tiny-http-mcp-server 0.1.21 → 0.1.23

package/node_modules/tiny-mcp-client/dist/index.js

@@ -152,11 +152,17 @@ var HttpResponseMessages = class {
 };
 
 // ../toolcraft-schema/dist/json.js
-function isJsonValue(value) {
+function isJsonValue(value, options = {}) {
+  const maxNodes = options.maxNodes ?? 1e4;
+  const maxDepth = options.maxDepth ?? 64;
+  if (!Number.isSafeInteger(maxNodes) || maxNodes < 1)
+    throw new Error("maxNodes must be a positive safe integer");
+  if (!Number.isSafeInteger(maxDepth) || maxDepth < 0 || maxDepth > 256)
+    throw new Error("maxDepth must be an integer between 0 and 256");
   const ancestors = /* @__PURE__ */ new Set();
   let nodes = 0;
   const visit = (item, depth) => {
-    if (++nodes > 1e4 || depth > 64)
+    if (++nodes > maxNodes || depth > maxDepth)
       return false;
     if (item === null || typeof item === "string" || typeof item === "boolean")
       return true;
@@ -182,7 +188,7 @@ function isJsonValue(value) {
     ancestors.add(item);
     let valid = true;
     if (Array.isArray(item)) {
-      if (item.length > 1e4)
+      if (item.length > maxNodes)
         valid = false;
       else
         for (let index = 0; index < item.length; index++) {
@@ -4102,47 +4108,137 @@ function getOwnEntry4(record2, key2) {
 
 // ../mcp-oauth/dist/client/loopback-authorization.js
 async function createLoopbackAuthorizationSession(options = {}) {
-  const callbackPath = options.callbackPath ?? "/callback";
+  options.signal?.throwIfAborted();
+  const timeoutMs = options.timeoutMs ?? 12e4;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  const target = loopbackTarget(options);
   const server = options.createServer ? options.createServer() : http.createServer();
-  const port = await startServer(server);
-  const redirectUri = `http://127.0.0.1:${port}${callbackPath}`;
+  const controller = new AbortController();
+  let closed = false;
+  let used = false;
+  const callerAbort = () => controller.abort(options.signal?.reason);
+  const teardown = () => {
+    if (closed)
+      return;
+    closed = true;
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", callerAbort);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer.unref?.();
+  controller.signal.addEventListener("abort", teardown, { once: true });
+  options.signal?.addEventListener("abort", callerAbort, { once: true });
+  if (options.signal?.aborted)
+    callerAbort();
+  let port;
+  try {
+    port = await startServer(server, target.port, target.host, controller.signal);
+  } catch (error) {
+    controller.abort(error);
+    throw error;
+  }
+  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
   return {
     redirectUri,
     async waitForCode(authorizationUrl) {
-      return waitForAuthorizationCode(server, authorizationUrl, options, callbackPath);
+      controller.signal.throwIfAborted();
+      if (used)
+        throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+      } finally {
+        clearTimeout(timer);
+      }
     },
     close() {
-      server.closeAllConnections?.();
-      server.close();
+      controller.abort(new Error("OAuth authorization session closed"));
     }
   };
 }
-async function startServer(server) {
+function loopbackTarget(options) {
+  if (options.redirectUri !== void 0) {
+    let url;
+    try {
+      url = new URL(options.redirectUri);
+    } catch (cause) {
+      throw new Error("Invalid OAuth loopback redirect URI", { cause });
+    }
+    const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
+    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || forbiddenQuery.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
+      throw new Error("Invalid OAuth loopback redirect URI");
+    return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
+  }
+  const callbackPath = options.callbackPath ?? "/callback";
+  const parsed = new URL(callbackPath, "http://127.0.0.1");
+  if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
+    throw new Error("Invalid OAuth loopback callback path");
+  return { port: 0, host: "127.0.0.1", callbackPath };
+}
+async function startServer(server, port, host, signal) {
+  signal.throwIfAborted();
   return new Promise((resolve, reject) => {
-    const handleError = (error) => {
+    const cleanup = () => {
       server.off("error", handleError);
+      signal.removeEventListener("abort", aborted);
+    };
+    const handleError = (error) => {
+      cleanup();
       reject(error);
     };
+    const aborted = () => {
