mcp-use 1.6.3-canary.0 → 1.7.0-canary.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (74) hide show
  1. package/dist/.tsbuildinfo +1 -1
  2. package/dist/chunk-JQKKMUCT.js +0 -0
  3. package/dist/chunk-PE7UMCVO.js +377 -0
  4. package/dist/{chunk-BWOTID2D.js → chunk-QSLJXXMG.js} +3 -346
  5. package/dist/chunk-R5DJJ4IV.js +942 -0
  6. package/dist/{chunk-SJEHVCPM.js → chunk-XN2PU4PS.js} +100 -23
  7. package/dist/index.cjs +132 -29
  8. package/dist/index.js +8 -5
  9. package/dist/oauth-CNGBFOZW.js +29 -0
  10. package/dist/src/agents/index.js +1 -1
  11. package/dist/src/auth/browser-provider.d.ts +2 -0
  12. package/dist/src/auth/browser-provider.d.ts.map +1 -1
  13. package/dist/src/auth/callback.d.ts.map +1 -1
  14. package/dist/src/auth/index.cjs +396 -0
  15. package/dist/src/auth/index.js +10 -0
  16. package/dist/src/auth/types.d.ts +3 -1
  17. package/dist/src/auth/types.d.ts.map +1 -1
  18. package/dist/src/browser.cjs +36 -8
  19. package/dist/src/browser.js +6 -4
  20. package/dist/src/connectors/http.d.ts.map +1 -1
  21. package/dist/src/react/index.cjs +132 -29
  22. package/dist/src/react/index.js +3 -2
  23. package/dist/src/react/types.d.ts +12 -1
  24. package/dist/src/react/types.d.ts.map +1 -1
  25. package/dist/src/react/useMcp.d.ts.map +1 -1
  26. package/dist/src/server/context-storage.d.ts +54 -0
  27. package/dist/src/server/context-storage.d.ts.map +1 -0
  28. package/dist/src/server/index.cjs +1409 -410
  29. package/dist/src/server/index.d.ts +4 -1
  30. package/dist/src/server/index.d.ts.map +1 -1
  31. package/dist/src/server/index.js +420 -412
  32. package/dist/src/server/mcp-server.d.ts +50 -81
  33. package/dist/src/server/mcp-server.d.ts.map +1 -1
  34. package/dist/src/server/oauth/index.d.ts +13 -0
  35. package/dist/src/server/oauth/index.d.ts.map +1 -0
  36. package/dist/src/server/oauth/middleware.d.ts +19 -0
  37. package/dist/src/server/oauth/middleware.d.ts.map +1 -0
  38. package/dist/src/server/oauth/providers/auth0.d.ts +22 -0
  39. package/dist/src/server/oauth/providers/auth0.d.ts.map +1 -0
  40. package/dist/src/server/oauth/providers/custom.d.ts +19 -0
  41. package/dist/src/server/oauth/providers/custom.d.ts.map +1 -0
  42. package/dist/src/server/oauth/providers/keycloak.d.ts +22 -0
  43. package/dist/src/server/oauth/providers/keycloak.d.ts.map +1 -0
  44. package/dist/src/server/oauth/providers/supabase.d.ts +24 -0
  45. package/dist/src/server/oauth/providers/supabase.d.ts.map +1 -0
  46. package/dist/src/server/oauth/providers/types.d.ts +138 -0
  47. package/dist/src/server/oauth/providers/types.d.ts.map +1 -0
  48. package/dist/src/server/oauth/providers/workos.d.ts +30 -0
  49. package/dist/src/server/oauth/providers/workos.d.ts.map +1 -0
  50. package/dist/src/server/oauth/providers.d.ts +208 -0
  51. package/dist/src/server/oauth/providers.d.ts.map +1 -0
  52. package/dist/src/server/oauth/routes.d.ts +33 -0
  53. package/dist/src/server/oauth/routes.d.ts.map +1 -0
  54. package/dist/src/server/oauth/utils.d.ts +155 -0
