob need no change.
+*
+* SEP-1932 (DPoP) note: DPoP request-signing is deliberately *not* done here. When the provider
+* implements {@linkcode OAuthClientProvider.dpop | dpop()}, the transports wrap their
+* resource-server `fetch` with {@linkcode withDpopFromProvider}, which upgrades the `Bearer` header
+* this adapter produces to `DPoP` + proof for DPoP-bound tokens and handles nonce challenges — at
+* the one layer that sees the real method, URL and response of every request.
 */
 function adaptOAuthProvider(provider, extraAuthOptions) {
 	return {
@@ -602,6 +608,17 @@ async function parseErrorResponse(input) {
 	}
 }
 /**
+* Recovering from a recoverable OAuth error discards stored credentials and silently starts a
+* fresh authorization. On a headless client whose `redirectToAuthorization()` is a no-op that
+* recovery is indistinguishable from nothing happening at all, so name the cause. The most
+* common case is `invalid_grant` — an expired, revoked, or rotation-reuse-detected refresh
+* token. See issue #2034.
+*/
+function warnCredentialInvalidation(provider, error, invalidated) {
+	const action = provider.invalidateCredentials === void 0 ? `retrying authorization without discarding the stored ${invalidated} (provider implements no invalidateCredentials())` : `invalidating the stored ${invalidated} and retrying authorization`;
+	console.warn(`[mcp-sdk] OAuth ${JSON.stringify(error.code)} — ${action}. Cause: ${JSON.stringify(error.message)}`);
+}
+/**
 * Orchestrates the full auth flow with a server.
 *
 * This can be used as a single entry point for all authorization functionality,
@@ -613,10 +630,12 @@ async function auth(provider, options) {
 	} catch (error) {
 		if (error instanceof OAuthError) {
 			if (error.code === OAuthErrorCode.InvalidClient || error.code === OAuthErrorCode.UnauthorizedClient) {
+				warnCredentialInvalidation(provider, error, "client credentials and tokens");
 				await provider.invalidateCredentials?.("client");
 				await provider.invalidateCredentials?.("tokens");
 				return await authInternal(provider, options);
-			} else if (error.code === OAuthErrorCode.InvalidGrant) {
+			} else if (error.code === OAuthErrorCode.InvalidGrant || error.code === OAuthErrorCode.InvalidDpopProof) {
+				warnCredentialInvalidation(provider, error, "tokens");
 				await provider.invalidateCredentials?.("tokens");
 				return await authInternal(provider, options);
 			}
@@ -687,8 +706,9 @@ async function authInternal(provider, { serverUrl, authorizationCode, iss, scope
 		} else if (!issuersMatch(recordedIssuer, issuer)) throw new AuthorizationServerMismatchError(recordedIssuer, issuer);
 	}
 	if (freshDiscoveryState) await provider.saveDiscoveryState?.(freshDiscoveryState);
-	const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-	if (resource) await provider.saveResourceUrl?.(String(resource));
+	const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+	const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
+	if (resource) await provider.saveResourceUrl?.(resourceIndicatorToString(resource));
 	const resolvedScope = determineScope({
 		requestedScope: scope,
 		resourceMetadata,
@@ -759,23 +779,30 @@ async function authInternal(provider, { serverUrl, authorizationCode, iss, scope
 		};
 		await provider.saveTokens(tokens, infoCtx);
 	}
-	if (tokens?.refresh_token && !forceReauthorization) try {
-		const newTokens = await refreshAuthorization(authorizationServerUrl, {
-			metadata,
-			clientInformation,
-			refreshToken: tokens.refresh_token,
-			resource,
-			addClientAuthentication: provider.addClientAuthentication,
-			fetchFn
-		});
-		await provider.saveTokens({
-			...newTokens,
-			issuer
-		}, infoCtx);
-		return "AUTHORIZED";
-	} catch (error) {
-		if (error instanceof InsecureTokenEndpointError) throw error;
-		if (!(error instanceof OAuthError) || error.code === OAuthErrorCode.ServerError) {} else throw error;
+	if (tokens?.refresh_token && !forceReauthorization) {
+		let newTokens;
+		try {
+			newTokens = await refreshAuthorization(authorizationServerUrl, {
+				metadata,
+				clientInformation,
+				refreshToken: tokens.refresh_token,
+				resource,
+				addClientAuthentication: provider.addClientAuthentication,
+				dpop: await provider.dpop?.(),
+				fetchFn
+			});
+		} catch (error) {
+			if (error instanceof InsecureTokenEndpointError) throw error;
+			if (!(error instanceof OAuthError) || error.code === OAuthErrorCode.ServerError) console.warn(`[mcp-sdk] Could not refresh OAuth tokens; falling back to a new authorization request. Cause: ${JSON.stringify(error instanceof Error ? error.message : String(error))}`);
+			else throw error;
+		}
+		if (newTokens) {
+			await provider.saveTokens({
+				...newTokens,
+				issuer
+			}, infoCtx);
+			return "AUTHORIZED";
+		}
 	}
 	const state = provider.state ? await provider.state() : void 0;
 	const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
@@ -819,6 +846,17 @@ function isHttpsUrl(value) {
 		return false;
 	}
 }
+/**
+* Selects the RFC 8707 resource indicator for an MCP server: the provider's
+* {@linkcode OAuthClientProvider.validateResourceURL | validateResourceURL} result when
+* implemented, otherwise the protected resource metadata's `resource` (checked against the
+* server URL with `checkResourceAllowed`), or `undefined` when there is no metadata.