+      cleanup();
+      reject(signal.reason);
+    };
     server.once("error", handleError);
-    server.listen(0, "127.0.0.1", () => {
-      server.off("error", handleError);
-      const address = server.address();
-      resolve(address.port);
-    });
+    signal.addEventListener("abort", aborted, { once: true });
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        if (signal.aborted) {
+          server.close();
+          reject(signal.reason);
+          return;
+        }
+        const address = server.address();
+        if (address === null || typeof address === "string") {
+          reject(new Error("OAuth listener has no TCP address"));
+          return;
+        }
+        resolve(address.port);
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
   });
 }
-function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath) {
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
+  signal.throwIfAborted();
   const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
   return new Promise((resolve, reject) => {
     let settled = false;
     const settle = (fn) => {
-      if (!settled) {
-        settled = true;
-        fn();
-      }
+      if (settled)
+        return;
+      settled = true;
+      server.off("request", request);
+      signal.removeEventListener("abort", aborted);
+      fn();
     };
-    server.on("request", (req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const aborted = () => settle(() => reject(signal.reason));
+    const request = (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.writeHead(400);
+        res.end("Invalid callback URL");
+        return;
+      }
       if (url.pathname !== callbackPath) {
         res.writeHead(404);
         res.end("Not found");
@@ -4157,21 +4253,8 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
       };
       try {
         validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-      } catch (error) {
-        res.writeHead(400);
-        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-        return;
-      }
-      const authorizationError = callbackParameters.error;
-      if (authorizationError !== null) {
-        const description = callbackParameters.errorDescription ?? authorizationError;
-        res.writeHead(400);
-        res.end(`Authorization failed: ${description}`);
-        settle(() => reject(createAuthorizationError(authorizationError, description)));
-        return;
-      }
-      try {
+        if (callbackParameters.error !== null)
+          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
         const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
         res.writeHead(200, { "Content-Type": "text/html" });
         res.end(buildSuccessPage(options.landingPage));
@@ -4179,35 +4262,27 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
       } catch (error) {
         res.writeHead(400);
         res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+        settle(() => reject(error));
       }
-    });
+    };
+    server.on("request", request);
+    signal.addEventListener("abort", aborted, { once: true });
     if (options.readLine !== void 0) {
-      options.readLine().then((input) => {
-        const callbackParameters = extractCallbackParametersFromInput(input);
-        if (callbackParameters === null) {
-          settle(() => reject(new Error("OAuth callback missing authorization code")));
+      void Promise.resolve().then(() => settled ? void 0 : options.readLine()).then((input) => {
+        if (settled)
           return;
-        }
-        try {
-          validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-          if (callbackParameters.error !== null) {
-            const description = callbackParameters.errorDescription ?? callbackParameters.error;
-            throw createAuthorizationError(callbackParameters.error, description);
-          }
-          const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-          settle(() => resolve(code));
-        } catch (error) {
-          settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-        }
-      }).catch((error) => {
-        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
-      });
+        const callbackParameters = extractCallbackParametersFromInput(input);
+        if (callbackParameters === null)
+          throw new Error("OAuth callback missing authorization code");
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+        if (callbackParameters.error !== null)