  55. package/dist/src/server/oauth/utils.d.ts.map +1 -0
  56. package/dist/src/server/types/common.d.ts +47 -0
  57. package/dist/src/server/types/common.d.ts.map +1 -1
  58. package/dist/src/server/types/context.d.ts +34 -0
  59. package/dist/src/server/types/context.d.ts.map +1 -0
  60. package/dist/src/server/types/index.d.ts +2 -1
  61. package/dist/src/server/types/index.d.ts.map +1 -1
  62. package/dist/src/server/types/tool.d.ts +82 -9
  63. package/dist/src/server/types/tool.d.ts.map +1 -1
  64. package/dist/src/server/utils/index.d.ts +6 -0
  65. package/dist/src/server/utils/index.d.ts.map +1 -0
  66. package/dist/src/server/utils/response-helpers.d.ts +151 -0
  67. package/dist/src/server/utils/response-helpers.d.ts.map +1 -0
  68. package/dist/src/server/utils/runtime.d.ts +25 -0
  69. package/dist/src/server/utils/runtime.d.ts.map +1 -0
  70. package/dist/src/task_managers/streamable_http.d.ts +1 -0
  71. package/dist/src/task_managers/streamable_http.d.ts.map +1 -1
  72. package/dist/tsup.config.d.ts.map +1 -1
  73. package/package.json +14 -5
  74. /package/dist/{chunk-MCF5P6GJ.js → chunk-GVVPUU5K.js} +0 -0
@@ -0,0 +1,396 @@
1
+ "use strict";
2
+ var __defProp = Object.defineProperty;
3
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4
+ var __getOwnPropNames = Object.getOwnPropertyNames;
5
+ var __hasOwnProp = Object.prototype.hasOwnProperty;
6
+ var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
7
+ var __export = (target, all) => {
8
+ for (var name in all)
9
+ __defProp(target, name, { get: all[name], enumerable: true });
10
+ };
11
+ var __copyProps = (to, from, except, desc) => {
12
+ if (from && typeof from === "object" || typeof from === "function") {
13
+ for (let key of __getOwnPropNames(from))
14
+ if (!__hasOwnProp.call(to, key) && key !== except)
15
+ __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
16
+ }
17
+ return to;
18
+ };
19
+ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
20
+
21
+ // src/auth/index.ts
22
+ var auth_exports = {};
23
+ __export(auth_exports, {
24
+ BrowserOAuthClientProvider: () => BrowserOAuthClientProvider,
25
+ onMcpAuthorization: () => onMcpAuthorization
26
+ });
27
+ module.exports = __toCommonJS(auth_exports);
28
+
29
+ // src/auth/browser-provider.ts
30
+ var import_strict_url_sanitise = require("strict-url-sanitise");
31
+ var BrowserOAuthClientProvider = class {
32
+ static {
33
+ __name(this, "BrowserOAuthClientProvider");
34
+ }
35
+ serverUrl;
36
+ storageKeyPrefix;
37
+ serverUrlHash;
38
+ clientName;
39
+ clientUri;
40
+ callbackUrl;
41
+ preventAutoAuth;
42
+ useRedirectFlow;
43
+ onPopupWindow;
44
+ constructor(serverUrl, options = {}) {
45
+ this.serverUrl = serverUrl;
46
+ this.storageKeyPrefix = options.storageKeyPrefix || "mcp:auth";
47
+ this.serverUrlHash = this.hashString(serverUrl);
48
+ this.clientName = options.clientName || "mcp-use";
49
+ this.clientUri = options.clientUri || (typeof window !== "undefined" ? window.location.origin : "");
50
+ this.callbackUrl = (0, import_strict_url_sanitise.sanitizeUrl)(