+*
+* The result is a parsed `URL`, so a pathless indicator such as `https://example.com` has
+* the `href` `https://example.com/`. {@linkcode auth} therefore sends the metadata string
+* verbatim instead of this URL's `href` (#1968); callers that emit the `resource`
+* parameter themselves should do the same.
+*/
 async function selectResourceURL(serverUrl, provider, resourceMetadata) {
 	const defaultResource = resourceUrlFromServerUrl(serverUrl);
 	if (provider.validateResourceURL) return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
@@ -829,15 +867,22 @@ async function selectResourceURL(serverUrl, provider, resourceMetadata) {
 	})) throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
 	return new URL(resourceMetadata.resource);
 }
+/** Auth-scheme challenge tokens {@linkcode extractWWWAuthenticateParams} recognizes. */
+const RECOGNIZED_CHALLENGE_SCHEMES = new Set(["bearer", "dpop"]);
 /**
 * Extract `resource_metadata`, `scope`, `error`, and `error_description` from a
 * `WWW-Authenticate` header.
+*
+* Recognizes both the `Bearer` scheme (RFC 6750) and the `DPoP` scheme (RFC 9449 §7.1,
+* SEP-1932) — a DPoP-protected resource's challenge carries the same parameters under `DPoP`
+* instead of `Bearer`, and this must still surface `resource_metadata`/`scope` from it for
+* discovery and SEP-2350 step-up to work against such a resource.
 */
 function extractWWWAuthenticateParams(res) {
 	const authenticateHeader = res.headers.get("WWW-Authenticate");
 	if (!authenticateHeader) return {};
 	const [type, scheme] = authenticateHeader.split(" ");
-	if (type?.toLowerCase() !== "bearer" || !scheme) return {};
+	if (!type || !RECOGNIZED_CHALLENGE_SCHEMES.has(type.toLowerCase()) || !scheme) return {};
 	const resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0;
 	let resourceMetadataUrl;
 	if (resourceMetadataMatch) try {
@@ -1135,6 +1180,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
 		resourceMetadata
 	};
 }
+function resourceIndicatorToString(resource) {
+	return typeof resource === "string" ? resource : resource.href;
+}
 /**
 * Begins the authorization flow with the given server, by generating a PKCE challenge and constructing the authorization URL.
 */
@@ -1156,7 +1204,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
 	if (state) authorizationUrl.searchParams.set("state", state);
 	if (scope) authorizationUrl.searchParams.set("scope", scope);
 	if (scope?.split(" ").includes("offline_access")) authorizationUrl.searchParams.append("prompt", "consent");
-	if (resource) authorizationUrl.searchParams.set("resource", resource.href);
+	if (resource) authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
 	return {
 		authorizationUrl,
 		codeVerifier
@@ -1185,20 +1233,35 @@ function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redire
 * Internal helper to execute a token request with the given parameters.
 * Used by {@linkcode exchangeAuthorization}, {@linkcode refreshAuthorization}, and {@linkcode fetchToken}.