+          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        settle(() => resolve(code));
+      }).catch((error) => settle(() => reject(error)));
     }
     if (options.openBrowser !== void 0) {
-      options.openBrowser(authorizationUrl).catch((error) => {
-        settle(() => reject(error));
-      });
+      void Promise.resolve().then(() => settled ? void 0 : options.openBrowser(authorizationUrl)).catch((error) => settle(() => reject(error)));
     }
   });
 }
@@ -4387,6 +4462,7 @@ async function exchangeAuthorizationCode(input) {
       resource
     },
     fetch: input.fetch,
+    signal: input.signal,
     now: input.now
   });
 }
@@ -4402,6 +4478,7 @@ async function refreshAccessToken(input) {
       resource
     },
     fetch: input.fetch,
+    signal: input.signal,
     now: input.now
   });
 }
@@ -4413,7 +4490,9 @@ async function requestTokens(input) {
   if (input.clientSecret !== void 0) {
     body.set("client_secret", input.clientSecret);
   }
-  const signal = AbortSignal.timeout(3e4);
+  input.signal?.throwIfAborted();
+  const deadline = AbortSignal.timeout(3e4);
+  const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
   const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
     method: "POST",
     headers: {
@@ -4521,12 +4600,34 @@ function createDefaultOAuthClientProvider(options) {
   const registeredClients = /* @__PURE__ */ new Map();
   const refreshPromises = /* @__PURE__ */ new Map();
   const authorizationPromises = /* @__PURE__ */ new Map();
+  if (options.initialGrant !== void 0) {
+    let resource;
+    try {
+      resource = new URL2(options.initialGrant.resource);
+    } catch {
+      throw new Error("OAuth initial grant resource must be an absolute HTTP URL");
+    }
+    if (resource.protocol !== "http:" && resource.protocol !== "https:" || resource.username || resource.password || resource.hash)
+      throw new Error("OAuth initial grant resource must be an HTTP URL without credentials or fragments");
+  }
+  const initialGrant = options.initialGrant === void 0 ? void 0 : {
+    resource: canonicalizeResourceIndicator(options.initialGrant.resource),
+    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    client: normalizeConfiguredClient(options.client)
+  };
+  if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
+    throw new Error("OAuth initial grant requires valid tokens and the original client ID");
+  let initialGrantConsumed = false;
   return {
     async authorizeRequest(input) {
       assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
       const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
-      const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false);
+      const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false, false, input.signal);
       const accessToken = session?.tokens?.accessToken;
+      if (session === null && !initialGrantConsumed && initialGrant?.resource === requestUrl && initialGrant.tokens !== void 0 && !isExpired(initialGrant.tokens, now)) {
+        input.headers.set("Authorization", `Bearer ${initialGrant.tokens.accessToken}`);
+        return;
+      }
       if (session === null || accessToken === void 0 || session.tokens === void 0 || isExpired(session.tokens, now)) {
         return;
       }
@@ -4539,16 +4640,17 @@ function createDefaultOAuthClientProvider(options) {
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
         const resource = canonicalizeResourceIndicator(input.discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
-        const forceRefresh = hasCachedAccessToken(await loadSession(resource)) && input.challenge?.params.error === "invalid_token";
+        const forceRefresh = (hasCachedAccessToken(await loadSession(resource)) || !initialGrantConsumed && initialGrant?.resource === resource) && input.challenge?.params.error === "invalid_token";
         const session = await ensureAuthorizedSession(resource, {
           ...input.discovery,
           resource
-        }, input.fetch, true, forceRefresh);
+        }, input.fetch, true, forceRefresh, input.signal);
         if (session?.tokens?.accessToken === void 0) {
           return { action: "fail" };
         }
         return { action: "retry" };
       } catch (error) {
+        input.signal?.throwIfAborted();
         return {
           action: "fail",
           error: error instanceof Error ? error : new Error(String(error))
@@ -4556,9 +4658,13 @@ function createDefaultOAuthClientProvider(options) {