51
+ options.callbackUrl || (typeof window !== "undefined" ? new URL("/oauth/callback", window.location.origin).toString() : "/oauth/callback")
52
+ );
53
+ this.preventAutoAuth = options.preventAutoAuth;
54
+ this.useRedirectFlow = options.useRedirectFlow;
55
+ this.onPopupWindow = options.onPopupWindow;
56
+ }
57
+ // --- SDK Interface Methods ---
58
+ get redirectUrl() {
59
+ return (0, import_strict_url_sanitise.sanitizeUrl)(this.callbackUrl);
60
+ }
61
+ get clientMetadata() {
62
+ return {
63
+ redirect_uris: [this.redirectUrl],
64
+ token_endpoint_auth_method: "none",
65
+ // Public client
66
+ grant_types: ["authorization_code", "refresh_token"],
67
+ response_types: ["code"],
68
+ client_name: this.clientName,
69
+ client_uri: this.clientUri
70
+ // scope: 'openid profile email mcp', // Example scopes, adjust as needed
71
+ };
72
+ }
73
+ async clientInformation() {
74
+ const key = this.getKey("client_info");
75
+ const data = localStorage.getItem(key);
76
+ if (!data) return void 0;
77
+ try {
78
+ return JSON.parse(data);
79
+ } catch (e) {
80
+ console.warn(
81
+ `[${this.storageKeyPrefix}] Failed to parse client information:`,
82
+ e
83
+ );
84
+ localStorage.removeItem(key);
85
+ return void 0;
86
+ }
87
+ }
88
+ // NOTE: The SDK's auth() function uses this if dynamic registration is needed.
89
+ // Ensure your OAuthClientInformationFull matches the expected structure if DCR is used.
90
+ async saveClientInformation(clientInformation) {
91
+ const key = this.getKey("client_info");
92
+ localStorage.setItem(key, JSON.stringify(clientInformation));
93
+ }
94
+ async tokens() {
95
+ const key = this.getKey("tokens");
96
+ const data = localStorage.getItem(key);
97
+ if (!data) return void 0;
98
+ try {
99
+ return JSON.parse(data);
100
+ } catch (e) {
101
+ console.warn(`[${this.storageKeyPrefix}] Failed to parse tokens:`, e);
102
+ localStorage.removeItem(key);
103
+ return void 0;
104
+ }
105
+ }
106
+ async saveTokens(tokens) {
107
+ const key = this.getKey("tokens");
108
+ localStorage.setItem(key, JSON.stringify(tokens));
109
+ localStorage.removeItem(this.getKey("code_verifier"));
110
+ localStorage.removeItem(this.getKey("last_auth_url"));
111
+ }
112
+ async saveCodeVerifier(codeVerifier) {
113
+ const key = this.getKey("code_verifier");
114
+ localStorage.setItem(key, codeVerifier);
115
+ }
116
+ async codeVerifier() {
117
+ const key = this.getKey("code_verifier");
118
+ const verifier = localStorage.getItem(key);
119
+ if (!verifier) {
120
+ throw new Error(
121
+ `[${this.storageKeyPrefix}] Code verifier not found in storage for key ${key}. Auth flow likely corrupted or timed out.`
122
+ );
123
+ }
124
+ return verifier;
125
+ }
126
+ /**
127
+ * Generates and stores the authorization URL with state, without opening a popup.
128
+ * Used when preventAutoAuth is enabled to provide the URL for manual navigation.
129
+ * @param authorizationUrl The fully constructed authorization URL from the SDK.
130
+ * @returns The full authorization URL with state parameter.
