tiny-http-mcp-server 0.1.34 → 0.1.36

package/node_modules/tiny-mcp-client/dist/index.js

@@ -3395,6 +3395,311 @@ var SubscriptionManager = class {
   }
 };
 
+// ../mcp-oauth/dist/client/loopback-authorization.js
+import http from "node:http";
+
+// ../mcp-oauth/dist/client/authorization-state.js
+import crypto from "node:crypto";
+function createAuthorizationState(input) {
+  const payload = {
+    v: 1,
+    n: crypto.randomBytes(16).toString("base64url"),
+    i: input.issuer,
+    r: input.requireIssuer
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function parseAuthorizationState(value) {
+  if (value === null || value.length === 0) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(value, "base64url").toString("utf8");
+    const parsed = JSON.parse(decoded);
+    if (!isObjectRecord(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry(parsed, "v");
+    const nonce = getOwnEntry(parsed, "n");
+    const issuer = getOwnEntry(parsed, "i");
+    const requireIssuer = getOwnEntry(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
+      return null;
+    }
+    return {
+      issuer,
+      requireIssuer
+    };
+  } catch {
+    return null;
+  }
+}
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry(record2, key2) {
+  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+}
+
+// ../mcp-oauth/dist/client/loopback-authorization.js
+async function createLoopbackAuthorizationSession(options = {}) {
+  options.signal?.throwIfAborted();
+  const timeoutMs = options.timeoutMs ?? 12e4;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  const target = loopbackTarget(options);
+  const server = options.createServer ? options.createServer() : http.createServer();
+  const controller = new AbortController();
+  let closed = false;
+  let used = false;
+  const callerAbort = () => controller.abort(options.signal?.reason);
+  const teardown = () => {
+    if (closed)
+      return;
+    closed = true;
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", callerAbort);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer.unref?.();
+  controller.signal.addEventListener("abort", teardown, { once: true });
+  options.signal?.addEventListener("abort", callerAbort, { once: true });
+  if (options.signal?.aborted)
+    callerAbort();
+  let port;
+  try {
+    port = await startServer(server, target.port, target.host, controller.signal);
+  } catch (error) {
+    controller.abort(error);
+    throw error;
+  }
+  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used)
+        throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
+function loopbackTarget(options) {
+  if (options.redirectUri !== void 0) {
+    let url;
+    try {
+      url = new URL(options.redirectUri);
+    } catch (cause) {
+      throw new Error("Invalid OAuth loopback redirect URI", { cause });
+    }
+    const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
+    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || forbiddenQuery.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
+      throw new Error("Invalid OAuth loopback redirect URI");
+    return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
+  }
+  const callbackPath = options.callbackPath ?? "/callback";
+  const parsed = new URL(callbackPath, "http://127.0.0.1");
+  if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
+    throw new Error("Invalid OAuth loopback callback path");
+  return { port: 0, host: "127.0.0.1", callbackPath };
+}
+async function startServer(server, port, host, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      server.off("error", handleError);
+      signal.removeEventListener("abort", aborted);
+    };
+    const handleError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const aborted = () => {
+      cleanup();
+      reject(signal.reason);
+    };
+    server.once("error", handleError);
+    signal.addEventListener("abort", aborted, { once: true });
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        if (signal.aborted) {
+          server.close();
+          reject(signal.reason);
+          return;
+        }
+        const address = server.address();
+        if (address === null || typeof address === "string") {
+          reject(new Error("OAuth listener has no TCP address"));
+          return;
+        }
+        resolve(address.port);
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
+  });
+}
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
+  signal.throwIfAborted();
+  const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled)
+        return;
+      settled = true;
+      server.off("request", request);
+      signal.removeEventListener("abort", aborted);
+      fn();
+    };
+    const aborted = () => settle(() => reject(signal.reason));
+    const request = (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.writeHead(400);
+        res.end("Invalid callback URL");
+        return;
+      }
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+      }
+      const callbackParameters = {
+        code: url.searchParams.get("code"),
+        error: url.searchParams.get("error"),
+        errorDescription: url.searchParams.get("error_description"),
+        state: url.searchParams.get("state"),
+        iss: url.searchParams.get("iss")
+      };
+      try {
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+        if (callbackParameters.error !== null)
+          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(buildSuccessPage(options.landingPage));
+        settle(() => resolve(code));
+      } catch (error) {
+        res.writeHead(400);
+        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
+        settle(() => reject(error));
+      }
+    };
+    server.on("request", request);
+    signal.addEventListener("abort", aborted, { once: true });
+    if (options.readLine !== void 0) {
+      void Promise.resolve().then(() => settled ? void 0 : options.readLine()).then((input) => {
+        if (settled)
+          return;
+        const callbackParameters = extractCallbackParametersFromInput(input);
