@fastybird/smart-panel-backend 1.0.0-beta.2 → 1.1.0-alpha.0

package/dist/modules/mcp/guards/mcp-client.guard.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpClientGuard = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_exceptions_1 = require("../mcp.exceptions");
+const mcp_audit_service_1 = require("../services/mcp-audit.service");
+const mcp_oauth_route_gate_service_1 = require("../services/mcp-oauth-route-gate.service");
+const mcp_policy_service_1 = require("../services/mcp-policy.service");
+const mcp_server_service_1 = require("../services/mcp-server.service");
+let McpClientGuard = class McpClientGuard {
+    constructor(policyService, serverService, auditService, oauthRouteGate) {
+        this.policyService = policyService;
+        this.serverService = serverService;
+        this.auditService = auditService;
+        this.oauthRouteGate = oauthRouteGate;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        if (!request.auth && this.oauthRouteGate.isOpen)
+            return true;
+        const policyRevision = this.serverService.getPolicyRevision();
+        const clientPolicyRevision = request.auth?.type === 'token' && request.auth.ownerId
+            ? this.serverService.getClientPolicyRevision(request.auth.ownerId)
+            : 0;
+        try {
+            const policy = await this.policyService.resolve(request.auth);
+            this.policyService.validateRequestOrigin(request, policy);
+            request.mcpPolicy = { ...policy, clientPolicyRevision, policyRevision };
+        }
+        catch (error) {
+            const identity = {
+                requestId: this.auditService.getRequestId(request.body),
+                ...(request.auth?.type === 'token' && request.auth.ownerId ? { clientId: request.auth.ownerId } : {}),
+            };
+            const denialReason = this.getDenialReason(error);
+            if (denialReason) {
+                this.auditService.recordPolicyDenial(identity, denialReason);
+            }
+            else {
+                this.auditService.recordRequestFailure(identity, 'policy_resolution_error');
+            }
+            throw error;
+        }
+        return true;
+    }
+    getDenialReason(error) {
+        if (error instanceof mcp_exceptions_1.McpEndpointDisabledException) {
+            return 'endpoint_disabled';
+        }
+        if (error instanceof common_1.ForbiddenException) {
+            return 'origin_denied';
+        }
+        return error instanceof common_1.UnauthorizedException ? 'request_denied' : null;
+    }
+};
+exports.McpClientGuard = McpClientGuard;
+exports.McpClientGuard = McpClientGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_policy_service_1.McpPolicyService,
+        mcp_server_service_1.McpServerService,
+        mcp_audit_service_1.McpAuditService,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService])
+], McpClientGuard);
+//# sourceMappingURL=mcp-client.guard.js.map

package/dist/modules/mcp/guards/mcp-client.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client.guard.js","sourceRoot":"","sources":["../../../../src/modules/mcp/guards/mcp-client.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAsH;AAEtH,sDAAiE;AACjE,qEAAsF;AACtF,2FAAoF;AACpF,uEAAoF;AACpF,uEAAkE;AAG3D,IAAM,cAAc,GAApB,MAAM,cAAc;IAC1B,YACkB,aAA+B,EAC/B,aAA+B,EAC/B,YAA6B,EAC7B,cAAwC;QAHxC,kBAAa,GAAb,aAAa,CAAkB;QAC/B,kBAAa,GAAb,aAAa,CAAkB;QAC/B,iBAAY,GAAZ,YAAY,CAAiB;QAC7B,mBAAc,GAAd,cAAc,CAA0B;IACvD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAoB,CAAC;QAEtE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE7D,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC;QAC9D,MAAM,oBAAoB,GACzB,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO;YACrD,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAClE,CAAC,CAAC,CAAC,CAAC;QACN,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAE9D,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,oBAAoB,EAAE,cAAc,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,QAAQ,GAAG;gBAChB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;gBACvD,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrG,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAEjD,IAAI,YAAY,EAAE,CAAC;gBAClB,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,KAAK,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,eAAe,CAAC,KAAc;QACrC,IAAI,KAAK,YAAY,6CAA4B,EAAE,CAAC;YACnD,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QAED,IAAI,KAAK,YAAY,2BAAkB,EAAE,CAAC;YACzC,OAAO,eAAe,CAAC;QACxB,CAAC;QAED,OAAO,KAAK,YAAY,8BAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;CACD,CAAA;AArDY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAGqB,qCAAgB;QAChB,qCAAgB;QACjB,mCAAe;QACb,uDAAwB;GAL9C,cAAc,CAqD1B"}

