@creezio/mcp-facade 0.22.0

package/dist/module-ops-tools.js

@@ -0,0 +1,301 @@
+/**
+ * Génération des tools MCP depuis les opérations de module (SoT).
+ * Handler = requête synthétique vers le même mount HTTP — zéro 2e implémentation.
+ */
+import { entityOperationsFromSpec, resolveOperationHttpPath, } from "@creezio/api-kernel";
+import { dynImport } from "./dyn-import.js";
+import { verifyAccessToken } from "./oauth/store.js";
+/**
+ * Access token OAuth MCP (HS256 MCP_JWT_SECRET — ChatGPT & co) → session
+ * plateforme mintée pour le user du consentement (`uid`). Les gardes marque
+ * (`requireSession`) ne connaissent que les JWT session AUTH_SECRET : sans
+ * cette conversion, tout tool `module.*` répond 401 malgré un OAuth valide.
+ * Fail-closed : uid absent/inconnu ou stores indisponibles → null (le 401
+ * métier reste la réponse).
+ */
+async function mintSessionFromMcpAccessToken(token) {
+    let userId = "";
+    try {
+        const payload = await verifyAccessToken(token);
+        userId = (payload?.user_id || "").trim();
+    }
+    catch {
+        return null; // adapters OAuth non configurés (façade standalone)
+    }
+    if (!userId)
+        return null;
+    try {
+        const [authMod, tasksMod] = await Promise.all([
+            dynImport("@creezio/auth"),
+            dynImport("@creezio/tasks"),
+        ]);
+        if (!authMod.createSessionToken)
+            return null;
+        const users = tasksMod.getTasksBrandConfig?.()?.users;
+        let user = null;
+        try {
+            const found = users?.list().find((u) => u.id === userId && u.active !== false) ??
+                null;
+            if (found) {
+                user = {
+                    id: found.id,
+                    username: found.username,
+                    role: found.role === "owner" ? "owner" : found.role || "collaborator",
+                    permissions: [...(found.permissions || [])],
+                };
+            }
+        }
+        catch {
+            /* store users indisponible → fallback owner ci-dessous */
+        }
+        if (!user) {
+            try {
+                const owner = users?.getOwner?.() ?? null;
+                if (owner && owner.id === userId) {
+                    user = {
+                        id: owner.id,
+                        username: owner.username,
+                        role: "owner",
+                        permissions: [...(owner.permissions || [])],
+                    };
+                }
+            }
+            catch {
+                /* fail-closed */
+            }
+        }
+        if (!user)
+            return null;
+        return await authMod.createSessionToken({ user });
+    }
+    catch {
+        return null;
+    }
+}
+/** Cookie + Authorization pour `requireSession` sur la req synthétique. */
+async function headersFromActor(actor) {
+    const headers = {};
+    if (actor?.headers) {
+        for (const [key, value] of Object.entries(actor.headers)) {
+            if (value == null || value === "")
+                continue;
+            headers[key.toLowerCase()] = String(value);
+        }
+    }
+    const raw = (actor?.bearerToken || "").trim();
+    if (raw) {
+        const token = raw.replace(/^Bearer\s+/i, "").trim();
+        if (token && !headers.authorization) {
+            headers.authorization = `Bearer ${token}`;
+        }
+    }
+    // Bearer JWT : si c'est un access token OAuth MCP, le convertir en
+    // session plateforme mintée (sinon inchangé — JWT session déjà valide).
+    const authz = (headers.authorization || "")
+        .replace(/^Bearer\s+/i, "")
+        .trim();
+    if (authz && authz.split(".").length === 3) {