131
+ */
132
+ async prepareAuthorizationUrl(authorizationUrl) {
133
+ const state = globalThis.crypto.randomUUID();
134
+ const stateKey = `${this.storageKeyPrefix}:state_${state}`;
135
+ const stateData = {
136
+ serverUrlHash: this.serverUrlHash,
137
+ expiry: Date.now() + 1e3 * 60 * 10,
138
+ // State expires in 10 minutes
139
+ // Store provider options needed to reconstruct on callback
140
+ providerOptions: {
141
+ serverUrl: this.serverUrl,
142
+ storageKeyPrefix: this.storageKeyPrefix,
143
+ clientName: this.clientName,
144
+ clientUri: this.clientUri,
145
+ callbackUrl: this.callbackUrl
146
+ },
147
+ // Store flow type so callback knows how to handle the response
148
+ flowType: this.useRedirectFlow ? "redirect" : "popup",
149
+ // Store current URL for redirect flow so we can return to it
150
+ returnUrl: this.useRedirectFlow && typeof window !== "undefined" ? window.location.href : void 0
151
+ };
152
+ localStorage.setItem(stateKey, JSON.stringify(stateData));
153
+ authorizationUrl.searchParams.set("state", state);
154
+ const authUrlString = authorizationUrl.toString();
155
+ const sanitizedAuthUrl = (0, import_strict_url_sanitise.sanitizeUrl)(authUrlString);
156
+ localStorage.setItem(this.getKey("last_auth_url"), sanitizedAuthUrl);
157
+ return sanitizedAuthUrl;
158
+ }
159
+ /**
160
+ * Redirects the user agent to the authorization URL, storing necessary state.
161
+ * This now adheres to the SDK's void return type expectation for the interface.
162
+ * @param authorizationUrl The fully constructed authorization URL from the SDK.
163
+ */
164
+ async redirectToAuthorization(authorizationUrl) {
165
+ const sanitizedAuthUrl = await this.prepareAuthorizationUrl(authorizationUrl);
166
+ if (this.preventAutoAuth) {
167
+ console.info(
168
+ `[${this.storageKeyPrefix}] Auto-auth prevented. Authorization URL stored for manual trigger.`
169
+ );
170
+ return;
171
+ }
172
+ if (this.useRedirectFlow) {
173
+ console.info(
174
+ `[${this.storageKeyPrefix}] Redirecting to authorization URL (full-page redirect).`
175
+ );
176
+ window.location.href = sanitizedAuthUrl;
177
+ return;
178
+ }
179
+ const popupFeatures = "width=600,height=700,resizable=yes,scrollbars=yes,status=yes";
180
+ try {
181
+ const popup = window.open(
182
+ sanitizedAuthUrl,
183
+ `mcp_auth_${this.serverUrlHash}`,
184
+ popupFeatures
185
+ );
186
+ if (this.onPopupWindow) {
187
+ this.onPopupWindow(sanitizedAuthUrl, popupFeatures, popup);
188
+ }
189
+ if (!popup || popup.closed || typeof popup.closed === "undefined") {
190
+ console.warn(
191
+ `[${this.storageKeyPrefix}] Popup likely blocked by browser. Manual navigation might be required using the stored URL.`
192
+ );
193
+ } else {
194
+ popup.focus();
195
+ console.info(
196
+ `[${this.storageKeyPrefix}] Redirecting to authorization URL in popup.`
197
+ );
198
+ }
199
+ } catch (e) {
200
+ console.error(
201
+ `[${this.storageKeyPrefix}] Error opening popup window:`,
202
+ e
203
+ );
204
+ }
205
+ }
206
+ // --- Helper Methods ---
207
+ /**
208
+ * Retrieves the last URL passed to `redirectToAuthorization`. Useful for manual fallback.