+        if (callbackParameters === null)
+          throw new Error("OAuth callback missing authorization code");
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+        if (callbackParameters.error !== null)
+          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        settle(() => resolve(code));
+      }).catch((error) => settle(() => reject(error)));
+    }
+    if (options.openBrowser !== void 0) {
+      void Promise.resolve().then(() => settled ? void 0 : options.openBrowser(authorizationUrl)).catch((error) => settle(() => reject(error)));
+    }
+  });
+}
+function extractCallbackParametersFromInput(input) {
+  const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
+  if (trimmed.length === 0) {
+    return null;
+  }
+  try {
+    const url = new URL(trimmed);
+    return {
+      code: url.searchParams.get("code"),
+      error: url.searchParams.get("error"),
+      errorDescription: url.searchParams.get("error_description"),
+      state: url.searchParams.get("state"),
+      iss: url.searchParams.get("iss")
+    };
+  } catch {
+    return {
+      code: trimmed,
+      error: null,
+      errorDescription: null,
+      state: null,
+      iss: null
+    };
+  }
+}
+function readExpectedAuthorizationCallback(authorizationUrl) {
+  const url = new URL(authorizationUrl);
+  const state = url.searchParams.get("state");
+  const parsedState = parseAuthorizationState(state);
+  return {
+    state,
+    issuer: parsedState?.issuer ?? null,
+    requireIssuer: parsedState?.requireIssuer ?? false
+  };
+}
+function validateAuthorizationCallbackParameters(callback, expected) {
+  validateAuthorizationCallbackBinding(callback, expected);
+  if (callback.code === null || callback.code.length === 0) {
+    throw new Error("OAuth callback missing authorization code");
+  }
+  return callback.code;
+}
+function validateAuthorizationCallbackBinding(callback, expected) {
+  if (expected.state !== null) {
+    if (callback.state === null || callback.state.length === 0) {
+      throw new Error("OAuth callback missing state");
+    }
+    if (callback.state !== expected.state) {
+      throw new Error("OAuth callback state mismatch");
+    }
+  }
+  if (expected.requireIssuer) {
+    if (callback.iss === null || callback.iss.length === 0) {
+      throw new Error("OAuth callback missing issuer");
+    }
+  }
+  if (callback.iss !== null && callback.iss.length > 0 && expected.issuer !== null && callback.iss !== expected.issuer) {
+    throw new Error("OAuth callback issuer mismatch");
+  }
+}
+function createAuthorizationError(error, description) {
+  return new Error(`OAuth authorization failed: ${error} \u2014 ${description}`);
+}
+function escapeHtml(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function buildSuccessPage(landingPage) {
+  const title = landingPage?.title ?? "Connected";
+  const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
+  return [
+    "<!DOCTYPE html>",
+    `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
+    '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+    '<div style="text-align:center">',
+    `<h1>${escapeHtml(title)}</h1>`,
+    `<p style="color:#666">${escapeHtml(body)}</p>`,
+    "</div></body></html>"
+  ].join("");
+}
+
 // ../mcp-oauth/dist/client/scope.js
 function normalizeOAuthScope(scope) {
   if (scope === void 0)
@@ -3512,6 +3817,17 @@ function normalizeStoredOAuthClient(value) {
   if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === ""))
     return null;
   const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const requestedRedirectUri = Object.hasOwn(record2, "requestedRedirectUri") ? record2.requestedRedirectUri : void 0;
+  if (requestedRedirectUri !== void 0) {
+    try {
+      if (typeof requestedRedirectUri !== "string")
+        throw new Error("Invalid redirect identity");
+      loopbackTarget({ redirectUri: requestedRedirectUri });
+    } catch {
+      throw new Error("Invalid stored OAuth registration redirect identity");
+    }
+    client.requestedRedirectUri = requestedRedirectUri;
+  }
   const method = normalizeOAuthTokenEndpointAuthMethod(Object.hasOwn(record2, "tokenEndpointAuthMethod") ? record2.tokenEndpointAuthMethod : void 0);
   if (Object.hasOwn(record2, "registration") && record2.registration !== void 0) {
     const registration = parseOAuthClientRegistration(record2.registration);
@@ -3529,9 +3845,38 @@ function normalizeStoredOAuthClient(value) {
     client.tokenEndpointAuthMethod = method;
   return client;
 }
+function registrationMatchesRedirect(client, requestedUri, fresh = false) {
+  if (client.requestedRedirectUri !== void 0)
+    return client.requestedRedirectUri === requestedUri;
+  const redirects = client.registration?.redirect_uris;
+  if (redirects === void 0 || redirects === null || redirects.length === 0)
+    return true;
+  return redirects.some((returnedUri) => {
+    if (returnedUri === requestedUri)
+      return true;
+    if (!fresh)
+      return false;
+    let returned, requested;
+    try {
+      returned = new URL(returnedUri);
+      requested = new URL(requestedUri);
+    } catch {
+      return false;
+    }
+    if (requested.protocol !== "http:" || returned.protocol !== "http:" || !["127.0.0.1", "[::1]", "localhost"].includes(requested.hostname))
+      return false;
+    const sameHost = returned.hostname === requested.hostname;
+    const normalizedIpv4 = requested.hostname === "127.0.0.1" && returned.hostname === "localhost" && returned.port === "";
+    if (!sameHost && !normalizedIpv4)
+      return false;
+    returned.hostname = requested.hostname;
+    returned.port = requested.port;
+    return returned.href === requested.href;
+  });
+}
 
 // ../mcp-oauth/dist/client/auth-store-session-store.js
-import crypto from "node:crypto";
+import crypto2 from "node:crypto";
 import path4 from "node:path";
 
 // ../auth-store/dist/encrypted-file-store.js
@@ -3955,10 +4300,10 @@ function parseEncryptedDocument(raw) {
     if (!isRecord2(parsed)) {
       return null;
     }
-    const version = getOwnEntry(parsed, "version");