+        const minted = await mintSessionFromMcpAccessToken(authz);
+        if (minted)
+            headers.authorization = `Bearer ${minted}`;
+    }
+    return Object.keys(headers).length ? headers : undefined;
+}
+function interpolatePath(template, args) {
+    const used = new Set();
+    const path = template.replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, (_, name) => {
+        used.add(name);
+        const value = args[name];
+        return encodeURIComponent(value == null ? "" : String(value));
+    });
+    return { path, used };
+}
+function asQuery(rest) {
+    const query = {};
+    for (const [key, value] of Object.entries(rest)) {
+        if (value == null)
+            continue;
+        if (Array.isArray(value)) {
+            query[key] = value.map((v) => String(v)).join(",");
+            continue;
+        }
+        if (typeof value === "object")
+            continue;
+        query[key] = String(value);
+    }
+    return query;
+}
+function defaultInputSchema(op) {
+    if (op.inputSchema && typeof op.inputSchema === "object") {
+        return op.inputSchema;
+    }
+    const params = [
+        ...normalizePath(op.path).matchAll(/:([A-Za-z_][A-Za-z0-9_]*)/g),
+    ].map((m) => m[1]);
+    const properties = {};
+    for (const name of params)
+        properties[name] = { type: "string" };
+    return {
+        type: "object",
+        properties,
+        required: params,
+        additionalProperties: true,
+    };
+}
+function normalizePath(path) {
+    const raw = String(path || "").trim();
+    if (!raw || raw === "/")
+        return "/";
+    return raw.startsWith("/") ? raw : `/${raw}`;
+}
+function restArgs(args, used) {
+    const rest = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (used.has(key))
+            continue;
+        rest[key] = value;
+    }
+    return rest;
+}
+function responseToToolResult(res) {
+    if (res.status >= 400) {
+        const body = res.body;
+        return {
+            ok: false,
+            error: (body && typeof body === "object" && body.error) ||
+                `http_${res.status}`,
+            content: res.body,
+        };
+    }
+    return { ok: true, content: res.body };
+}
+/**
+ * Génère un tool MCP par op — `module.<id>.<op.id>`.
+ * Handler = requête synthétique (method/path/body) vers le même
+ * `ApiMount.handle` via `invokeMount` (typiquement `api.handle`) —
+ * zéro 2ᵉ implémentation métier.
+ */
+export function generateModuleToolsFromOperations(moduleId, ops, invokeMount, options = {}) {
+    const mountId = options.mountId || moduleId;
+    const space = options.space || "module";
+    const tools = [];
+    for (const op of ops) {
+        const template = resolveOperationHttpPath(space, mountId, op.path);
+        tools.push({
+            name: `module.${mountId}.${op.id}`,
+            description: op.description,
+            space: "module",
+            ownerId: moduleId,
+            inputSchema: defaultInputSchema(op),
+            ...(op.roles?.length ? { defaultRoles: op.roles } : {}),
+            mcpPublishDefault: op.mcpPublishDefault === true,
+            requiredScope: op.method === "GET" ? "crm:read" : op.permission || "crm:write",
+            handler: async (args, actor) => {
+                const { path, used } = interpolatePath(template, args);
+                const rest = restArgs(args, used);
+                const method = op.method;
+                const headers = await headersFromActor(actor);
+                const req = {
+                    method,
+                    path,
+                    ...(headers ? { headers } : {}),
+                    ...(method === "GET"
+                        ? { query: asQuery(rest) }