209
+ */
210
+ getLastAttemptedAuthUrl() {
211
+ const storedUrl = localStorage.getItem(this.getKey("last_auth_url"));
212
+ return storedUrl ? (0, import_strict_url_sanitise.sanitizeUrl)(storedUrl) : null;
213
+ }
214
+ clearStorage() {
215
+ const prefixPattern = `${this.storageKeyPrefix}_${this.serverUrlHash}_`;
216
+ const statePattern = `${this.storageKeyPrefix}:state_`;
217
+ const keysToRemove = [];
218
+ let count = 0;
219
+ for (let i = 0; i < localStorage.length; i++) {
220
+ const key = localStorage.key(i);
221
+ if (!key) continue;
222
+ if (key.startsWith(prefixPattern)) {
223
+ keysToRemove.push(key);
224
+ } else if (key.startsWith(statePattern)) {
225
+ try {
226
+ const item = localStorage.getItem(key);
227
+ if (item) {
228
+ const state = JSON.parse(item);
229
+ if (state.serverUrlHash === this.serverUrlHash) {
230
+ keysToRemove.push(key);
231
+ }
232
+ }
233
+ } catch (e) {
234
+ console.warn(
235
+ `[${this.storageKeyPrefix}] Error parsing state key ${key} during clearStorage:`,
236
+ e
237
+ );
238
+ }
239
+ }
240
+ }
241
+ const uniqueKeysToRemove = [...new Set(keysToRemove)];
242
+ uniqueKeysToRemove.forEach((key) => {
243
+ localStorage.removeItem(key);
244
+ count++;
245
+ });
246
+ return count;
247
+ }
248
+ hashString(str) {
249
+ let hash = 0;
250
+ for (let i = 0; i < str.length; i++) {
251
+ const char = str.charCodeAt(i);
252
+ hash = (hash << 5) - hash + char;
253
+ hash = hash & hash;
254
+ }
255
+ return Math.abs(hash).toString(16);
256
+ }
257
+ getKey(keySuffix) {
258
+ return `${this.storageKeyPrefix}_${this.serverUrlHash}_${keySuffix}`;
259
+ }
260
+ };
261
+
262
+ // src/auth/callback.ts
263
+ var import_auth = require("@modelcontextprotocol/sdk/client/auth.js");
264
+ async function onMcpAuthorization() {
265
+ const queryParams = new URLSearchParams(window.location.search);
266
+ const code = queryParams.get("code");
267
+ const state = queryParams.get("state");
268
+ const error = queryParams.get("error");
269
+ const errorDescription = queryParams.get("error_description");
270
+ const logPrefix = "[mcp-callback]";
271
+ console.log(`${logPrefix} Handling callback...`, {
272
+ code,
273
+ state,
274
+ error,
275
+ errorDescription
276
+ });
277
+ let provider = null;
278
+ let storedStateData = null;
279
+ const stateKey = state ? `mcp:auth:state_${state}` : null;
280
+ try {
281
+ if (error) {
282
+ throw new Error(
283
+ `OAuth error: ${error} - ${errorDescription || "No description provided."}`
284
+ );
285
+ }
286
+ if (!code) {
287
+ throw new Error(
288
+ "Authorization code not found in callback query parameters."
289
+ );
290
+ }
291
+ if (!state || !stateKey) {
292
+ throw new Error(
293
+ "State parameter not found or invalid in callback query parameters."
294
+ );
295
+ }
296
+ const storedStateJSON = localStorage.getItem(stateKey);
297
+ if (!storedStateJSON) {
298
+ throw new Error(
299
+ `Invalid or expired state parameter "${state}". No matching state found in storage.`
300
+ );
301
+ }
302
+ try {
303
+ storedStateData = JSON.parse(storedStateJSON);
304
+ } catch (e) {
305
+ throw new Error("Failed to parse stored OAuth state.");
306
+ }
307
+ if (!storedStateData.expiry || storedStateData.expiry < Date.now()) {
308
+ localStorage.removeItem(stateKey);
309
+ throw new Error(
310
+ "OAuth state has expired. Please try initiating authentication again."