       }
     }
   };
-  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false) {
+  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal) {
+    signal?.throwIfAborted();
     const canonicalResource = canonicalizeResourceIndicator(resource);
     let session = await loadSession(canonicalResource);
+    if (session !== null && initialGrant?.resource === canonicalResource)
+      initialGrantConsumed = true;
+    signal?.throwIfAborted();
     if (discovery !== void 0 && getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer) {
       throw new Error("OAuth discovery authorization-server issuer mismatch");
     }
@@ -4566,12 +4672,25 @@ function createDefaultOAuthClientProvider(options) {
       await clearSession(canonicalResource);
       session = null;
     }
+    if (session === null && discovery !== void 0 && !initialGrantConsumed && initialGrant?.resource === canonicalResource && initialGrant.tokens !== void 0 && initialGrant.client !== null) {
+      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+      session = {
+        resource: canonicalResource,
+        authorizationServer: discovery.authorizationServer,
+        client: initialGrant.client,
+        tokens: initialGrant.tokens,
+        discovery: toStoredDiscovery(discovery)
+      };
+      await saveSession(canonicalResource, session);
+      initialGrantConsumed = true;
+      signal?.throwIfAborted();
+    }
     const sessionDiscovery = resolveDiscovery(discovery, session);
     if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
       return session;
     }
     if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
-      session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2);
+      session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
       if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
         return session;
       }
@@ -4583,9 +4702,12 @@ function createDefaultOAuthClientProvider(options) {
     if (!allowInteractive || sessionDiscovery === void 0) {
       return session;
     }
-    return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2);
+    if (options.allowInteractive === false)
+      throw new Error("OAuth interactive authorization is disabled");
+    return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
   }
-  async function refreshSession(resource, session, discovery, fetch2) {
+  async function refreshSession(resource, session, discovery, fetch2, signal) {
+    signal?.throwIfAborted();
     assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
     const inFlight = refreshPromises.get(resource);
     if (inFlight !== void 0) {
@@ -4607,10 +4729,12 @@ function createDefaultOAuthClientProvider(options) {
               refreshToken: session.tokens.refreshToken,
               resource,
               fetch: fetch2,
+              signal,
               now
             });
             break;
           } catch (error) {
+            signal?.throwIfAborted();
             if (error instanceof OAuthError && error.error === "invalid_grant") {
               const clearedSession = clearSessionTokens(session);
               await saveSession(resource, clearedSession);
@@ -4645,7 +4769,8 @@ function createDefaultOAuthClientProvider(options) {
     refreshPromises.set(resource, promise);
     return promise;
   }
-  async function authorizeSession(resource, existingSession, discovery, fetch2) {
+  async function authorizeSession(resource, existingSession, discovery, fetch2, signal) {
+    signal?.throwIfAborted();
     const inFlight = authorizationPromises.get(resource);
     if (inFlight !== void 0) {
       return inFlight;
@@ -4661,11 +4786,14 @@ function createDefaultOAuthClientProvider(options) {
           openBrowser: options.browser.openBrowser,
           readLine: options.browser.readLine,
           createServer: options.browser.createServer,
-          landingPage: options.browser.landingPage
+          landingPage: options.browser.landingPage,
+          redirectUri: options.browser.redirectUri,
+          signal: options.browser.signal === void 0 ? signal : signal === void 0 ? options.browser.signal : AbortSignal.any([signal, options.browser.signal]),
+          timeoutMs: options.browser.timeoutMs
         });
         let resolvedClient = null;
         try {
-          resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2);
+          resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2, signal);
           const sessionWithoutTokens = {