-    const iv = getOwnEntry(parsed, "iv");
-    const authTag = getOwnEntry(parsed, "authTag");
-    const ciphertext = getOwnEntry(parsed, "ciphertext");
+    const version = getOwnEntry2(parsed, "version");
+    const iv = getOwnEntry2(parsed, "iv");
+    const authTag = getOwnEntry2(parsed, "authTag");
+    const ciphertext = getOwnEntry2(parsed, "ciphertext");
     if (version !== ENCRYPTION_VERSION) {
       return null;
     }
@@ -3978,7 +4323,7 @@ function parseEncryptedDocument(raw) {
 function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function getOwnEntry(record2, key2) {
+function getOwnEntry2(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 function isNotFoundError(error) {
@@ -4139,552 +4484,247 @@ function createSecurityCliFailure(operation, result) {
   return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
 }
 function getCommandExitCode(result) {
-  const value = getOwnEntry2(result, "exitCode");
+  const value = getOwnEntry3(result, "exitCode");
   return typeof value === "number" && Number.isInteger(value) ? value : 1;
 }
 function getCommandOutput(result, key2) {
-  const value = getOwnEntry2(result, key2);
-  return typeof value === "string" ? value : "";
-}
-function getOwnEntry2(record2, key2) {
-  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
-}
-
-// ../auth-store/dist/create-secret-store.js
-var DEFAULT_BACKEND_ENV_VAR = "AUTH_BACKEND";
-var MACOS_PLATFORM = "darwin";
-var storeFactories = {
-  file: (input) => {
-    if (!input.fileStore) {
-      throw new Error("fileStore configuration is required for file backend");
-    }
-    return new EncryptedFileStore(input.fileStore);
-  },
-  keychain: (input) => {
-    if (!input.keychainStore) {
-      throw new Error("keychainStore configuration is required for keychain backend");
-    }
-    return new KeychainStore(input.keychainStore);
-  }
-};
-function createSecretStore(input) {
-  const backend = resolveBackend(input);
-  const platform = input.platform ?? process.platform;
-  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
-    throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
-  }
-  const store = storeFactories[backend](input);
-  return { backend, store };
-}
-function resolveBackend(input) {
-  const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
-  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
-  const backend = configuredBackend?.trim();
-  if (backend === "keychain") {
-    return "keychain";
-  }
-  if (backend === void 0 || backend === "file") {
-    return "file";
-  }
-  throw new Error(`Unsupported auth store backend: ${backend}`);
-}
-function getOwnEnvValue(env, key2) {
-  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
-}
-
-// ../mcp-oauth/dist/resource-indicator.js
-function canonicalizeResourceIndicator(value) {
-  let url;
-  try {
-    url = value instanceof URL ? new URL(value.toString()) : new URL(value);
-  } catch {
-    throw new Error("Resource indicator must be an absolute URL");
-  }
-  url.hash = "";
-  return url.toString();
-}
-
-// ../mcp-oauth/dist/client/auth-store-session-store.js
-var DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
-var DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
-var DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
-var DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
-var DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
-var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
-var MAX_JS_DATE_MS = 864e13;
-function createAuthStoreSessionStore(options = {}, namespace) {
-  assertPersistenceNamespace(namespace);
-  return {
-    async withLock(resource, operation, lockOptions) {
-      const store = createResourceSecretStore(resource, options, namespace);
-      if (store.withLock === void 0)
-        throw new Error("OAuth secret-store backend does not support transaction locks");
-      return store.withLock(operation, lockOptions);
-    },
-    async load(resource) {
-      const store = createResourceSecretStore(resource, options, namespace);
-      const value = await store.get();
-      if (value === null) {
-        return null;
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(value);
-      } catch {
-        throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
-      }
-      if (isStoredOAuthSession(parsed)) {
-        return parsed;
-      }
-      throw new Error("Stored OAuth session must match the expected shape");
-    },
-    async save(resource, session) {
-      const store = createResourceSecretStore(resource, options, namespace);
-      await store.set(JSON.stringify(session));
-    },
-    async clear(resource) {
-      const store = createResourceSecretStore(resource, options, namespace);
-      await store.delete();
-    }
-  };
-}
-function createAuthStoreClientStore(options, namespace) {
-  assertPersistenceNamespace(namespace);
-  return {
-    async load(issuer) {
-      const store = createIssuerSecretStore(issuer, options, namespace);
-      const value = await store.get();
-      if (value === null) {
-        return null;
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(value);
-      } catch {
-        throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
-      }
-      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
-        return parsed;
-      throw new Error("Stored OAuth client must be a JSON object with clientId");
-    },
-    async save(issuer, client) {
-      const store = createIssuerSecretStore(issuer, options, namespace);
-      await store.set(JSON.stringify(client));
-    },
-    async clear(issuer) {
-      const store = createIssuerSecretStore(issuer, options, namespace);
-      await store.delete();
-    }
-  };
-}
-function createNamedSecretStore(key2, options, defaults, namespace) {
-  const hash = crypto.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
-  const configuredFilePath = options.fileStore?.filePath;
-  const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
-  const fileStore = {
-    ...options.fileStore,