311
+ );
312
+ }
313
+ if (!storedStateData.providerOptions) {
314
+ throw new Error("Stored state is missing required provider options.");
315
+ }
316
+ const { serverUrl, ...providerOptions } = storedStateData.providerOptions;
317
+ console.log(
318
+ `${logPrefix} Re-instantiating provider for server: ${serverUrl}`
319
+ );
320
+ provider = new BrowserOAuthClientProvider(serverUrl, providerOptions);
321
+ console.log(`${logPrefix} Calling SDK auth() to exchange code...`);
322
+ const baseUrl = new URL(serverUrl).origin;
323
+ const authResult = await (0, import_auth.auth)(provider, {
324
+ serverUrl: baseUrl,
325
+ authorizationCode: code
326
+ });
327
+ if (authResult === "AUTHORIZED") {
328
+ console.log(`${logPrefix} Authorization successful via SDK auth().`);
329
+ const isRedirectFlow = storedStateData.flowType === "redirect";
330
+ if (isRedirectFlow && storedStateData.returnUrl) {
331
+ console.log(
332
+ `${logPrefix} Redirect flow complete. Returning to: ${storedStateData.returnUrl}`
333
+ );
334
+ localStorage.removeItem(stateKey);
335
+ window.location.href = storedStateData.returnUrl;
336
+ } else if (window.opener && !window.opener.closed) {
337
+ console.log(`${logPrefix} Popup flow complete. Notifying opener...`);
338
+ window.opener.postMessage(
339
+ { type: "mcp_auth_callback", success: true },
340
+ window.location.origin
341
+ );
342
+ localStorage.removeItem(stateKey);
343
+ window.close();
344
+ } else {
345
+ console.warn(
346
+ `${logPrefix} No opener window or return URL detected. Redirecting to root.`
347
+ );
348
+ localStorage.removeItem(stateKey);
349
+ const pathParts = window.location.pathname.split("/").filter(Boolean);
350
+ const basePath = pathParts.length > 0 && pathParts[pathParts.length - 1] === "callback" ? "/" + pathParts.slice(0, -2).join("/") : "/";
351
+ window.location.href = basePath || "/";
352
+ }
353
+ } else {
354
+ console.warn(
355
+ `${logPrefix} SDK auth() returned unexpected status: ${authResult}`
356
+ );
357
+ throw new Error(
358
+ `Unexpected result from authentication library: ${authResult}`
359
+ );
360
+ }
361
+ } catch (err) {
362
+ console.error(`${logPrefix} Error during OAuth callback handling:`, err);
363
+ const errorMessage = err instanceof Error ? err.message : String(err);
364
+ if (window.opener && !window.opener.closed) {
365
+ window.opener.postMessage(
366
+ { type: "mcp_auth_callback", success: false, error: errorMessage },
367
+ window.location.origin
368
+ );
369
+ }
370
+ try {
371
+ document.body.innerHTML = `
372
+ <div style="font-family: sans-serif; padding: 20px;">
373
+ <h1>Authentication Error</h1>
374
+ <p style="color: red; background-color: #ffebeb; border: 1px solid red; padding: 10px; border-radius: 4px;">
375
+ ${errorMessage}
376
+ </p>
377
+ <p>You can close this window or <a href="#" onclick="window.close(); return false;">click here to close</a>.</p>
378
+ <pre style="font-size: 0.8em; color: #555; margin-top: 20px; white-space: pre-wrap;">${err instanceof Error ? err.stack : ""}</pre>
379
+ </div>
380
+ `;
381
+ } catch (displayError) {
382
+ console.error(
383
+ `${logPrefix} Could not display error in callback window:`,
384
+ displayError
385
+ );
386
+ }
387
+ if (stateKey) {
388
+ localStorage.removeItem(stateKey);
389
+ }
390
+ if (provider) {
391
+ localStorage.removeItem(provider.getKey("code_verifier"));
392
+ localStorage.removeItem(provider.getKey("last_auth_url"));
393
+ }
394
+ }
395
+ }
396
+ __name(onMcpAuthorization, "onMcpAuthorization");
@@ -0,0 +1,10 @@
1
+ import "../../chunk-JQKKMUCT.js";
2
+ import {
3
+ BrowserOAuthClientProvider,
4
+ onMcpAuthorization
5
+ } from "../../chunk-PE7UMCVO.js";
6
+ import "../../chunk-3GQAWCBQ.js";
7
+ export {
8
+ BrowserOAuthClientProvider,
9
+ onMcpAuthorization
10
+ };
@@ -1,6 +1,6 @@
1
1
  import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
2
2
  /**
3
- * Internal type for storing OAuth state in localStorage during the popup flow.
3
+ * Internal type for storing OAuth state in localStorage during the OAuth flow.