 */
-async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, dpop, fetchFn }) {
 	const tokenUrl = assertSecureTokenEndpoint(metadata?.token_endpoint ?? new URL("/token", authorizationServerUrl));
 	const headers = new Headers({
 		"Content-Type": "application/x-www-form-urlencoded",
 		Accept: "application/json"
 	});
-	if (resource) tokenRequestParams.set("resource", resource.href);
-	if (addClientAuthentication) await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
-	else if (clientInformation) applyClientAuthentication(selectClientAuthMethod(clientInformation, metadata?.token_endpoint_auth_methods_supported ?? []), clientInformation, headers, tokenRequestParams);
-	const response = await (fetchFn ?? fetch)(tokenUrl, {
-		method: "POST",
-		headers,
-		body: tokenRequestParams
-	});
+	if (resource) tokenRequestParams.set("resource", resourceIndicatorToString(resource));
+	if (!addClientAuthentication && clientInformation) applyClientAuthentication(selectClientAuthMethod(clientInformation, metadata?.token_endpoint_auth_methods_supported ?? []), clientInformation, headers, tokenRequestParams);
+	const requestOnce = async () => {
+		const requestHeaders = new Headers(headers);
+		if (addClientAuthentication) await addClientAuthentication(requestHeaders, tokenRequestParams, tokenUrl, metadata);
+		if (dpop) requestHeaders.set("DPoP", await dpop.buildProof({
+			htm: "POST",
+			htu: tokenUrl
+		}));
+		return (fetchFn ?? fetch)(tokenUrl, {
+			method: "POST",
+			headers: requestHeaders,
+			body: tokenRequestParams
+		});
+	};
+	let response = await requestOnce();
+	if (dpop && response.status === 400) {
+		if ((await response.clone().json().catch(() => {}))?.error === OAuthErrorCode.UseDpopNonce) {
+			dpop.observeNonce(response, tokenUrl);
+			response = await requestOnce();
+		}
+	}
+	dpop?.observeNonce(response, tokenUrl);
 	if (!response.ok) throw await parseErrorResponse(response);
 	const json = await response.json();
 	try {
@@ -1220,7 +1283,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
 * @returns Promise resolving to OAuth tokens
 * @throws {Error} When token exchange fails or authentication is invalid
 */
-async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, iss, codeVerifier, redirectUri, resource, addClientAuthentication, fetchFn }) {
+async function exchangeAuthorization(authorizationServerUrl, { metadata, clientInformation, authorizationCode, iss, codeVerifier, redirectUri, resource, addClientAuthentication, dpop, fetchFn }) {
 	validateAuthorizationResponseIssuer({
 		iss,
 		expectedIssuer: metadata?.issuer,
@@ -1232,6 +1295,7 @@ async function exchangeAuthorization(authorizationServerUrl, { metadata, clientI
 		clientInformation,
 		addClientAuthentication,
 		resource,
+		dpop,
 		fetchFn
 	});
 }
@@ -1247,7 +1311,7 @@ async function exchangeAuthorization(authorizationServerUrl, { metadata, clientI
 * @returns Promise resolving to OAuth tokens (preserves original `refresh_token` if not replaced)
 * @throws {Error} When token refresh fails or authentication is invalid
 */
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, dpop, fetchFn }) {
 	return {
 		refresh_token: refreshToken,
 		...await executeTokenRequest(authorizationServerUrl, {
@@ -1259,6 +1323,7 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
 			clientInformation,
 			addClientAuthentication,
 			resource,
+			dpop,
 			fetchFn
 		})
 	};
@@ -1311,6 +1376,7 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
 		clientInformation: clientInformation ?? void 0,
 		addClientAuthentication: provider.addClientAuthentication,
 		resource,
+		dpop: await provider.dpop?.(),
 		fetchFn
 	});
 }
@@ -2397,7 +2463,7 @@ function classifyNetworkError(error, context) {
 	if (context.environment === "browser" && isOpaqueFetchTypeError(error)) return { kind: "legacy" };
 	return {
 		kind: "error",
-		error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error)}`, { cause: error })
+		error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error)}`, { cause: error }, { cause: error })
 	};
 }
 function isOpaqueFetchTypeError(error) {
@@ -4428,6 +4494,160 @@ async function exchangeJwtAuthGrant(options) {
 	return parseResult.data;
 }
 
+//#endregion
+//#region src/client/dpop.ts
+/** Asymmetric JWS algorithms usable for a DPoP proof (RFC 9449 §11.6 forbids symmetric algs and `none`). */
+const DPOP_SUPPORTED_ALGS = [
+	"ES256",
+	"ES384",
+	"ES512",
+	"RS256",
+	"RS384",
+	"RS512",
+	"PS256",
+	"PS384",
+	"PS512",
+	"EdDSA"
+];
+const DEFAULT_DPOP_ALG = "ES256";
+const DPOP_TYP = "dpop+jwt";
+async function importJose() {
+	if (globalThis.crypto === void 0) throw new TypeError("crypto is not available, please ensure you have Web Crypto API support for older Node.js versions (see https://github.com/modelcontextprotocol/typescript-sdk#nodejs-web-crypto-globalthiscrypto-compatibility)");
+	return import("jose");
+}
+/** Generate an asymmetric DPoP signing key pair. Non-extractable by default (RFC 9449 §11). */
+async function generateDpopKeyPair(options = {}) {
+	const alg = options.alg ?? DEFAULT_DPOP_ALG;
+	const jose = await importJose();
+	const { publicKey, privateKey } = await jose.generateKeyPair(alg, { extractable: options.extractable ?? false });
+	const publicJwk = await jose.exportJWK(publicKey);
+	return {
+		privateKey,
+		publicKey,
+		publicJwk,
+		thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+		alg
+	};
+}
+/**
+* Compute the `ath` claim for a DPoP proof presented alongside an access token: the
+* base64url-encoded SHA-256 digest of the ASCII access-token value (RFC 9449 §4.1).