package/dist/modules/mcp/guards/mcp-throttle.guard.d.ts

@@ -0,0 +1,26 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { JwtService } from '@nestjs/jwt';
+import { ThrottlerStorage } from '@nestjs/throttler';
+import { McpInstallationService } from '../services/mcp-installation.service';
+import { McpOAuthResourceServerService } from '../services/mcp-oauth-resource-server.service';
+import { McpOAuthRouteGateService } from '../services/mcp-oauth-route-gate.service';
+export declare class McpThrottleGuard implements CanActivate {
+    private readonly reflector;
+    private readonly jwtService;
+    private readonly installationService;
+    private readonly storage;
+    private readonly oauthRouteGate?;
+    private readonly oauthResourceServer?;
+    private readonly verifyCache;
+    private verifyTokens;
+    private verifyTokensRefilledAt;
+    constructor(reflector: Reflector, jwtService: JwtService, installationService: McpInstallationService, storage: ThrottlerStorage, oauthRouteGate?: McpOAuthRouteGateService, oauthResourceServer?: McpOAuthResourceServerService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private getVerifiedClientId;
+    private getOAuthClientId;
+    private safeDecode;
+    private tryConsumeVerifyToken;
+    private readVerifyCache;
+    private writeVerifyCache;
+}

package/dist/modules/mcp/guards/mcp-throttle.guard.js

@@ -0,0 +1,161 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpThrottleGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const jwt_1 = require("@nestjs/jwt");
+const throttler_1 = require("@nestjs/throttler");
+const auth_constants_1 = require("../../auth/auth.constants");
+const token_utils_1 = require("../../auth/utils/token.utils");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_installation_service_1 = require("../services/mcp-installation.service");
+const mcp_oauth_resource_server_service_1 = require("../services/mcp-oauth-resource-server.service");
+const mcp_oauth_route_gate_service_1 = require("../services/mcp-oauth-route-gate.service");
+const VERIFY_CACHE_TTL_MS = 60_000;
+const VERIFY_CACHE_MAX_ENTRIES = 1_000;
+const MAX_VERIFY_PER_SEC = 200;
+let McpThrottleGuard = class McpThrottleGuard {
+    constructor(reflector, jwtService, installationService, storage, oauthRouteGate, oauthResourceServer) {
+        this.reflector = reflector;
+        this.jwtService = jwtService;
+        this.installationService = installationService;
+        this.storage = storage;
+        this.oauthRouteGate = oauthRouteGate;
+        this.oauthResourceServer = oauthResourceServer;
+        this.verifyCache = new Map();
+        this.verifyTokens = MAX_VERIFY_PER_SEC;
+        this.verifyTokensRefilledAt = Date.now();
+    }
+    async canActivate(context) {
+        const isMcpEndpoint = this.reflector.getAllAndOverride(mcp_constants_1.IS_MCP_ENDPOINT_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!isMcpEndpoint || context.getType() !== 'http') {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const clientId = await this.getVerifiedClientId(request);
+        const limit = clientId ? mcp_constants_1.MCP_AUTHENTICATED_RATE_LIMIT : mcp_constants_1.MCP_UNAUTHENTICATED_RATE_LIMIT;
+        const key = clientId ? `mcp-client:${clientId}` : `mcp-ip:${request.ip}`;
+        const result = await this.storage.increment(key, mcp_constants_1.MCP_RATE_LIMIT_TTL_MS, limit, mcp_constants_1.MCP_RATE_LIMIT_TTL_MS, 'mcp');
+        if (result.isBlocked) {
+            throw new throttler_1.ThrottlerException();
+        }
+        return true;
+    }
+    async getVerifiedClientId(request) {
+        const token = (0, token_utils_1.extractAccessTokenFromHeader)(request);
+        if (!token) {
+            return null;
+        }
+        const decoded = this.safeDecode(token);