-    throwOnInvalidDocument: true,
-    filePath: parsedFilePath === null ? void 0 : path4.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
-    salt: options.fileStore?.salt ?? defaults.salt,
-    defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
-    defaultFileName: parsedFilePath === null ? `${hash}.enc` : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
-  };
-  const keychainStore = {
-    ...options.keychainStore,
-    service: options.keychainStore?.service ?? defaults.service,
-    account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
-  };
-  return createSecretStore({ ...options, fileStore, keychainStore }).store;
-}
-function createResourceSecretStore(resource, options, namespace) {
-  return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
-    salt: DEFAULT_FILE_SALT,
-    directory: DEFAULT_FILE_DIRECTORY,
-    service: DEFAULT_KEYCHAIN_SERVICE,
-    accountPrefix: "provider"
-  }, namespace);
-}
-function createIssuerSecretStore(issuer, options, namespace) {
-  return createNamedSecretStore(issuer, options, {
-    salt: DEFAULT_CLIENT_FILE_SALT,
-    directory: DEFAULT_CLIENT_FILE_DIRECTORY,
-    service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
-    accountPrefix: "issuer"
-  }, namespace);
-}
-function assertPersistenceNamespace(namespace) {
-  if (namespace !== void 0 && (typeof namespace !== "string" || namespace.trim() === "" || Buffer.byteLength(namespace, "utf8") > 1024))
-    throw new Error("OAuth persistence namespace must be a nonempty string within 1024 bytes");
-}
-function isObjectRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+  const value = getOwnEntry3(result, key2);
+  return typeof value === "string" ? value : "";
 }
 function getOwnEntry3(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
-function getOwnString(record2, key2) {
-  const value = getOwnEntry3(record2, key2);
-  return typeof value === "string" ? value : void 0;
-}
-function isStoredOAuthSession(value) {
-  if (!isObjectRecord(value)) {
-    return false;
+
+// ../auth-store/dist/create-secret-store.js
+var DEFAULT_BACKEND_ENV_VAR = "AUTH_BACKEND";
+var MACOS_PLATFORM = "darwin";
+var storeFactories = {
+  file: (input) => {
+    if (!input.fileStore) {
+      throw new Error("fileStore configuration is required for file backend");
+    }
+    return new EncryptedFileStore(input.fileStore);
+  },
+  keychain: (input) => {
+    if (!input.keychainStore) {
+      throw new Error("keychainStore configuration is required for keychain backend");
+    }
+    return new KeychainStore(input.keychainStore);
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
-}
-function isStoredOAuthDiscovery(value) {
-  if (!isObjectRecord(value)) {
-    return false;
+};
+function createSecretStore(input) {
+  const backend = resolveBackend(input);
+  const platform = input.platform ?? process.platform;
+  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
+    throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
   }
-  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord(getOwnEntry3(value, "resourceMetadata")) && isObjectRecord(getOwnEntry3(value, "authorizationServerMetadata"));
+  const store = storeFactories[backend](input);
+  return { backend, store };
 }
-function isStoredOAuthTokensOrMissing(value) {
-  if (value === void 0) {
-    return true;
-  }
-  if (!isObjectRecord(value)) {
-    return false;
-  }
-  if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
-    return false;
-  }
-  const expiresAt = getOwnEntry3(value, "expiresAt");
-  if (expiresAt !== null && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime()))) {
-    return false;
+function resolveBackend(input) {
+  const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
+  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
+  const backend = configuredBackend?.trim();
+  if (backend === "keychain") {
+    return "keychain";
   }
-  const refreshToken = getOwnEntry3(value, "refreshToken");
-  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
-    return false;
+  if (backend === void 0 || backend === "file") {
+    return "file";
   }
-  const scope = getOwnEntry3(value, "scope");
-  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
-}
-function isNonBlankOwnString(record2, key2) {
-  const value = getOwnString(record2, key2);
-  return value !== void 0 && value.trim().length > 0;
+  throw new Error(`Unsupported auth store backend: ${backend}`);
 }
-
-// ../mcp-oauth/dist/client/default-oauth-client-provider.js
-import { isIP } from "node:net";
-
-// ../mcp-oauth/dist/http-fetch.js
-async function fetchMcpResponse(fetchImplementation, input, init = {}) {
-  const response = await fetchImplementation(input, { ...init, redirect: "error" });
-  if (response.redirected || response.type === "opaqueredirect") {
-    void response.body?.cancel().catch(() => void 0);
-    throw new Error("MCP HTTP redirects are not allowed");
-  }
-  return response;
+function getOwnEnvValue(env, key2) {
+  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
 }
 
-// ../mcp-oauth/dist/client/default-oauth-client-provider.js
-import { URL as URL2 } from "node:url";
-
-// ../mcp-oauth/dist/client/loopback-authorization.js
-import http from "node:http";
-
-// ../mcp-oauth/dist/client/authorization-state.js
-import crypto2 from "node:crypto";
-function createAuthorizationState(input) {
-  const payload = {
-    v: 1,
-    n: crypto2.randomBytes(16).toString("base64url"),
-    i: input.issuer,
-    r: input.requireIssuer
-  };
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-}
-function parseAuthorizationState(value) {
-  if (value === null || value.length === 0) {
-    return null;
-  }
+// ../mcp-oauth/dist/resource-indicator.js
+function canonicalizeResourceIndicator(value) {
+  let url;
   try {
-    const decoded = Buffer.from(value, "base64url").toString("utf8");
-    const parsed = JSON.parse(decoded);
-    if (!isObjectRecord2(parsed)) {
-      return null;
-    }
-    const version = getOwnEntry4(parsed, "v");
-    const nonce = getOwnEntry4(parsed, "n");