+*
+* Uses Web Crypto (`crypto.subtle`) rather than a Node-only hashing API so this stays usable
+* in browser and edge runtimes.
+*/
+async function accessTokenHash(accessToken) {
+	if (globalThis.crypto?.subtle === void 0) throw new TypeError("crypto.subtle is not available, please ensure you have Web Crypto API support for older Node.js versions (see https://github.com/modelcontextprotocol/typescript-sdk#nodejs-web-crypto-globalthiscrypto-compatibility)");
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(accessToken));
+	return base64UrlEncode(new Uint8Array(digest));
+}
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+/** Strip the query and fragment from a URL, per RFC 9449 §4.2 (`htu` MUST NOT contain either). */
+function stripQueryAndFragment(url) {
+	const u = new URL(url.toString());
+	return `${u.origin}${u.pathname}`;
+}
+/** A fresh, cryptographically random `jti` (RFC 9449 §4.2 — MUST be unique per proof). */
+function randomJti() {
+	const bytes = new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return base64UrlEncode(bytes);
+}
+/**
+* A DPoP signing identity plus the small amount of state RFC 9449 requires across requests:
+* the key pair and, per origin, the most recently server-supplied nonce (RFC 9449 §8/§9).
+*
+* One `DpopSession` is meant to live for the lifetime of a single OAuth client registration —
+* the token endpoint and the resource server are different origins and get independent nonce
+* slots, so a nonce challenge from one never leaks into proofs sent to the other.
+*/
+var DpopSession = class DpopSession {
+	nonces = /* @__PURE__ */ new Map();
+	constructor(keyPair) {
+		this.keyPair = keyPair;
+	}
+	/** Create a session with a fresh key pair, or reuse a caller-supplied one. */
+	static async create(options = {}) {
+		return new DpopSession(options.keyPair ?? await generateDpopKeyPair({ alg: options.alg }));
+	}
+	/** RFC 7638 JWK SHA-256 thumbprint of the signing key — matches the token's `cnf.jkt` once bound. */
+	get thumbprint() {
+		return this.keyPair.thumbprint;
+	}
+	/** The JWS algorithm this session signs proofs with. */
+	get alg() {
+		return this.keyPair.alg;
+	}
+	/** The public JWK embedded in every proof's `jwk` header parameter. */
+	get publicJwk() {
+		return this.keyPair.publicJwk;
+	}
+	/** The remembered nonce for `url`'s origin, if the server has issued one (RFC 9449 §8/§9). */
+	nonceFor(url) {
+		return this.nonces.get(new URL(url.toString()).origin);
+	}
+	/** Record a server-supplied nonce for `url`'s origin (newest-wins, RFC 9449 §8.2). */
+	rememberNonce(url, nonce) {
+		this.nonces.set(new URL(url.toString()).origin, nonce);
+	}
+	/**
+	* Capture a `DPoP-Nonce` response header, if present, for `url`'s origin. RFC 9449 §8.2 says a
+	* fresh nonce may ride on *any* response (success or failure), so call this unconditionally
+	* after every request, not only on a `use_dpop_nonce` challenge.
+	*/
+	observeNonce(response, url) {
+		const nonce = response.headers.get("dpop-nonce");
+		if (nonce) this.rememberNonce(url, nonce);
+	}
+	/**
+	* Build a fresh DPoP proof JWT. Always mints a new `jti` — proofs are never cached or reused,
+	* since RFC 9449 §4.3 step 9 requires each to be presented at most once.
+	*/
+	async buildProof(request) {
+		const jose = await importJose();
+		const htu = stripQueryAndFragment(request.htu);
+		const nonce = request.nonce ?? this.nonceFor(request.htu);
+		const payload = {
+			jti: randomJti(),
+			htm: request.htm.toUpperCase(),
+			htu,
+			iat: Math.floor(Date.now() / 1e3)
+		};
+		if (request.accessToken !== void 0) payload.ath = await accessTokenHash(request.accessToken);
+		if (nonce !== void 0) payload.nonce = nonce;
+		return new jose.SignJWT(payload).setProtectedHeader({
+			alg: this.keyPair.alg,
+			typ: DPOP_TYP,
+			jwk: this.keyPair.publicJwk
+		}).sign(this.keyPair.privateKey);
+	}
+};
+/**
+* Whether `wwwAuthenticate` advertises a `DPoP` auth-scheme challenge (matched at the start of the
+* header or after a comma, per RFC 9110 §11.6.1 — a server may list several schemes together, e.g.
+* `Bearer …, DPoP …`).