+        if (!decoded || decoded.type !== auth_constants_1.TokenOwnerType.MCP || !decoded.sub) {
+            return this.getOAuthClientId(token);
+        }
+        const cached = this.readVerifyCache(token);
+        if (cached !== undefined) {
+            return cached;
+        }
+        if (!this.tryConsumeVerifyToken()) {
+            return null;
+        }
+        try {
+            const verified = await this.jwtService.verifyAsync(token, {
+                audience: await this.installationService.getAudience(),
+            });
+            const clientId = verified.type === auth_constants_1.TokenOwnerType.MCP && verified.sub ? verified.sub : null;
+            this.writeVerifyCache(token, clientId);
+            return clientId;
+        }
+        catch {
+            this.writeVerifyCache(token, null);
+            return this.getOAuthClientId(token);
+        }
+    }
+    async getOAuthClientId(token) {
+        if (!this.oauthRouteGate?.isOpen || !this.oauthResourceServer)
+            return null;
+        const cached = this.readVerifyCache(token, 'oauth');
+        if (cached !== undefined)
+            return cached;
+        if (!this.tryConsumeVerifyToken())
+            return null;
+        try {
+            const authInfo = await this.oauthResourceServer.verifyMcpBearerToken(`Bearer ${token}`, [mcp_constants_1.McpCapability.READ]);
+            const clientId = `oauth:${authInfo.clientId}`;
+            this.writeVerifyCache(token, clientId, 'oauth');
+            return clientId;
+        }
+        catch {
+            this.writeVerifyCache(token, null, 'oauth');
+            return null;
+        }
+    }
+    safeDecode(token) {
+        try {
+            const decoded = this.jwtService.decode(token);
+            return typeof decoded === 'object' && decoded !== null ? decoded : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    tryConsumeVerifyToken() {
+        const now = Date.now();
+        const elapsedSeconds = (now - this.verifyTokensRefilledAt) / 1000;
+        this.verifyTokens = Math.min(MAX_VERIFY_PER_SEC, this.verifyTokens + elapsedSeconds * MAX_VERIFY_PER_SEC);
+        this.verifyTokensRefilledAt = now;
+        if (this.verifyTokens < 1) {
+            return false;
+        }
+        this.verifyTokens -= 1;
+        return true;
+    }
+    readVerifyCache(token, profile = 'static') {
+        const key = `${profile}:${(0, token_utils_1.hashToken)(token)}`;
+        const entry = this.verifyCache.get(key);
+        if (!entry) {
+            return undefined;
+        }
+        if (entry.expiresAt <= Date.now()) {
+            this.verifyCache.delete(key);
+            return undefined;
+        }
+        return entry.clientId;
+    }
+    writeVerifyCache(token, clientId, profile = 'static') {
+        const key = `${profile}:${(0, token_utils_1.hashToken)(token)}`;
+        if (this.verifyCache.size >= VERIFY_CACHE_MAX_ENTRIES && !this.verifyCache.has(key)) {
+            for (const oldestKey of this.verifyCache.keys()) {
+                this.verifyCache.delete(oldestKey);
+                break;
+            }
+        }
+        this.verifyCache.set(key, { clientId, expiresAt: Date.now() + VERIFY_CACHE_TTL_MS });
+    }
+};
+exports.McpThrottleGuard = McpThrottleGuard;
+exports.McpThrottleGuard = McpThrottleGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, throttler_1.InjectThrottlerStorage)()),
+    __param(4, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        jwt_1.JwtService,
+        mcp_installation_service_1.McpInstallationService, Object, mcp_oauth_route_gate_service_1.McpOAuthRouteGateService,
+        mcp_oauth_resource_server_service_1.McpOAuthResourceServerService])
+], McpThrottleGuard);
+//# sourceMappingURL=mcp-throttle.guard.js.map