+                        : { body: rest }),
+                };
+                return responseToToolResult(await invokeMount(req));
+            },
+        });
+    }
+    return tools;
+}
+function toolsFromListedOps(api, listed, spaces) {
+    const byMount = new Map();
+    for (const { space, mountId, op } of listed) {
+        if (!spaces.has(space))
+            continue;
+        const cur = byMount.get(mountId);
+        if (cur) {
+            cur.ops.push(op);
+            continue;
+        }
+        byMount.set(mountId, { space, ops: [op] });
+    }
+    const invokeMount = (req) => api.handle(req);
+    const out = [];
+    for (const [mountId, { space, ops }] of byMount) {
+        out.push(...generateModuleToolsFromOperations(mountId, ops, invokeMount, {
+            mountId,
+            space,
+        }));
+    }
+    return out;
+}
+/**
+ * Tools `module.*` générés depuis `api.listOperations()` (space module).
+ * SoT runtime — `BrandModuleDef.mcpTools` n'existe plus.
+ */
+export function generateModuleToolsFromListedOps(api, listed) {
+    return toolsFromListedOps(api, listed ?? api.listOperations(), new Set(["module"]));
+}
+/** Tools générés depuis les mounts déjà enregistrés sur le kernel. */
+export function generateModuleToolsFromMountedOps(api, mounts) {
+    if (!mounts) {
+        return toolsFromListedOps(api, api.listOperations(), new Set(["module", "platform"]));
+    }
+    const out = [];
+    for (const mount of mounts) {
+        if (mount.space !== "module" && mount.space !== "platform")
+            continue;
+        if (!mount.operations?.length)
+            continue;
+        out.push(...generateModuleToolsFromOperations(mount.id, mount.operations, (req) => api.handle(req), { mountId: mount.id, space: mount.space }));
+    }
+    return out;
+}
+/**
+ * Discovery runtime : uniquement `listOperations()` (space module).
+ * `extraTools` = hook apps (health, JWT) — pas de `mcpTools` manuscrit.
+ */
+export function discoverModuleToolsFromKernel(api, extraTools = []) {
+    const generated = generateModuleToolsFromListedOps(api);
+    if (!extraTools.length)
+        return generated;
+    const seen = new Set(generated.map((t) => t.name));
+    return [...generated, ...extraTools.filter((t) => !seen.has(t.name))];
+}
+/**
+ * Discovery kit-side : SoT = `api.listOperations()` (space module).
+ * Fallback : ops des BrandModuleDef (EntitySpec CRUD + apiMounts) si le
+ * kernel n'a pas encore les mounts. Pas de champ `mcpTools`.
+ */
+export function discoverModuleToolsFromBrandModules(modules, api) {
+    const fromKernel = generateModuleToolsFromListedOps(api);
+    if (fromKernel.length)
+        return fromKernel;
+    const generated = [];
+    const invoke = (req) => api.handle(req);
+    for (const mod of modules) {
+        const seenOp = new Set();
+        for (const [mountId, spec] of Object.entries(mod.entitySpecs ?? {})) {
+            const ops = entityOperationsFromSpec(spec);
+            for (const op of ops)
+                seenOp.add(`${mountId}:${op.id}`);
+            generated.push(...generateModuleToolsFromOperations(mod.id, ops, invoke, {
+                mountId,
+                space: "module",
+            }));
+        }
+        for (const [mountId, mount] of Object.entries(mod.apiMounts ?? {})) {
+            const extras = (mount.operations ?? []).filter((op) => !seenOp.has(`${mountId}:${op.id}`));
+            if (!extras.length)
+                continue;
+            generated.push(...generateModuleToolsFromOperations(mod.id, extras, invoke, {
+                mountId,
+                space: "module",
+            }));
+        }
+    }
+    return generated;
+}
+//# sourceMappingURL=module-ops-tools.js.map