+*/
+function hasDpopChallenge(wwwAuthenticate) {
+	return /(?:^|,)\s*dpop(?:\s|$|,)/i.test(wwwAuthenticate);
+}
+/**
+* Whether `response` is a resource-server `use_dpop_nonce` challenge (RFC 9449 §9): a `401` whose
+* `WWW-Authenticate` header carries a `DPoP` challenge with `error="use_dpop_nonce"`.
+*
+* A conformant retry re-signs the proof with the nonce {@linkcode DpopSession.observeNonce} just
+* captured — never resend the original proof: RFC 9449 §4.2 requires a unique `jti` per proof, and
+* replaying one across the challenge/retry boundary is itself a violation.
+*/
+function isDpopNonceChallenge(response) {
+	if (response.status !== 401) return false;
+	const wwwAuthenticate = response.headers.get("www-authenticate") ?? "";
+	return hasDpopChallenge(wwwAuthenticate) && /use_dpop_nonce/i.test(wwwAuthenticate);
+}
+
 //#endregion
 //#region src/client/middleware.ts
 /**
@@ -4438,6 +4658,10 @@ async function exchangeJwtAuthGrant(options) {
 * - Handle 401 responses by attempting re-authentication
 * - Retry the original request after successful auth
 * - Handle OAuth errors appropriately ({@linkcode index.OAuthErrorCode.InvalidClient | OAuthErrorCode.InvalidClient}, etc.)
+* - When {@linkcode OAuthClientProvider.dpop | provider.dpop()} is implemented, present DPoP-bound
+*   tokens with the `DPoP` scheme plus a per-request proof (RFC 9449 / SEP-1932) by composing
+*   {@linkcode withDpopFromProvider} underneath — so a `use_dpop_nonce` challenge is retried
+*   inline on every attempt, independently of the single re-authentication retry here
 *
 * The `baseUrl` parameter is optional and defaults to using the domain from the request URL.
 * However, you should explicitly provide `baseUrl` when:
@@ -4456,7 +4680,8 @@ async function exchangeJwtAuthGrant(options) {
 * @param baseUrl - Base URL for OAuth server discovery (defaults to request URL domain)
 * @returns A fetch middleware function
 */
-const withOAuth = (provider, baseUrl) => (next) => {
+const withOAuth = (provider, baseUrl) => (baseNext) => {
+	const next = provider.dpop ? withDpopFromProvider(provider)(baseNext) : baseNext;
 	return async (input, init) => {
 		const makeRequest = async () => {
 			const headers = new Headers(init?.headers);
@@ -4474,7 +4699,7 @@ const withOAuth = (provider, baseUrl) => (next) => {
 				serverUrl: baseUrl || (typeof input === "string" ? new URL(input).origin : input.origin),
 				resourceMetadataUrl,
 				scope,
-				fetchFn: next
+				fetchFn: baseNext
 			});
 			if (result === "REDIRECT") throw new UnauthorizedError("Authentication requires user authorization - redirect initiated");
 			if (result !== "AUTHORIZED") throw new UnauthorizedError(`Authentication failed with result: ${result}`);
@@ -4488,6 +4713,90 @@ const withOAuth = (provider, baseUrl) => (next) => {
 	};
 };
 /**
+* Creates a fetch wrapper that presents an access token using the `DPoP` Authorization scheme
+* (RFC 9449 / SEP-1932) instead of `Bearer`: every request carries `Authorization: DPoP <token>`
+* plus a fresh `DPoP` proof bound to that request's method and URL, a resource-server
+* `use_dpop_nonce` challenge (RFC 9449 §9) is retried once, inline, with the server-supplied nonce,
+* and a `DPoP-Nonce` delivered on any response is remembered for the next proof (RFC 9449 §8.2).
+*
+* Because it wraps `fetch` itself, the proof is always bound to the request actually sent and every
+* response is observed — which is why the MCP transports apply this wrapper internally (via
+* {@linkcode withDpopFromProvider}) when their `authProvider` implements
+* {@linkcode OAuthClientProvider.dpop | dpop()}, rather than threading request context through
+* {@linkcode AuthProvider}.
+*
+* Use this directly when you already manage the access token yourself (a non-OAuth token source,
+* or credentials obtained out-of-band) and only need DPoP's request-signing behavior — e.g.
+* `fetch: withDpop(session, getToken)(fetch)` alongside a minimal `authProvider: { token }`.
+*
+* @param session - The DPoP signing session (key pair + nonce state), or a function resolving to
+*   it. Reuse the same session across requests to the same server so its nonce state persists.
+*   When the function resolves to `undefined` the request passes through unchanged.
+* @param getToken - Returns the current access token, or `undefined` if none is available (the
+*   request passes through unchanged — any `Authorization` header already on it is left as is).