package/dist/modules/mcp/guards/mcp-throttle.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-throttle.guard.js","sourceRoot":"","sources":["../../../../src/modules/mcp/guards/mcp-throttle.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAEA,2CAAqF;AACrF,uCAAyC;AACzC,qCAAyC;AACzC,iDAAiG;AAEjG,8DAA2D;AAC3D,8DAAuF;AACvF,oDAM0B;AAC1B,mFAA8E;AAC9E,qGAA8F;AAC9F,2FAAoF;AAcpF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAGxB,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAK5B,YACkB,SAAoB,EACpB,UAAsB,EACtB,mBAA2C,EAE5D,OAA0C,EAC9B,cAA0D,EAC1D,mBAAoE;QAN/D,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAAY;QACtB,wBAAmB,GAAnB,mBAAmB,CAAwB;QAE3C,YAAO,GAAP,OAAO,CAAkB;QACb,mBAAc,GAAd,cAAc,CAA2B;QACzC,wBAAmB,GAAnB,mBAAmB,CAAgC;QAXhE,gBAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;QAC3D,iBAAY,GAAG,kBAAkB,CAAC;QAClC,2BAAsB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAUzC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,mCAAmB,EAAE;YACpF,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAkB,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,4CAA4B,CAAC,CAAC,CAAC,8CAA8B,CAAC;QACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,EAAE,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,qCAAqB,EAAE,KAAK,EAAE,qCAAqB,EAAE,KAAK,CAAC,CAAC;QAE7G,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,8BAAkB,EAAE,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAuB;QACxD,MAAM,KAAK,GAAG,IAAA,0CAA4B,EAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,+BAAc,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAgB,KAAK,EAAE;gBACxE,QAAQ,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,+BAAc,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5F,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAEvC,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC3C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE;YAAE,OAAO,IAAI,CAAC;QAE/C,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC,6BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9G,MAAM,QAAQ,GAAG,SAAS,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAE9C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEhD,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,UAAU,CAAC,KAAa;QAC/B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAY,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEvD,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAE,OAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEO,qBAAqB;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,CAAC,YAAY,GAAG,cAAc,GAAG,kBAAkB,CAAC,CAAC;QAC1G,IAAI,CAAC,sBAAsB,GAAG,GAAG,CAAC;QAElC,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,UAA8B,QAAQ;QAC5E,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,IAAA,uBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,gBAAgB,CAAC,KAAa,EAAE,QAAuB,EAAE,UAA8B,QAAQ;QACtG,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,IAAA,uBAAS,EAAC,KAAK,CAAC,EAAE,CAAC;QAE7C,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,wBAAwB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnC,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC;IACtF,CAAC;CACD,CAAA;AAtJY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAUV,WAAA,IAAA,kCAAsB,GAAE,CAAA;IAExB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCANiB,gBAAS;QACR,gBAAU;QACD,iDAAsB,UAGd,uDAAwB;QACnB,iEAA6B;GAZrE,gBAAgB,CAsJ5B"}

package/dist/modules/mcp/listeners/mcp-config.listener.d.ts

@@ -0,0 +1,22 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+import { ConfigService } from '../../config/services/config.service';
+import { McpServerService } from '../services/mcp-server.service';
+interface ConfigUpdatedEvent {
+    source: string;
+    type: 'module' | 'plugin';
+}
+export declare class McpConfigListener implements OnApplicationBootstrap {
+    private readonly configService;
+    private readonly serverService;
+    private readonly logger;
+    private previousConfig?;
+    constructor(configService: ConfigService, serverService: McpServerService);
+    onApplicationBootstrap(): void;
+    onConfigUpdated(event: ConfigUpdatedEvent): void;
+    onConfigReset(): void;
+    private snapshot;
+    private sameCapabilities;
+    private notifyBestEffort;
+    private closeAllStreams;
+}
+export {};