package/dist/module-ops-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-ops-tools.js","sourceRoot":"","sources":["../src/module-ops-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAaH,OAAO,EACL,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrD;;;;;;;GAOG;AACH,KAAK,UAAU,6BAA6B,CAC1C,KAAa;IAEb,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,oDAAoD;IACnE,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QAQH,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,SAAS,CAAC,eAAe,CASvB;YACF,SAAS,CAAC,gBAAgB,CAOxB;SACH,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,mBAAmB,EAAE,EAAE,EAAE,KAAK,CAAC;QACtD,IAAI,IAAI,GAKG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GACT,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;gBAChE,IAAI,CAAC;YACP,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,GAAG;oBACL,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc;oBACrE,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;iBAC5C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC;gBAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;oBACjC,IAAI,GAAG;wBACL,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,IAAI,EAAE,OAAO;wBACb,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;qBAC5C,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,MAAM,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAC7B,KAAwB;IAExB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAK,EAAE,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;SACxC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,MAAM;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAYD,SAAS,eAAe,CACtB,QAAgB,EAChB,IAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,OAAO,kBAAkB,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,OAAO,CACd,IAA6B;IAE7B,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,IAAI,IAAI;YAAE,SAAS;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAmB;IAC7C,IAAI,EAAE,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzD,OAAO,EAAE,CAAC,WAAsC,CAAC;IACnD,CAAC;IACD,MAAM,MAAM,GAAG;QACb,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACjE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACpB,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,UAAU;QACV,QAAQ,EAAE,MAAM;QAChB,oBAAoB,EAAE,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACpC,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CACf,IAA6B,EAC7B,IAAiB;IAEjB,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAgB;IAC5C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAsC,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;gBAChD,QAAQ,GAAG,CAAC,MAAM,EAAE;YACtB,OAAO,EAAE,GAAG,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAAgB,EAChB,GAA+B,EAC/B,WAAsC,EACtC,UAAsC,EAAE;IAExC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACxC,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE;YAClC,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,QAAQ;YACjB,WAAW,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,KAAK,IAAI;YAChD,aAAa,EACX,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,IAAI,WAAW;YACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAClC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAe;oBACtB,MAAM;oBACN,IAAI;oBACJ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/B,GAAG,CAAC,MAAM,KAAK,KAAK;wBAClB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;wBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;iBACpB,CAAC;gBACF,OAAO,oBAAoB,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,GAAc,EACd,MAAwC,EACxC,MAA8C;IAE9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAGpB,CAAC;IACJ,KAAK,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GAA8B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxE,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CACN,GAAG,iCAAiC,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE;YAC9D,OAAO;YACP,KAAK;SACN,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAAc,EACd,MAAyC;IAEzC,OAAO,kBAAkB,CACvB,GAAG,EACH,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,EAC9B,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iCAAiC,CAC/C,GAAc,EACd,MAAkC;IAElC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,kBAAkB,CACvB,GAAG,EACH,GAAG,CAAC,cAAc,EAAE,EACpB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAChC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS;QACrE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM;YAAE,SAAS;QACxC,GAAG,CAAC,IAAI,CACN,GAAG,iCAAiC,CAClC,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,UAAU,EAChB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EACxB,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1C,CACF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAc,EACd,aAA2C,EAAE;IAE7C,MAAM,SAAS,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAAwC,EACxC,GAAc;IAEd,MAAM,UAAU,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IAEzC,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,MAAM,GAA8B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEnE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAC3C,KAAK,MAAM,EAAE,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,SAAS,CAAC,IAAI,CACZ,GAAG,iCAAiC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE;gBACxD,OAAO;gBACP,KAAK,EAAE,QAAQ;aAChB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YAC7B,SAAS,CAAC,IAAI,CACZ,GAAG,iCAAiC,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC3D,OAAO;gBACP,KAAK,EAAE,QAAQ;aAChB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/namespace.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Namespacing H4 — core.* / creezio.* · module.<owner>.* · plugin.<owner>.*
+ */
+import type { McpToolSpace } from "./types.js";
+export type ParsedToolName = {
+    space: McpToolSpace;
+    ownerId?: string;
+    rest: string;
+};
+/**
+ * Parse un nom de tool namespacé. Retourne null si le format est invalide
+ * pour la couche attendue.
+ */
+export declare function parseNamespacedToolName(name: string): ParsedToolName | null;
+/**
+ * Vérifie qu'un tool déclaré respecte le préfixe de sa `space`.
+ * Les alias legacy (snake_case historique) ne passent pas ici — ils
+ * passent par `registerAlias`.
+ */
+export declare function assertNamespacedToolName(space: McpToolSpace, name: string, ownerId?: string): void;
+/** True si le nom ressemble à un alias legacy (hors namespace H4). */
+export declare function isLegacyAliasName(name: string): boolean;
+//# sourceMappingURL=namespace.d.ts.map