-    const issuer = getOwnEntry4(parsed, "i");
-    const requireIssuer = getOwnEntry4(parsed, "r");
-    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
-      return null;
-    }
-    return {
-      issuer,
-      requireIssuer
-    };
+    url = value instanceof URL ? new URL(value.toString()) : new URL(value);
   } catch {
-    return null;
+    throw new Error("Resource indicator must be an absolute URL");
   }
-}
-function isObjectRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getOwnEntry4(record2, key2) {
-  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+  url.hash = "";
+  return url.toString();
 }
 
-// ../mcp-oauth/dist/client/loopback-authorization.js
-async function createLoopbackAuthorizationSession(options = {}) {
-  options.signal?.throwIfAborted();
-  const timeoutMs = options.timeoutMs ?? 12e4;
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
-    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
-  const target = loopbackTarget(options);
-  const server = options.createServer ? options.createServer() : http.createServer();
-  const controller = new AbortController();
-  let closed = false;
-  let used = false;
-  const callerAbort = () => controller.abort(options.signal?.reason);
-  const teardown = () => {
-    if (closed)
-      return;
-    closed = true;
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", callerAbort);
-    server.closeAllConnections?.();
-    server.close();
-  };
-  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-  timer.unref?.();
-  controller.signal.addEventListener("abort", teardown, { once: true });
-  options.signal?.addEventListener("abort", callerAbort, { once: true });
-  if (options.signal?.aborted)
-    callerAbort();
-  let port;
-  try {
-    port = await startServer(server, target.port, target.host, controller.signal);
-  } catch (error) {
-    controller.abort(error);
-    throw error;
-  }
-  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
+// ../mcp-oauth/dist/client/auth-store-session-store.js
+var DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
+var DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
+var DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
+var DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
+var DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
+var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+var MAX_JS_DATE_MS = 864e13;
+function createAuthStoreSessionStore(options = {}, namespace) {
+  assertPersistenceNamespace(namespace);
   return {
-    redirectUri,
-    async waitForCode(authorizationUrl) {
-      controller.signal.throwIfAborted();
-      if (used)
-        throw new Error("OAuth authorization session has already been used");
-      used = true;
-      try {
-        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
-      } finally {
-        clearTimeout(timer);
-      }
-    },
-    close() {
-      controller.abort(new Error("OAuth authorization session closed"));
-    }
-  };
-}
-function loopbackTarget(options) {
-  if (options.redirectUri !== void 0) {
-    let url;
-    try {
-      url = new URL(options.redirectUri);
-    } catch (cause) {
-      throw new Error("Invalid OAuth loopback redirect URI", { cause });
-    }
-    const forbiddenQuery = ["code", "state", "error", "error_description", "iss"];
-    if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.hash || url.port === "0" || forbiddenQuery.some((name) => url.searchParams.has(name)) || [...options.redirectUri].some((char) => char.codePointAt(0) <= 32) || options.callbackPath !== void 0 && options.callbackPath !== url.pathname)
-      throw new Error("Invalid OAuth loopback redirect URI");
-    return { port: url.port ? Number(url.port) : 80, host: url.hostname === "[::1]" ? "::1" : url.hostname, callbackPath: url.pathname };
-  }
-  const callbackPath = options.callbackPath ?? "/callback";
-  const parsed = new URL(callbackPath, "http://127.0.0.1");
-  if (!callbackPath.startsWith("/") || parsed.origin !== "http://127.0.0.1" || parsed.pathname !== callbackPath || parsed.search || parsed.hash)
-    throw new Error("Invalid OAuth loopback callback path");
-  return { port: 0, host: "127.0.0.1", callbackPath };
-}
-async function startServer(server, port, host, signal) {
-  signal.throwIfAborted();
-  return new Promise((resolve, reject) => {
-    const cleanup = () => {
-      server.off("error", handleError);
-      signal.removeEventListener("abort", aborted);
-    };
-    const handleError = (error) => {
-      cleanup();
-      reject(error);
-    };
-    const aborted = () => {
-      cleanup();
-      reject(signal.reason);
-    };
-    server.once("error", handleError);
-    signal.addEventListener("abort", aborted, { once: true });
-    try {
-      server.listen(port, host, () => {
-        cleanup();
-        if (signal.aborted) {
-          server.close();
-          reject(signal.reason);
-          return;
-        }
-        const address = server.address();
-        if (address === null || typeof address === "string") {
-          reject(new Error("OAuth listener has no TCP address"));
-          return;
-        }
-        resolve(address.port);
-      });
-    } catch (error) {
-      cleanup();
-      reject(error);
-    }
-  });
-}
-function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
-  signal.throwIfAborted();
-  const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const settle = (fn) => {
-      if (settled)
-        return;
-      settled = true;
-      server.off("request", request);
-      signal.removeEventListener("abort", aborted);
-      fn();
-    };
-    const aborted = () => settle(() => reject(signal.reason));
-    const request = (req, res) => {
-      let url;
+    async withLock(resource, operation, lockOptions) {
+      const store = createResourceSecretStore(resource, options, namespace);
+      if (store.withLock === void 0)
+        throw new Error("OAuth secret-store backend does not support transaction locks");
+      return store.withLock(operation, lockOptions);
+    },