+* @returns A fetch middleware function
+*/
+const withDpop = (session, getToken) => (next) => {
+	const resolveSession = typeof session === "function" ? session : () => session;
+	return async (input, init) => {
+		const method = (init?.method ?? "GET").toUpperCase();
+		const url = new URL(input.toString());
+		const activeSession = await resolveSession();
+		if (!activeSession) return next(input, init);
+		const makeRequest = async () => {
+			const accessToken = await getToken();
+			if (!accessToken) return next(input, init);
+			const headers = new Headers(init?.headers);
+			const proof = await activeSession.buildProof({
+				htm: method,
+				htu: url,
+				accessToken
+			});
+			headers.set("Authorization", `DPoP ${accessToken}`);
+			headers.set("DPoP", proof);
+			return next(input, {
+				...init,
+				headers
+			});
+		};
+		let response = await makeRequest();
+		if (isDpopNonceChallenge(response) && response.headers.has("dpop-nonce")) {
+			activeSession.observeNonce(response, url);
+			await response.text?.().catch(() => {});
+			response = await makeRequest();
+		}
+		activeSession.observeNonce(response, url);
+		return response;
+	};
+};
+/**
+* {@linkcode withDpop} driven by an {@linkcode OAuthClientProvider}: the session comes from
+* {@linkcode OAuthClientProvider.dpop | provider.dpop()} and the token from
+* {@linkcode OAuthClientProvider.tokens | provider.tokens()} — presented with the DPoP scheme only
+* when the AS actually issued `token_type: "DPoP"` (RFC 9449 §7.1); a Bearer token passes through
+* untouched.
+*
+* This is what the MCP transports and {@linkcode withOAuth} compose internally when the provider
+* implements `dpop()`. Use it directly only when building your own fetch pipeline around an
+* `OAuthClientProvider` (e.g. a custom re-authorization middleware) — place it *innermost*, below
+* whatever sets `Authorization: Bearer` and handles 401 re-authentication.
+*/
+const withDpopFromProvider = (provider) => withDpop(async () => {
+	try {
+		return await provider.dpop?.();
+	} catch (error) {
+		throw markAuthSeamEscape(error);
+	}
+}, async () => {
+	let tokens;
+	try {
+		tokens = await provider.tokens();
+	} catch (error) {
+		throw markAuthSeamEscape(error);
+	}
+	return tokens?.token_type?.toLowerCase() === "dpop" ? tokens.access_token : void 0;
+});
+/**
 * Creates a fetch middleware that logs HTTP requests and responses.
 *
 * When called without arguments `withLogging()`, it uses the default logger that:
@@ -4685,6 +4994,7 @@ var SSEClientTransport = class {
 	_skipIssuerMetadataValidation;
 	_fetch;
 	_fetchWithInit;
+	_dpop;
 	_protocolVersion;
 	onclose;
 	onerror;
@@ -4696,32 +5006,33 @@ var SSEClientTransport = class {
 		this._eventSourceInit = opts?.eventSourceInit;
 		this._requestInit = opts?.requestInit;
 		this._skipIssuerMetadataValidation = opts?.skipIssuerMetadataValidation;
+		this._fetch = opts?.fetch;
 		if (isOAuthClientProvider(opts?.authProvider)) {
 			this._oauthProvider = opts.authProvider;
 			this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
+			if (opts.authProvider.dpop) {
+				this._dpop = withDpopFromProvider(opts.authProvider);
+				this._fetch = this._dpop(opts.fetch ?? fetch);
+			}
 		} else this._authProvider = opts?.authProvider;
-		this._fetch = opts?.fetch;
 		this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
 	}
 	_last401Response;
 	async _commonHeaders() {
-		const headers = {};
+		const headers = new Headers(this._requestInit?.headers || void 0);
 		let token;
 		try {
 			token = await this._authProvider?.token();
 		} catch (error) {
 			throw markAuthSeamEscape(error);
 		}
-		if (token) headers["Authorization"] = `Bearer ${token}`;
-		if (this._protocolVersion) headers["mcp-protocol-version"] = this._protocolVersion;
-		const extraHeaders = normalizeHeaders(this._requestInit?.headers);
-		return new Headers({
-			...headers,
-			...extraHeaders
-		});
+		if (token) headers.set("Authorization", `Bearer ${token}`);
+		if (this._protocolVersion) headers.set("mcp-protocol-version", this._protocolVersion);
+		return headers;
 	}
 	_startOrAuth() {