package/dist/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../src/namespace.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAIF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAc3E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,IAAI,CAsBN;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/namespace.js

@@ -0,0 +1,51 @@
+/**
+ * Namespacing H4 — core.* / creezio.* · module.<owner>.* · plugin.<owner>.*
+ */
+const OWNER_RE = /^[a-z][a-z0-9_-]{0,62}$/;
+/**
+ * Parse un nom de tool namespacé. Retourne null si le format est invalide
+ * pour la couche attendue.
+ */
+export function parseNamespacedToolName(name) {
+    if (!name || typeof name !== "string")
+        return null;
+    if (name.startsWith("creezio.") || name.startsWith("core.")) {
+        return { space: "core", rest: name.replace(/^(creezio|core)\./, "") };
+    }
+    const mod = /^module\.([a-z][a-z0-9_-]{0,62})\.(.+)$/.exec(name);
+    if (mod) {
+        return { space: "module", ownerId: mod[1], rest: mod[2] };
+    }
+    const plug = /^plugin\.([a-z][a-z0-9_-]{0,62})\.(.+)$/.exec(name);
+    if (plug) {
+        return { space: "plugin", ownerId: plug[1], rest: plug[2] };
+    }
+    return null;
+}
+/**
+ * Vérifie qu'un tool déclaré respecte le préfixe de sa `space`.
+ * Les alias legacy (snake_case historique) ne passent pas ici — ils
+ * passent par `registerAlias`.
+ */
+export function assertNamespacedToolName(space, name, ownerId) {
+    const parsed = parseNamespacedToolName(name);
+    if (!parsed) {
+        throw new Error(`mcp_namespace_invalid: « ${name} » doit être core.*/creezio.* | module.<id>.* | plugin.<id>.*`);
+    }
+    if (parsed.space !== space) {
+        throw new Error(`mcp_namespace_mismatch: « ${name} » parse comme ${parsed.space}, déclaré ${space}`);
+    }
+    if (space === "module" || space === "plugin") {
+        if (!ownerId || !OWNER_RE.test(ownerId)) {
+            throw new Error(`mcp_owner_invalid: ownerId requis pour space=${space}`);
+        }
+        if (parsed.ownerId !== ownerId) {
+            throw new Error(`mcp_owner_mismatch: nom « ${name} » owner=${parsed.ownerId}, déclaré ${ownerId}`);
+        }
+    }
+}
+/** True si le nom ressemble à un alias legacy (hors namespace H4). */
+export function isLegacyAliasName(name) {
+    return parseNamespacedToolName(name) === null;
+}
+//# sourceMappingURL=namespace.js.map

package/dist/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../src/namespace.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAmB,EACnB,IAAY,EACZ,OAAgB;IAEhB,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,+DAA+D,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,kBAAkB,MAAM,CAAC,KAAK,aAAa,KAAK,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,YAAY,MAAM,CAAC,OAAO,aAAa,OAAO,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC"}

package/dist/oauth/cors-policy.d.ts

@@ -0,0 +1,3 @@
+export declare function mcpCorsAllowlist(): string[];
+export declare function resolveMcpCorsOrigin(origin: string): string;
+//# sourceMappingURL=cors-policy.d.ts.map

package/dist/oauth/cors-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-policy.d.ts","sourceRoot":"","sources":["../../src/oauth/cors-policy.ts"],"names":[],"mappings":"AAQA,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAY3C;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAK3D"}