4
4
  * @internal
5
5
  */
6
6
  export interface StoredState {
@@ -14,5 +14,7 @@ export interface StoredState {
14
14
  clientUri: string;
15
15
  callbackUrl: string;
16
16
  };
17
+ flowType?: "popup" | "redirect";
18
+ returnUrl?: string;
17
19
  }
18
20
  //# sourceMappingURL=types.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IAEtB,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0CAA0C,CAAC;AAE9E;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IAEtB,eAAe,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAEhC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}
@@ -1757,6 +1757,7 @@ var HttpConnector = class extends BaseConnector {
1757
1757
  stop: /* @__PURE__ */ __name(async () => {
1758
1758
  if (this.streamableTransport) {
1759
1759
  try {
1760
+ await this.streamableTransport.terminateSession();
1760
1761
  await this.streamableTransport.close();
1761
1762
  } catch (e) {
1762
1763
  logger.warn(`Error closing Streamable HTTP transport: ${e}`);
@@ -1781,6 +1782,8 @@ var HttpConnector = class extends BaseConnector {
1781
1782
  async connectWithSse(baseUrl) {
1782
1783
  try {
1783
1784
  this.connectionManager = new SseConnectionManager(baseUrl, {
1785
+ authProvider: this.opts.authProvider,
1786
+ // ← Pass OAuth provider to SDK (same as streamable HTTP)
1784
1787
  requestInit: {
1785
1788
  headers: this.headers
1786
1789
  }
@@ -5205,6 +5208,7 @@ var BrowserOAuthClientProvider = class {
5205
5208
  clientUri;
5206
5209
  callbackUrl;
5207
5210
  preventAutoAuth;
5211
+ useRedirectFlow;
5208
5212
  onPopupWindow;
5209
5213
  constructor(serverUrl, options = {}) {
5210
5214
  this.serverUrl = serverUrl;
@@ -5216,6 +5220,7 @@ var BrowserOAuthClientProvider = class {
5216
5220
  options.callbackUrl || (typeof window !== "undefined" ? new URL("/oauth/callback", window.location.origin).toString() : "/oauth/callback")
5217
5221
  );
5218
5222
  this.preventAutoAuth = options.preventAutoAuth;
5223
+ this.useRedirectFlow = options.useRedirectFlow;
5219
5224
  this.onPopupWindow = options.onPopupWindow;
5220
5225
  }
5221
5226
  // --- SDK Interface Methods ---
@@ -5307,7 +5312,11 @@ var BrowserOAuthClientProvider = class {
5307
5312
  clientName: this.clientName,
5308
5313
  clientUri: this.clientUri,
5309
5314
  callbackUrl: this.callbackUrl
5310
- }
5315
+ },
5316
+ // Store flow type so callback knows how to handle the response
5317
+ flowType: this.useRedirectFlow ? "redirect" : "popup",
5318
+ // Store current URL for redirect flow so we can return to it
5319
+ returnUrl: this.useRedirectFlow && typeof window !== "undefined" ? window.location.href : void 0
5311
5320
  };
5312
5321
  localStorage.setItem(stateKey, JSON.stringify(stateData));
5313
5322
  authorizationUrl.searchParams.set("state", state);
@@ -5322,8 +5331,20 @@ var BrowserOAuthClientProvider = class {
5322
5331
  * @param authorizationUrl The fully constructed authorization URL from the SDK.