+    async load(resource) {
+      const store = createResourceSecretStore(resource, options, namespace);
+      const value = await store.get();
+      if (value === null) {
+        return null;
+      }
+      let parsed;
       try {
-        url = new URL(req.url ?? "/", "http://127.0.0.1");
+        parsed = JSON.parse(value);
       } catch {
-        res.writeHead(400);
-        res.end("Invalid callback URL");
-        return;
+        throw new Error("Stored OAuth session must be valid JSON; reset the store explicitly to recover");
       }
-      if (url.pathname !== callbackPath) {
-        res.writeHead(404);
-        res.end("Not found");
-        return;
+      if (isStoredOAuthSession(parsed)) {
+        return parsed;
       }
-      const callbackParameters = {
-        code: url.searchParams.get("code"),
-        error: url.searchParams.get("error"),
-        errorDescription: url.searchParams.get("error_description"),
-        state: url.searchParams.get("state"),
-        iss: url.searchParams.get("iss")
-      };
+      throw new Error("Stored OAuth session must match the expected shape");
+    },
+    async save(resource, session) {
+      const store = createResourceSecretStore(resource, options, namespace);
+      await store.set(JSON.stringify(session));
+    },
+    async clear(resource) {
+      const store = createResourceSecretStore(resource, options, namespace);
+      await store.delete();
+    }
+  };
+}
+function createAuthStoreClientStore(options, namespace) {
+  assertPersistenceNamespace(namespace);
+  return {
+    async load(issuer) {
+      const store = createIssuerSecretStore(issuer, options, namespace);
+      const value = await store.get();
+      if (value === null) {
+        return null;
+      }
+      let parsed;
       try {
-        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-        if (callbackParameters.error !== null)
-          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
-        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(buildSuccessPage(options.landingPage));
-        settle(() => resolve(code));
-      } catch (error) {
-        res.writeHead(400);
-        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-        settle(() => reject(error));
+        parsed = JSON.parse(value);
+      } catch {
+        throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-    };
-    server.on("request", request);
-    signal.addEventListener("abort", aborted, { once: true });
-    if (options.readLine !== void 0) {
-      void Promise.resolve().then(() => settled ? void 0 : options.readLine()).then((input) => {
-        if (settled)
-          return;
-        const callbackParameters = extractCallbackParametersFromInput(input);
-        if (callbackParameters === null)
-          throw new Error("OAuth callback missing authorization code");
-        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-        if (callbackParameters.error !== null)
-          throw createAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
-        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-        settle(() => resolve(code));
-      }).catch((error) => settle(() => reject(error)));
-    }
-    if (options.openBrowser !== void 0) {
-      void Promise.resolve().then(() => settled ? void 0 : options.openBrowser(authorizationUrl)).catch((error) => settle(() => reject(error)));
+      if (isObjectRecord2(parsed) && typeof getOwnEntry4(parsed, "clientId") === "string")
+        return parsed;
+      throw new Error("Stored OAuth client must be a JSON object with clientId");
+    },
+    async save(issuer, client) {
+      const store = createIssuerSecretStore(issuer, options, namespace);
+      await store.set(JSON.stringify(client));
+    },
+    async clear(issuer) {
+      const store = createIssuerSecretStore(issuer, options, namespace);
+      await store.delete();
     }
-  });
-}
-function extractCallbackParametersFromInput(input) {
-  const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
-  if (trimmed.length === 0) {
-    return null;
-  }
-  try {
-    const url = new URL(trimmed);
-    return {
-      code: url.searchParams.get("code"),
-      error: url.searchParams.get("error"),
-      errorDescription: url.searchParams.get("error_description"),
-      state: url.searchParams.get("state"),
-      iss: url.searchParams.get("iss")
-    };
-  } catch {
-    return {
-      code: trimmed,
-      error: null,
-      errorDescription: null,
-      state: null,
-      iss: null
-    };
-  }
+  };
 }
-function readExpectedAuthorizationCallback(authorizationUrl) {
-  const url = new URL(authorizationUrl);
-  const state = url.searchParams.get("state");
-  const parsedState = parseAuthorizationState(state);
-  return {
-    state,
-    issuer: parsedState?.issuer ?? null,
-    requireIssuer: parsedState?.requireIssuer ?? false
+function createNamedSecretStore(key2, options, defaults, namespace) {
+  const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
+  const configuredFilePath = options.fileStore?.filePath;
+  const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
+  const fileStore = {
+    ...options.fileStore,
+    throwOnInvalidDocument: true,
+    filePath: parsedFilePath === null ? void 0 : path4.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
+    salt: options.fileStore?.salt ?? defaults.salt,
+    defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
+    defaultFileName: parsedFilePath === null ? `${hash}.enc` : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
+  };
+  const keychainStore = {
+    ...options.keychainStore,
+    service: options.keychainStore?.service ?? defaults.service,
+    account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
   };
+  return createSecretStore({ ...options, fileStore, keychainStore }).store;
 }
-function validateAuthorizationCallbackParameters(callback, expected) {
-  validateAuthorizationCallbackBinding(callback, expected);
-  if (callback.code === null || callback.code.length === 0) {