             resource,
             authorizationServer: discovery.authorizationServer,
@@ -4693,6 +4821,7 @@ function createDefaultOAuthClientProvider(options) {
             redirectUri: loopback.redirectUri,
             resource,
             fetch: fetch2,
+            signal,
             now
           });
           const session = {
@@ -4702,6 +4831,7 @@ function createDefaultOAuthClientProvider(options) {
           await saveSession(resource, session);
           return session;
         } catch (error) {
+          signal?.throwIfAborted();
           if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
             reRegistrationAttempted = true;
             await clearRegisteredClient(discovery.authorizationServer);
@@ -4727,7 +4857,8 @@ function createDefaultOAuthClientProvider(options) {
     authorizationPromises.set(resource, finalPromise);
     return finalPromise;
   }
-  async function resolveClient(existingSession, discovery, redirectUri, fetch2) {
+  async function resolveClient(existingSession, discovery, redirectUri, fetch2, parentSignal) {
+    parentSignal?.throwIfAborted();
     const configuredClient = normalizeConfiguredClient(options.client);
     if (options.client.mode === "static") {
       if (configuredClient === null) {
@@ -4777,7 +4908,8 @@ function createDefaultOAuthClientProvider(options) {
       }
     }
     const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
-    const signal = AbortSignal.timeout(3e4);
+    const deadline = AbortSignal.timeout(3e4);
+    const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
     const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
       method: "POST",
       headers: {
@@ -5340,8 +5472,10 @@ async function readJsonResponse(response, label, signal) {
     throw new Error(`${label} response must be valid JSON`);
   }
 }
-async function fetchMetadata(fetch2, location, label) {
-  const signal = AbortSignal.timeout(1e4);
+async function fetchMetadata(fetch2, location, label, parentSignal) {
+  parentSignal?.throwIfAborted();
+  const deadline = AbortSignal.timeout(1e4);
+  const signal = parentSignal === void 0 ? deadline : AbortSignal.any([deadline, parentSignal]);
   const response = await fetchMcpResponse(fetch2, location, {
     method: "GET",
     headers: { Accept: "application/json" },
@@ -5443,7 +5577,7 @@ var OAuthMetadataDiscovery = class {
     this.fetchImpl = fetch2;
     this.cache = cache;
   }
-  async discoverProtectedResource(resource, resourceMetadataUrl) {
+  async discoverProtectedResource(resource, resourceMetadataUrl, signal) {
     const locations = /* @__PURE__ */ new Set([resolveProtectedResourceMetadataUrl(resource, resourceMetadataUrl)]);
     if (resourceMetadataUrl === void 0) {
       locations.add(new URL("/.well-known/oauth-protected-resource", resource).toString());
@@ -5452,17 +5586,19 @@ var OAuthMetadataDiscovery = class {
     for (const location of locations) {
       try {
         const metadata = validateProtectedResourceMetadata(
-          await fetchMetadata(this.fetchImpl, location, "Protected resource metadata"),
+          await fetchMetadata(this.fetchImpl, location, "Protected resource metadata", signal),
           resource
         );
         return { location, metadata };
       } catch (error) {
+        signal?.throwIfAborted();
         lastError = error;
       }
     }
     throw lastError;
   }
-  async discover(resourceUrl, { resourceMetadataUrl } = {}) {
+  async discover(resourceUrl, { resourceMetadataUrl, signal } = {}) {
+    signal?.throwIfAborted();
     const cacheKey = canonicalizeResourceIndicator(resourceUrl);
     resolveProtectedResourceMetadataUrl(cacheKey, resourceMetadataUrl);
     const memoryCachedResult = this.memoryCache.get(cacheKey);
@@ -5470,6 +5606,7 @@ var OAuthMetadataDiscovery = class {
       return structuredClone(memoryCachedResult);
     }
     const sharedCachedResult = await this.cache?.get(cacheKey);
+    signal?.throwIfAborted();
     if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
       try {
         const result = validateCachedDiscovery(sharedCachedResult, cacheKey);
@@ -5479,7 +5616,7 @@ var OAuthMetadataDiscovery = class {
         await this.cache?.delete?.(cacheKey);
       }
     }
-    const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl);
+    const { location: resourceMetadataLocation, metadata: resourceMetadata } = await this.discoverProtectedResource(cacheKey, resourceMetadataUrl, signal);