5323
5332
  */
5324
5333
  async redirectToAuthorization(authorizationUrl) {
5325
- if (this.preventAutoAuth) return;
5326
5334
  const sanitizedAuthUrl = await this.prepareAuthorizationUrl(authorizationUrl);
5335
+ if (this.preventAutoAuth) {
5336
+ console.info(
5337
+ `[${this.storageKeyPrefix}] Auto-auth prevented. Authorization URL stored for manual trigger.`
5338
+ );
5339
+ return;
5340
+ }
5341
+ if (this.useRedirectFlow) {
5342
+ console.info(
5343
+ `[${this.storageKeyPrefix}] Redirecting to authorization URL (full-page redirect).`
5344
+ );
5345
+ window.location.href = sanitizedAuthUrl;
5346
+ return;
5347
+ }
5327
5348
  const popupFeatures = "width=600,height=700,resizable=yes,scrollbars=yes,status=yes";
5328
5349
  try {
5329
5350
  const popup = window.open(
@@ -5473,24 +5494,31 @@ async function onMcpAuthorization() {
5473
5494
  authorizationCode: code
5474
5495
  });
5475
5496
  if (authResult === "AUTHORIZED") {
5476
- console.log(
5477
- `${logPrefix} Authorization successful via SDK auth(). Notifying opener...`
5478
- );
5479
- if (window.opener && !window.opener.closed) {
5497
+ console.log(`${logPrefix} Authorization successful via SDK auth().`);
5498
+ const isRedirectFlow = storedStateData.flowType === "redirect";
5499
+ if (isRedirectFlow && storedStateData.returnUrl) {
5500
+ console.log(
5501
+ `${logPrefix} Redirect flow complete. Returning to: ${storedStateData.returnUrl}`
5502
+ );
5503
+ localStorage.removeItem(stateKey);
5504
+ window.location.href = storedStateData.returnUrl;
5505
+ } else if (window.opener && !window.opener.closed) {
5506
+ console.log(`${logPrefix} Popup flow complete. Notifying opener...`);
5480
5507
  window.opener.postMessage(
5481
5508
  { type: "mcp_auth_callback", success: true },
5482
5509
  window.location.origin
5483
5510
  );
5511
+ localStorage.removeItem(stateKey);
5484
5512
  window.close();
5485
5513
  } else {
5486
5514
  console.warn(
5487
- `${logPrefix} No opener window detected. Redirecting to root.`
5515
+ `${logPrefix} No opener window or return URL detected. Redirecting to root.`
5488
5516
  );
5517
+ localStorage.removeItem(stateKey);
5489
5518
  const pathParts = window.location.pathname.split("/").filter(Boolean);
5490
5519
  const basePath = pathParts.length > 0 && pathParts[pathParts.length - 1] === "callback" ? "/" + pathParts.slice(0, -2).join("/") : "/";
5491
5520
  window.location.href = basePath || "/";
5492
5521
  }
5493
- localStorage.removeItem(stateKey);
5494
5522
  } else {
5495
5523
  console.warn(
5496
5524
  `${logPrefix} SDK auth() returned unexpected status: ${authResult}`
@@ -9,15 +9,17 @@ import {
9
9
  MCPAgent,
10
10
  ObservabilityManager,
11
11
  RemoteAgent
12
- } from "../chunk-MCF5P6GJ.js";
12
+ } from "../chunk-GVVPUU5K.js";
13
13
  import {
14
14
  BrowserMCPClient,
15
- BrowserOAuthClientProvider,
16
15
  HttpConnector,
17
16
  MCPSession,
18
- WebSocketConnector,
17
+ WebSocketConnector
18
+ } from "../chunk-QSLJXXMG.js";
19
+ import {
20
+ BrowserOAuthClientProvider,
19
21
  onMcpAuthorization
20
- } from "../chunk-BWOTID2D.js";
22
+ } from "../chunk-PE7UMCVO.js";
21
23
  import {
22
24
  BaseConnector
23
25
  } from "../chunk-2JBWOW4S.js";
@@ -1 +1 @@
1
- {"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/connectors/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,mBAAmB,CAA8C;gBAE7D,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB;IAkB5D,mFAAmF;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA6GhB,yBAAyB;YAoIzB,cAAc;IAyD5B,IAAI,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7C;IAED;;OAEG;IACH,gBAAgB,IAAI,iBAAiB,GAAG,KAAK,GAAG,IAAI;CAGrD"}
1
+ {"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/connectors/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,aAAc,SAAQ,aAAa;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,mBAAmB,CAA8C;gBAE7D,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB;IAkB5D,mFAAmF;IAC7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YA6GhB,yBAAyB;YAuIzB,cAAc;IA0D5B,IAAI,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7C;IAED;;OAEG;IACH,gBAAgB,IAAI,iBAAiB,GAAG,KAAK,GAAG,IAAI;CAGrD"}