-    throw new Error("OAuth callback missing authorization code");
+function createResourceSecretStore(resource, options, namespace) {
+  return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
+    salt: DEFAULT_FILE_SALT,
+    directory: DEFAULT_FILE_DIRECTORY,
+    service: DEFAULT_KEYCHAIN_SERVICE,
+    accountPrefix: "provider"
+  }, namespace);
+}
+function createIssuerSecretStore(issuer, options, namespace) {
+  return createNamedSecretStore(issuer, options, {
+    salt: DEFAULT_CLIENT_FILE_SALT,
+    directory: DEFAULT_CLIENT_FILE_DIRECTORY,
+    service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
+    accountPrefix: "issuer"
+  }, namespace);
+}
+function assertPersistenceNamespace(namespace) {
+  if (namespace !== void 0 && (typeof namespace !== "string" || namespace.trim() === "" || Buffer.byteLength(namespace, "utf8") > 1024))
+    throw new Error("OAuth persistence namespace must be a nonempty string within 1024 bytes");
+}
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry4(record2, key2) {
+  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+}
+function getOwnString(record2, key2) {
+  const value = getOwnEntry4(record2, key2);
+  return typeof value === "string" ? value : void 0;
+}
+function isStoredOAuthSession(value) {
+  if (!isObjectRecord2(value)) {
+    return false;
   }
-  return callback.code;
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry4(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry4(value, "discovery")) && (getOwnEntry4(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry4(value, "refreshState") === void 0 || getOwnEntry4(value, "refreshState") === "pending" && getOwnEntry4(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry4(value, "tokens"));
 }
-function validateAuthorizationCallbackBinding(callback, expected) {
-  if (expected.state !== null) {
-    if (callback.state === null || callback.state.length === 0) {
-      throw new Error("OAuth callback missing state");
-    }
-    if (callback.state !== expected.state) {
-      throw new Error("OAuth callback state mismatch");
-    }
+function isStoredOAuthDiscovery(value) {
+  if (!isObjectRecord2(value)) {
+    return false;
   }
-  if (expected.requireIssuer) {
-    if (callback.iss === null || callback.iss.length === 0) {
-      throw new Error("OAuth callback missing issuer");
-    }
+  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord2(getOwnEntry4(value, "resourceMetadata")) && isObjectRecord2(getOwnEntry4(value, "authorizationServerMetadata"));
+}
+function isStoredOAuthTokensOrMissing(value) {
+  if (value === void 0) {
+    return true;
   }
-  if (callback.iss !== null && callback.iss.length > 0 && expected.issuer !== null && callback.iss !== expected.issuer) {
-    throw new Error("OAuth callback issuer mismatch");
+  if (!isObjectRecord2(value)) {
+    return false;
   }
+  if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+    return false;
+  }
+  const expiresAt = getOwnEntry4(value, "expiresAt");
+  if (expiresAt !== null && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime()))) {
+    return false;
+  }
+  const refreshToken = getOwnEntry4(value, "refreshToken");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+    return false;
+  }
+  const scope = getOwnEntry4(value, "scope");
+  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
 }
-function createAuthorizationError(error, description) {
-  return new Error(`OAuth authorization failed: ${error} \u2014 ${description}`);
-}
-function escapeHtml(text) {
-  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+function isNonBlankOwnString(record2, key2) {
+  const value = getOwnString(record2, key2);
+  return value !== void 0 && value.trim().length > 0;
 }
-function buildSuccessPage(landingPage) {
-  const title = landingPage?.title ?? "Connected";
-  const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
-  return [
-    "<!DOCTYPE html>",
-    `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
-    '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
-    '<div style="text-align:center">',
-    `<h1>${escapeHtml(title)}</h1>`,
-    `<p style="color:#666">${escapeHtml(body)}</p>`,
-    "</div></body></html>"
-  ].join("");
+
+// ../mcp-oauth/dist/client/default-oauth-client-provider.js
+import { isIP } from "node:net";
+
+// ../mcp-oauth/dist/http-fetch.js
+async function fetchMcpResponse(fetchImplementation, input, init = {}) {
+  const response = await fetchImplementation(input, { ...init, redirect: "error" });
+  if (response.redirected || response.type === "opaqueredirect") {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error("MCP HTTP redirects are not allowed");
+  }
+  return response;
 }
 
+// ../mcp-oauth/dist/client/default-oauth-client-provider.js
+import { URL as URL2 } from "node:url";
+
 // ../mcp-oauth/dist/client/pkce.js
 import crypto3 from "node:crypto";
 function generateCodeVerifier() {
@@ -4999,7 +5039,7 @@ function createDefaultOAuthClientProvider(options) {
   }
   const initialGrant = options.initialGrant === void 0 ? void 0 : {
     resource: canonicalizeResourceIndicator(options.initialGrant.resource),
-    tokens: normalizeStoredTokens(options.initialGrant.tokens),
+    tokens: normalizeImportedTokens(options.initialGrant.tokens, now),
     client: configuredClient
   };
   if (initialGrant !== void 0 && (initialGrant.tokens === void 0 || initialGrant.client === null))
@@ -5077,6 +5117,10 @@ function createDefaultOAuthClientProvider(options) {
     const canonicalResource = canonicalizeResourceIndicator(resource);
     return withOAuthSessionTransaction(sessionStore, canonicalResource, async () => {
       let session = await loadSession(canonicalResource);
+      if (session !== null)
+        assertRegistrationIssuer(session.client, session.authorizationServer);
+      if (configuredClient !== null && discovery !== void 0)
+        assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
       if (session !== null && initialGrant?.resource === canonicalResource)
         initialGrantConsumed = true;
       signal?.throwIfAborted();