package/dist/oauth/cors-policy.js

@@ -0,0 +1,25 @@
+import { resolveMcpPublicUrl } from "./store.js";
+const SAFE_DEFAULTS = [
+    "https://chatgpt.com",
+    "https://chat.openai.com",
+    "https://claude.ai",
+];
+export function mcpCorsAllowlist() {
+    const configured = (process.env.MCP_CORS_ORIGINS || "")
+        .split(",")
+        .map((origin) => origin.trim().replace(/\/+$/, ""))
+        .filter(Boolean);
+    const publicUrl = resolveMcpPublicUrl();
+    return Array.from(new Set([
+        ...(configured.length ? configured : SAFE_DEFAULTS),
+        ...(publicUrl ? [publicUrl] : []),
+    ]));
+}
+export function resolveMcpCorsOrigin(origin) {
+    // Requêtes serveur-à-serveur et loopback sans Origin.
+    if (!origin)
+        return "*";
+    const normalized = origin.replace(/\/+$/, "");
+    return mcpCorsAllowlist().includes(normalized) ? origin : "";
+}
+//# sourceMappingURL=cors-policy.js.map

package/dist/oauth/cors-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-policy.js","sourceRoot":"","sources":["../../src/oauth/cors-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,aAAa,GAAG;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,mBAAmB;CACpB,CAAC;AAEF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACpD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAClD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CAAC;QACN,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,sDAAsD;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,gBAAgB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/oauth/hono-app.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Factory Hono `/mcp` + OAuth — SoT kit (équivalent fonctionnel server/mcp/app.ts).
+ * Transport Streamable HTTP et buildMcpServer restent injectés par la marque.
+ */
+import { Hono } from "hono";
+import type { CreateMcpHonoAppOptions } from "./types.js";
+type McpAppEnv = {
+    Variables: {
+        mcpAuth: {
+            authType: "api_key" | "oauth";
+            clientId: string;
+            userId: string | null;
+        };
+    };
+};
+export declare function createMcpHonoApp(options: CreateMcpHonoAppOptions): Hono<McpAppEnv>;
+export {};
+//# sourceMappingURL=hono-app.d.ts.map

package/dist/oauth/hono-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-app.d.ts","sourceRoot":"","sources":["../../src/oauth/hono-app.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,KAAK,SAAS,GAAG;IACf,SAAS,EAAE;QACT,OAAO,EAAE;YACP,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC;YAC9B,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;SACvB,CAAC;KACH,CAAC;CACH,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAAC,SAAS,CAAC,CAuMlF"}