     const authorizationServerErrors = [];
     for (const authorizationServer of resourceMetadata.authorization_servers) {
       const normalizedAuthorizationServer = validateAuthorizationServerIssuer(authorizationServer);
@@ -5487,7 +5624,7 @@ var OAuthMetadataDiscovery = class {
       for (const authorizationServerMetadataUrl of metadataLocations) {
         try {
           const authorizationServerMetadata = validateAuthorizationServerMetadata(
-            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "Authorization server metadata"),
+            await fetchMetadata(this.fetchImpl, authorizationServerMetadataUrl, "Authorization server metadata", signal),
             normalizedAuthorizationServer
           );
           const result = {
@@ -5502,6 +5639,7 @@ var OAuthMetadataDiscovery = class {
           await this.cache?.set(cacheKey, structuredClone(result));
           return result;
         } catch (error) {
+          signal?.throwIfAborted();
           authorizationServerErrors.push(
             `${authorizationServerMetadataUrl}: ${error instanceof Error ? error.message : String(error)}`
           );
@@ -6642,6 +6780,7 @@ var HttpTransport = class {
   oauthProvider;
   oauthMetadataDiscovery;
   inFlightFetchAbortControllers = /* @__PURE__ */ new Set();
+  inFlightOAuthAbortControllers = /* @__PURE__ */ new Set();
   openResponseReaders = /* @__PURE__ */ new Set();
   modernRequests = /* @__PURE__ */ new Map();
   modernMode = false;
@@ -6711,7 +6850,7 @@ var HttpTransport = class {
     this.rejectLegacyEndpoint = void 0;
     this.resolveLegacyEndpoint = void 0;
     this.toolParameterHeaders.clear();
-    this.abortInFlightFetches();
+    this.abortInFlightFetches(reason);
     this.cancelOpenResponseReaders();
     if (!this.writeStream.destroyed && !this.writeStream.writableEnded) {
       this.writeStream.end();
@@ -6747,12 +6886,14 @@ var HttpTransport = class {
     this.resolveClosed = void 0;
     resolveClosed?.({ reason: closeReason });
   }
-  abortInFlightFetches() {
-    for (const controller of this.modernRequests.values()) controller.abort();
+  abortInFlightFetches(reason) {
+    for (const controller of this.modernRequests.values()) controller.abort(reason);
     this.modernRequests.clear();
     for (const abortController of this.inFlightFetchAbortControllers) {
-      abortController.abort();
+      abortController.abort(reason);
     }
+    for (const controller of this.inFlightOAuthAbortControllers) controller.abort(reason);
+    this.inFlightOAuthAbortControllers.clear();
     this.inFlightFetchAbortControllers.clear();
   }
   cancelOpenResponseReaders() {
@@ -6818,7 +6959,7 @@ var HttpTransport = class {
       const response = await this.fetchWithOAuthRetry({
         url: postUrl,
         method: "POST",
-        createHeaders: () => this.createPostHeaders(message, modern),
+        createHeaders: (signal) => this.createPostHeaders(message, modern, signal),
         body: line,
         controller
       });
@@ -6858,7 +6999,7 @@ var HttpTransport = class {
         this.modernRequests.delete(id);
     }
   }
-  async createPostHeaders(message, modern = false) {
+  async createPostHeaders(message, modern = false, signal) {
     const headers = new Headers(this.headers);
     headers.set("Accept", "application/json, text/event-stream");
     headers.set("Content-Type", "application/json");
@@ -6888,9 +7029,9 @@ var HttpTransport = class {
       headers.set("Mcp-Session-Id", this.sessionId);
       headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
     }
-    return this.authorizeRequestHeaders(headers);
+    return this.authorizeRequestHeaders(headers, signal);
   }
-  async createGetHeaders() {
+  async createGetHeaders(signal) {
     const headers = new Headers(this.headers);
     headers.set("Accept", "text/event-stream");
     if (this.sessionId !== void 0) {
@@ -6900,20 +7041,26 @@ var HttpTransport = class {
     if (this.lastEventId !== void 0) {
       headers.set("Last-Event-ID", this.lastEventId);
     }
-    return this.authorizeRequestHeaders(headers);
+    return this.authorizeRequestHeaders(headers, signal);
   }
-  async createDeleteHeaders(sessionId) {
+  async createDeleteHeaders(sessionId, signal) {
     const headers = new Headers(this.headers);
     headers.set("Mcp-Session-Id", sessionId);
     headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
-    return this.authorizeRequestHeaders(headers);
+    return this.authorizeRequestHeaders(headers, signal);