@@ -5122,6 +5166,11 @@ function createDefaultOAuthClientProvider(options) {
         return session;
       }
       if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
+        if (hasExpiredClientSecret(session.client, now)) {
+          if (!allowInteractive || options.allowInteractive === false || options.client.mode === "static" || configuredClient?.registration !== void 0)
+            throw new Error("OAuth client secret has expired; authorize again or update the imported registration");
+          return authorizeSession(canonicalResource, clearSessionTokens(session), sessionDiscovery, fetch2, signal);
+        }
         session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2, signal);
         if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
           return session;
@@ -5289,6 +5338,9 @@ function createDefaultOAuthClientProvider(options) {
       if (configuredClient === null) {
         throw new Error("OAuth client_id must not be blank");
       }
+      assertRegistrationIssuer(configuredClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(configuredClient, now))
+        throw new Error("OAuth client secret has expired; update the imported registration");
       return {
         kind: "static",
         fromStoredRegistration: false,
@@ -5303,7 +5355,14 @@ function createDefaultOAuthClientProvider(options) {
         client: configuredClient
       };
     }
-    const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    let storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    if (storedClient !== null) {
+      assertRegistrationIssuer(storedClient, discovery.authorizationServer);
+      if (hasExpiredClientSecret(storedClient, now) || !registrationMatchesRedirect(storedClient, redirectUri)) {
+        await clearRegisteredClient(discovery.authorizationServer);
+        storedClient = null;
+      }
+    }
     if (storedClient !== null) {
       return {
         kind: "dynamic",
@@ -5312,7 +5371,7 @@ function createDefaultOAuthClientProvider(options) {
       };
     }
     if (registrationEndpoint === void 0) {
-      if (existingSession !== null && existingSession.client.clientId.length > 0) {
+      if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
         return {
           kind: "dynamic",
           fromStoredRegistration: true,
@@ -5321,7 +5380,7 @@ function createDefaultOAuthClientProvider(options) {
       }
       throw new Error("Authorization server metadata is missing registration_endpoint");
     }
-    if (existingSession !== null && existingSession.client.clientId.length > 0) {
+    if (existingSession !== null && existingSession.client.clientId.length > 0 && !hasExpiredClientSecret(existingSession.client, now) && registrationMatchesRedirect(existingSession.client, redirectUri)) {
       const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
       if (!isConfiguredStaticFallback) {
         await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
@@ -5357,11 +5416,17 @@ function createDefaultOAuthClientProvider(options) {
       ...responseMethod === void 0 ? {} : { tokenEndpointAuthMethod: responseMethod },
       registration
     };
-    await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+    assertRegistrationIssuer(registeredClient, discovery.authorizationServer);
+    if (hasExpiredClientSecret(registeredClient, now))
+      throw new Error("OAuth client secret has expired in the registration response");
+    if (!registrationMatchesRedirect(registeredClient, redirectUri, true))
+      throw new Error("OAuth registration response does not match the requested redirect URI");
+    const clientWithRedirect = { ...registeredClient, requestedRedirectUri: redirectUri };
+    await saveRegisteredClient(discovery.authorizationServer, clientWithRedirect);
     return {
       kind: "dynamic",
       fromStoredRegistration: false,
-      client: registeredClient
+      client: clientWithRedirect
     };
   }
   async function loadSession(resource) {
@@ -5464,6 +5529,19 @@ function normalizeLoadedSession(session) {
     tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
   };
 }
+function normalizeImportedTokens(value, now) {
+  if (!isObjectRecord3(value))
+    return void 0;
+  const absolute = getOwnEntry6(value, "expiresAt");
+  const lifetime = getOwnEntry6(value, "expiresIn");
+  const issuedAt = getOwnEntry6(value, "issuedAt");
+  if (lifetime !== void 0 && (typeof lifetime !== "number" || !Number.isSafeInteger(lifetime) || lifetime < 0))
+    throw new Error("OAuth initial grant has invalid relative expiry");
+  if (issuedAt !== void 0 && (typeof issuedAt !== "number" || !Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS3))
+    throw new Error("OAuth initial grant has invalid issuance time");
+  const expiresAt = absolute !== void 0 && absolute !== null ? absolute : lifetime === void 0 ? null : (issuedAt === void 0 ? now() : issuedAt) + lifetime * 1e3;
+  return normalizeStoredTokens({ ...value, expiresAt });
+}
 function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
@@ -5604,6 +5682,17 @@ function assertRequestMatchesResource(requestUrl, resource) {
     throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
   }
 }
+function assertRegistrationIssuer(client, issuer) {
+  const registrationIssuer = client.registration === void 0 ? void 0 : getOwnString2(client.registration, "issuer");
+  if (registrationIssuer !== void 0 && registrationIssuer !== issuer)
+    throw new Error("OAuth client registration issuer does not match the authorization server");
+}
+function hasExpiredClientSecret(client, now) {
+  if (client.clientSecret === void 0 || client.tokenEndpointAuthMethod === "none" || client.registration === void 0)
+    return false;
+  const expiry = getOwnEntry6(client.registration, "client_secret_expires_at");
+  return typeof expiry === "number" && expiry !== 0 && expiry <= now() / 1e3;
+}
 function getSupportedTokenAuthMethods(metadata) {
   const value = getOwnEntry6(metadata, "token_endpoint_auth_methods_supported");
   if (value === void 0)