-		const fetchImpl = this?._eventSourceInit?.fetch ?? this._fetch ?? fetch;
+		const eventSourceFetch = this._eventSourceInit?.fetch;
+		const fetchImpl = eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch;
 		return new Promise((resolve, reject) => {
 			this._eventSource = new EventSource(this._url.href, {
 				...this._eventSourceInit,
@@ -4899,6 +5210,7 @@ const DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
 */
 const RESERVED_REQUEST_HEADER_NAMES = new Set([
 	"authorization",
+	"dpop",
 	"content-type",
 	"mcp-protocol-version",
 	"mcp-method",
@@ -4974,11 +5286,12 @@ var StreamableHTTPClientTransport = class {
 		this._scope = void 0;
 		this._requestInit = opts?.requestInit;
 		this._skipIssuerMetadataValidation = opts?.skipIssuerMetadataValidation;
+		this._fetch = opts?.fetch;
 		if (isOAuthClientProvider(opts?.authProvider)) {
 			this._oauthProvider = opts.authProvider;
 			this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
+			if (opts.authProvider.dpop) this._fetch = withDpopFromProvider(opts.authProvider)(opts.fetch ?? fetch);
 		} else this._authProvider = opts?.authProvider;
-		this._fetch = opts?.fetch;
 		this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
 		this._sessionId = opts?.sessionId;
 		this._protocolVersion = opts?.protocolVersion;
@@ -5032,21 +5345,17 @@ var StreamableHTTPClientTransport = class {
 		});
 	}
 	async _commonHeaders() {
-		const headers = {};
+		const headers = new Headers(this._requestInit?.headers || void 0);
 		let token;
 		try {
 			token = await this._authProvider?.token();
 		} catch (error) {
 			throw markAuthSeamEscape(error);
 		}
-		if (token) headers["Authorization"] = `Bearer ${token}`;
-		if (this._sessionId) headers["mcp-session-id"] = this._sessionId;
-		if (this._protocolVersion) headers["mcp-protocol-version"] = this._protocolVersion;
-		const extraHeaders = normalizeHeaders(this._requestInit?.headers);
-		return new Headers({
-			...headers,
-			...extraHeaders
-		});
+		if (token) headers.set("Authorization", `Bearer ${token}`);
+		if (this._sessionId) headers.set("mcp-session-id", this._sessionId);
+		if (this._protocolVersion) headers.set("mcp-protocol-version", this._protocolVersion);
+		return headers;
 	}
 	/**
 	* Body-derived per-request headers: when an outgoing request carries a
@@ -5062,9 +5371,8 @@ var StreamableHTTPClientTransport = class {
 		if (typeof envelopeVersion !== "string") return;
 		headers.set("mcp-protocol-version", envelopeVersion);
 		headers.set("mcp-method", message.method);
-		const params = message.params;
-		const nameHeader = message.method === "resources/read" ? typeof params?.uri === "string" ? params.uri : void 0 : typeof params?.name === "string" ? params.name : void 0;
-		if (nameHeader !== void 0) headers.set("mcp-name", encodeMcpParamValue(nameHeader));
+		const source = mcpNameSource(message.method, message.params);
+		if (source?.value !== void 0) headers.set("mcp-name", encodeMcpParamValue(source.value));
 	}
 	/**
 	* `true` when the outbound message is a single request carrying a
@@ -5477,5 +5785,5 @@ function fromJsonSchema(schema, validator) {
 }
 
 //#endregion
-export { AuthorizationServerMismatchError, BAGGAGE_META_KEY, CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, Client, ClientCredentialsProvider, CrossAppAccessProvider, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, DEFAULT_REQUEST_TIMEOUT_MSEC, INTERNAL_ERROR, INVALID_PARAMS, INVALID_REQUEST, InMemoryResponseCacheStore, InMemoryTransport, InsecureTokenEndpointError, InsufficientScopeError, IssuerMismatchError, JSONRPC_VERSION, LATEST_PROTOCOL_VERSION, LOG_LEVEL_META_KEY, MAX_CACHE_TTL_MS, METHOD_NOT_FOUND, MissingRequiredClientCapabilityError, OAuthClientFlowError, OAuthError, OAuthErrorCode, PARSE_ERROR, PROTOCOL_VERSION_META_KEY, PrivateKeyJwtProvider, Protocol, ProtocolError, ProtocolErrorCode, RELATED_TASK_META_KEY, ReadBuffer, RegistrationRejectedError, ResourceNotFoundError, SERVER_INFO_META_KEY, SSEClientTransport, STDIO_DEFAULT_MAX_BUFFER_SIZE, SUBSCRIPTION_ID_META_KEY, SUPPORTED_PROTOCOL_VERSIONS, SdkError, SdkErrorCode, SdkHttpError, SseError, StaticPrivateKeyJwtProvider, StreamableHTTPClientTransport, TRACEPARENT_META_KEY, TRACESTATE_META_KEY, UnauthorizedError, UnsupportedProtocolVersionError, UriTemplate, UrlElicitationRequiredError, applyMiddlewares, assertCompleteRequestPrompt, assertCompleteRequestResourceTemplate, assertSecureTokenEndpoint, auth, buildDiscoveryUrls, checkResourceAllowed, computeScopeUnion, createFetchWithInit, createMiddleware, createPrivateKeyJwtAuth, deserializeMessage, discoverAndRequestJwtAuthGrant, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, discoverOAuthServerInfo, exchangeAuthorization, exchangeJwtAuthGrant, extractResourceMetadataUrl, extractWWWAuthenticateParams, fetchToken, fromJsonSchema, getDisplayName, getSupportedElicitationModes, isCallToolResult, isHttpsUrl, isInitializeRequest, isInitializedNotification, isInputRequiredResult, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResponse, isJSONRPCResultResponse, isJsonContentType, isSpecType, isStrictScopeSuperset, isTaskAugmentedRequestParams, mergeCapabilities, parseErrorResponse, parseJSONRPCMessage, preloadSchemas, prepareAuthorizationCodeRequest, refreshAuthorization, registerClient, requestJwtAuthorizationGrant, resolveClientMetadata, resourceUrlFromServerUrl, selectClientAuthMethod, selectResourceURL, serializeMessage, specTypeSchemas, startAuthorization, validateAuthorizationResponseIssuer, validateClientMetadataUrl, withInputRequired, withLogging, withOAuth };
+export { AuthorizationServerMismatchError, BAGGAGE_META_KEY, CLIENT_CAPABILITIES_META_KEY, CLIENT_INFO_META_KEY, Client, ClientCredentialsProvider, CrossAppAccessProvider, DEFAULT_NEGOTIATED_PROTOCOL_VERSION, DEFAULT_REQUEST_TIMEOUT_MSEC, DPOP_SUPPORTED_ALGS, DpopSession, INTERNAL_ERROR, INVALID_PARAMS, INVALID_REQUEST, InMemoryResponseCacheStore, InMemoryTransport, InsecureTokenEndpointError, InsufficientScopeError, IssuerMismatchError, JSONRPC_VERSION, LATEST_PROTOCOL_VERSION, LOG_LEVEL_META_KEY, MAX_CACHE_TTL_MS, METHOD_NOT_FOUND, MissingRequiredClientCapabilityError, OAuthClientFlowError, OAuthError, OAuthErrorCode, PARSE_ERROR, PROTOCOL_VERSION_META_KEY, PrivateKeyJwtProvider, Protocol, ProtocolError, ProtocolErrorCode, RELATED_TASK_META_KEY, ReadBuffer, RegistrationRejectedError, ResourceNotFoundError, SERVER_INFO_META_KEY, SSEClientTransport, STDIO_DEFAULT_MAX_BUFFER_SIZE, SUBSCRIPTION_ID_META_KEY, SUPPORTED_PROTOCOL_VERSIONS, SdkError, SdkErrorCode, SdkHttpError, SseError, StaticPrivateKeyJwtProvider, StreamableHTTPClientTransport, TRACEPARENT_META_KEY, TRACESTATE_META_KEY, UnauthorizedError, UnsupportedProtocolVersionError, UriTemplate, UrlElicitationRequiredError, accessTokenHash, applyMiddlewares, assertCompleteRequestPrompt, assertCompleteRequestResourceTemplate, assertSecureTokenEndpoint, auth, buildDiscoveryUrls, checkResourceAllowed, computeScopeUnion, createFetchWithInit, createMiddleware, createPrivateKeyJwtAuth, deserializeMessage, discoverAndRequestJwtAuthGrant, discoverAuthorizationServerMetadata, discoverOAuthMetadata, discoverOAuthProtectedResourceMetadata, discoverOAuthServerInfo, exchangeAuthorization, exchangeJwtAuthGrant, extractResourceMetadataUrl, extractWWWAuthenticateParams, fetchToken, fromJsonSchema, generateDpopKeyPair, getDisplayName, getSupportedElicitationModes, isCallToolResult, isDpopNonceChallenge, isHttpsUrl, isInitializeRequest, isInitializedNotification, isInputRequiredResult, isJSONRPCErrorResponse, isJSONRPCNotification, isJSONRPCRequest, isJSONRPCResponse, isJSONRPCResultResponse, isJsonContentType, isSpecType, isStrictScopeSuperset, isTaskAugmentedRequestParams, mergeCapabilities, parseErrorResponse, parseJSONRPCMessage, preloadSchemas, prepareAuthorizationCodeRequest, refreshAuthorization, registerClient, requestJwtAuthorizationGrant, resolveClientMetadata, resourceUrlFromServerUrl, selectClientAuthMethod, selectResourceURL, serializeMessage, specTypeSchemas, startAuthorization, validateAuthorizationResponseIssuer, validateClientMetadataUrl, withDpop, withDpopFromProvider, withInputRequired, withLogging, withOAuth };
 //# sourceMappingURL=index.mjs.map