package/dist/oauth/hono-app.js

@@ -0,0 +1,175 @@
+/**
+ * Factory Hono `/mcp` + OAuth — SoT kit (équivalent fonctionnel server/mcp/app.ts).
+ * Transport Streamable HTTP et buildMcpServer restent injectés par la marque.
+ */
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { clientCanAuthenticate } from "../admin/mcp-admin.js";
+import { getClient, isMcpPublicUrlRequiredError, mcpBaseUrl, verifyAccessToken, } from "./store.js";
+import { checkMcpRateLimit, rateLimitHeaders } from "./rate-limit.js";
+import { resolveMcpCorsOrigin } from "./cors-policy.js";
+export function createMcpHonoApp(options) {
+    const mcpApp = new Hono();
+    const rateLimit = options.mcpRateLimit?.limit ?? 120;
+    const rateWindow = options.mcpRateLimit?.windowMs ?? 60_000;
+    const resolveCors = options.resolveCorsOrigin ?? resolveMcpCorsOrigin;
+    if (options.ensureSchema) {
+        mcpApp.use("*", async (_c, next) => {
+            options.ensureSchema?.();
+            await next();
+        });
+    }
+    mcpApp.use("*", cors({
+        origin: resolveCors,
+        allowMethods: ["GET", "POST", "DELETE", "OPTIONS"],
+        allowHeaders: [
+            "Authorization",
+            "Content-Type",
+            "Mcp-Session-Id",
+            "MCP-Protocol-Version",
+        ],
+        exposeHeaders: ["Mcp-Session-Id", "WWW-Authenticate"],
+        maxAge: 86400,
+    }));
+    mcpApp.route("/", options.oauthRoutes);
+    if (options.mcpMiddleware) {
+        mcpApp.use("/mcp", options.mcpMiddleware);
+    }
+    function tunnelRequired() {
+        return new Response(JSON.stringify({
+            error: "temporarily_unavailable",
+            error_description: "tunnel requis — configurez l'accès mobile (APP_PUBLIC_URL / MCP_PUBLIC_URL)",
+        }), { status: 503, headers: { "Content-Type": "application/json" } });
+    }
+    function unauthorized(description, opts) {
+        const headers = {
+            "Content-Type": "application/json",
+        };
+        if (opts?.publicMeta !== false) {
+            try {
+                const meta = `${mcpBaseUrl()}/.well-known/oauth-protected-resource/mcp`;
+                headers["WWW-Authenticate"] =
+                    `Bearer resource_metadata="${meta}", ` +
+                        `error="invalid_token", error_description="${description}"`;
+            }
+            catch (e) {
+                if (!isMcpPublicUrlRequiredError(e))
+                    throw e;
+            }
+        }
+        return new Response(JSON.stringify({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: `Unauthorized: ${description}` },
+            id: null,
+        }), { status: 401, headers });
+    }
+    mcpApp.all("/mcp", async (c) => {
+        const auth = c.req.header("authorization") || "";
+        const token = auth.replace(/^Bearer\s+/i, "").trim();
+        if (!token || token === auth) {
+            return unauthorized("Bearer token manquant");
+        }
+        const apiKeyAuth = options.apiKeyAuth;
+        if (apiKeyAuth && token.startsWith(apiKeyAuth.prefix)) {
+            const key = apiKeyAuth.verify(token);
+            if (!key) {
+                return unauthorized("clé API invalide ou révoquée", {
+                    publicMeta: false,
+                });
+            }
+            const rate = checkMcpRateLimit(`mcp:api-key:${key.id}`, rateLimit, rateWindow);
+            for (const [name, value] of Object.entries(rateLimitHeaders(rate))) {
+                c.header(name, value);
+            }
+            if (!rate.ok) {
+                return c.json({
+                    error: "rate_limit_exceeded",
+                    error_description: "Limite MCP atteinte",
+                }, 429);
+            }
+            const userId = apiKeyAuth.resolveUserId?.(key) ?? key.user_id ?? null;
+            c.set("mcpAuth", {
+                authType: "api_key",
+                clientId: `api-key:${key.id}`,
+                userId,
+            });
+            const server = await options.buildMcpServer({
+                userId,
+                clientId: `api-key:${key.id}`,
+                scopes: key.scopes,
+            });
+            const transport = options.createTransport();
+            await server.connect(transport);
+            try {
+                return await transport.handleRequest(c);
+            }
+            finally {
+                queueMicrotask(() => {
+                    transport.close().catch(() => { });
+                    server.close().catch(() => { });
+                });
+            }
+        }
+        try {
+            mcpBaseUrl();
+        }
+        catch (e) {
+            if (isMcpPublicUrlRequiredError(e))
+                return tunnelRequired();
+            throw e;
+        }
+        const payload = await verifyAccessToken(token);
+        if (!payload) {
+            return unauthorized("token invalide ou expiré");
+        }
+        let clientOk = false;
+        try {
+            clientOk = clientCanAuthenticate(payload.client_id);
+        }
+        catch {
+            // Admin adapters absents : fallback store (filtre enabled/revoked).
+            clientOk = Boolean(getClient(payload.client_id));
+        }
+        if (!clientOk) {
+            return unauthorized("client OAuth désactivé ou révoqué");
+        }
+        const rate = checkMcpRateLimit(`mcp:oauth:${payload.client_id}`, rateLimit, rateWindow);
+        for (const [name, value] of Object.entries(rateLimitHeaders(rate))) {
+            c.header(name, value);
+        }
+        if (!rate.ok) {
+            return c.json({
+                error: "rate_limit_exceeded",
+                error_description: "Limite MCP atteinte",
+            }, 429);
+        }
+        c.set("mcpAuth", {
+            authType: "oauth",
+            clientId: payload.client_id,
+            userId: payload.user_id,
+        });
+        const server = await options.buildMcpServer({
+            userId: payload.user_id,
+            clientId: payload.client_id,
+            scopes: payload.scope,
+        });
+        const transport = options.createTransport();
+        await server.connect(transport);
+        try {
+            return await transport.handleRequest(c);
+        }
+        finally {
+            queueMicrotask(() => {
+                transport.close().catch(() => { });
+                server.close().catch(() => { });
+            });
+        }
+    });
+    mcpApp.notFound((c) => c.json({ error: "Route inconnue" }, 404));
+    mcpApp.onError((err, c) => {
+        console.error("[mcp]", err);
+        return c.json({ error: err instanceof Error ? err.message : "Erreur serveur" }, 500);
+    });
+    return mcpApp;
+}
+//# sourceMappingURL=hono-app.js.map