   }
-  async authorizeRequestHeaders(headers) {
+  async authorizeRequestHeaders(headers, signal) {
+    signal?.throwIfAborted();
     await this.oauthProvider?.authorizeRequest?.({
       requestUrl: new URL(this.url),
       headers,
-      fetch: this.fetchImpl
+      signal,
+      fetch: (url, init) => fetchMcpResponse(this.fetchImpl, url, {
+        ...init,
+        signal: signal === void 0 ? init?.signal : init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
+      })
     });
+    signal?.throwIfAborted();
     return headers;
   }
   captureSessionId(response) {
@@ -6950,7 +7097,7 @@ var HttpTransport = class {
     return this.legacyEndpointReady;
   }
   async sendSessionTerminationRequest(sessionId, signal) {
-    const headers = await this.createDeleteHeaders(sessionId);
+    const headers = await this.createDeleteHeaders(sessionId, signal);
     signal.throwIfAborted();
     const response = await fetchMcpResponse(this.fetchImpl, this.url, {
       method: "DELETE",
@@ -6973,7 +7120,7 @@ var HttpTransport = class {
   async consumeGetSseStream() {
     const response = await this.fetchWithOAuthRetry({
       method: "GET",
-      createHeaders: () => this.createGetHeaders()
+      createHeaders: (signal) => this.createGetHeaders(signal)
     });
     if (this.disposed) {
       void response.body?.cancel().catch(() => void 0);
@@ -7056,7 +7203,7 @@ var HttpTransport = class {
     const message = responseBody.length === 0 ? `HTTP transport POST failed (${statusDescriptor})` : `HTTP transport POST failed (${statusDescriptor}): ${responseBody}`;
     throw new HttpTransportError(message, response.status, "POST");
   }
-  async maybeHandleUnauthorizedResponse(response) {
+  async maybeHandleUnauthorizedResponse(response, signal) {
     if (response.status !== 401 || this.oauthProvider === void 0) {
       return false;
     }
@@ -7067,7 +7214,7 @@ var HttpTransport = class {
     const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
     const resourceMetadataUrl = challenge?.params.resource_metadata;
     try {
-      const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl });
+      const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
       const providerResponse = response.clone();
       let result;
       try {
@@ -7076,8 +7223,13 @@ var HttpTransport = class {
           response: providerResponse,
           challenge,
           discovery,
-          fetch: this.fetchImpl
+          signal,
+          fetch: (url, init) => fetchMcpResponse(this.fetchImpl, url, {
+            ...init,
+            signal: init?.signal == null ? signal : AbortSignal.any([signal, init.signal])
+          })
         });
+        signal.throwIfAborted();
       } finally {
         void providerResponse.body?.cancel().catch(() => void 0);
       }
@@ -7207,25 +7359,30 @@ var HttpTransport = class {
 `);
   }
   async fetchWithOAuthRetry(input) {
-    const request = async () => this.fetchWithAbort(
-      input.url ?? this.url,
-      {
+    const controller = input.controller ?? new AbortController();
+    this.inFlightOAuthAbortControllers.add(controller);
+    const request = async () => {
+      controller.signal.throwIfAborted();
+      const headers = await input.createHeaders(controller.signal);
+      controller.signal.throwIfAborted();
+      return this.fetchWithAbort(input.url ?? this.url, {
         method: input.method,
-        headers: await input.createHeaders(),
+        headers,
         body: input.body
-      },
-      input.controller
-    );
-    let response = await request();
-    if (await this.maybeHandleUnauthorizedResponse(response)) {
-      response = await request();
-    }
-    const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
-    if (oauthError !== null) {
-      void response.body?.cancel().catch(() => void 0);
-      throw oauthError;
+      }, controller);
+    };
+    try {
+      let response = await request();
+      if (await this.maybeHandleUnauthorizedResponse(response, controller.signal)) response = await request();
+      const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
+      if (oauthError !== null) {
+        void response.body?.cancel().catch(() => void 0);
+        throw oauthError;
+      }
+      return response;
+    } finally {
+      this.inFlightOAuthAbortControllers.delete(controller);
     }
-    return response;
   }
   readOAuthChallengeError(response) {
     if (response.status !== 401 && response.status !== 403) {