package/dist/oauth/hono-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-app.js","sourceRoot":"","sources":["../../src/oauth/hono-app.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EACL,SAAS,EACT,2BAA2B,EAC3B,UAAU,EACV,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAaxD,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAC/D,MAAM,MAAM,GAAG,IAAI,IAAI,EAAa,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,IAAI,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,MAAM,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IAEtE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;YACjC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,GAAG,CACR,GAAG,EACH,IAAI,CAAC;QACH,MAAM,EAAE,WAAW;QACnB,YAAY,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;QAClD,YAAY,EAAE;YACZ,eAAe;YACf,cAAc;YACd,gBAAgB;YAChB,sBAAsB;SACvB;QACD,aAAa,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACrD,MAAM,EAAE,KAAK;KACd,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,WAAmB,CAAC,CAAC;IAE/C,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,cAAc;QACrB,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,KAAK,EAAE,yBAAyB;YAChC,iBAAiB,EACf,6EAA6E;SAChF,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IACJ,CAAC;IAED,SAAS,YAAY,CACnB,WAAmB,EACnB,IAA+B;QAE/B,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,IAAI,IAAI,EAAE,UAAU,KAAK,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,GAAG,UAAU,EAAE,2CAA2C,CAAC;gBACxE,OAAO,CAAC,kBAAkB,CAAC;oBACzB,6BAA6B,IAAI,KAAK;wBACtC,6CAA6C,WAAW,GAAG,CAAC;YAChE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;YACb,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,WAAW,EAAE,EAAE;YAChE,EAAE,EAAE,IAAI;SACT,CAAC,EACF,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CACzB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,YAAY,CAAC,8BAA8B,EAAE;oBAClD,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,iBAAiB,CAC5B,eAAe,GAAG,CAAC,EAAE,EAAE,EACvB,SAAS,EACT,UAAU,CACX,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,CAAC,CAAC,IAAI,CACX;oBACE,KAAK,EAAE,qBAAqB;oBAC5B,iBAAiB,EAAE,qBAAqB;iBACzC,EACD,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GACV,UAAU,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;gBACf,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,WAAW,GAAG,CAAC,EAAE,EAAE;gBAC7B,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;gBAC1C,MAAM;gBACN,QAAQ,EAAE,WAAW,GAAG,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC;gBACH,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;oBAAS,CAAC;gBACT,cAAc,CAAC,GAAG,EAAE;oBAClB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,UAAU,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,2BAA2B,CAAC,CAAC,CAAC;gBAAE,OAAO,cAAc,EAAE,CAAC;YAC5D,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAC5B,aAAa,OAAO,CAAC,SAAS,EAAE,EAChC,SAAS,EACT,UAAU,CACX,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,iBAAiB,EAAE,qBAAqB;aACzC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE;YACf,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC1C,MAAM,EAAE,OAAO,CAAC,OAAO;YACvB,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,MAAM,EAAE,OAAO,CAAC,KAAK;SACtB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,GAAG,EAAE;gBAClB,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,EAChE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}