package/dist/modules/mcp/listeners/mcp-config.listener.js

@@ -0,0 +1,104 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpConfigListener = void 0;
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const logger_1 = require("../../../common/logger");
+const config_constants_1 = require("../../config/config.constants");
+const config_service_1 = require("../../config/services/config.service");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_server_service_1 = require("../services/mcp-server.service");
+let McpConfigListener = class McpConfigListener {
+    constructor(configService, serverService) {
+        this.configService = configService;
+        this.serverService = serverService;
+        this.logger = (0, logger_1.createExtensionLogger)(mcp_constants_1.MCP_MODULE_NAME, 'McpConfigListener');
+    }
+    onApplicationBootstrap() {
+        this.previousConfig = this.snapshot(this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME));
+    }
+    onConfigUpdated(event) {
+        if (event.type !== 'module' || event.source !== mcp_constants_1.MCP_MODULE_NAME) {
+            return;
+        }
+        const previous = this.previousConfig;
+        const current = this.snapshot(this.configService.getModuleConfig(mcp_constants_1.MCP_MODULE_NAME));
+        this.previousConfig = current;
+        const capabilitiesChanged = !previous || !this.sameCapabilities(previous.capabilities, current.capabilities);
+        const toolsChanged = !previous || previous.enabled !== current.enabled || (current.enabled && capabilitiesChanged);
+        const resourcesChanged = !previous ||
+            (previous.enabled && previous.capabilities.includes(mcp_constants_1.McpCapability.READ)) !==
+                (current.enabled && current.capabilities.includes(mcp_constants_1.McpCapability.READ));
+        this.serverService.invalidatePolicies();
+        if (toolsChanged) {
+            this.notifyBestEffort('tool-list change', () => this.serverService.notifyToolsChanged());
+        }
+        if (resourcesChanged) {
+            this.notifyBestEffort('resource-list change', () => this.serverService.notifyResourcesChanged());
+        }
+        if (!current.enabled) {
+            this.closeAllStreams('module disable');
+        }
+    }
+    onConfigReset() {
+        this.previousConfig = undefined;
+        this.notifyBestEffort('tool-list change before configuration reset', () => this.serverService.notifyToolsChanged());
+        this.notifyBestEffort('resource-list change before configuration reset', () => this.serverService.notifyResourcesChanged());
+        this.closeAllStreams('configuration reset');
+    }
+    snapshot(config) {
+        return { enabled: config.enabled, capabilities: [...config.capabilities] };
+    }
+    sameCapabilities(first, second) {
+        return first.length === second.length && first.every((capability) => second.includes(capability));
+    }
+    notifyBestEffort(reason, callback) {
+        try {
+            callback();
+        }
+        catch (error) {
+            const err = error instanceof Error ? error : new Error('Unknown MCP notification error');
+            this.logger.error(`Failed to publish MCP ${reason}`, {
+                message: err.message,
+                stack: err.stack,
+            });
+        }
+    }
+    closeAllStreams(reason) {
+        void this.serverService.closeAll().catch((error) => {
+            const err = error instanceof Error ? error : new Error('Unknown MCP handler shutdown error');
+            this.logger.error(`Failed to close MCP streams after ${reason}`, {
+                message: err.message,
+                stack: err.stack,
+            });
+        });
+    }
+};
+exports.McpConfigListener = McpConfigListener;
+__decorate([
+    (0, event_emitter_1.OnEvent)(config_constants_1.EventType.CONFIG_UPDATED),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], McpConfigListener.prototype, "onConfigUpdated", null);
+__decorate([
+    (0, event_emitter_1.OnEvent)(config_constants_1.EventType.CONFIG_RESET),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], McpConfigListener.prototype, "onConfigReset", null);
+exports.McpConfigListener = McpConfigListener = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_service_1.ConfigService,
+        mcp_server_service_1.McpServerService])
+], McpConfigListener);
+//# sourceMappingURL=mcp-config.listener.js.map

package/dist/modules/mcp/listeners/mcp-config.listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config.listener.js","sourceRoot":"","sources":["../../../../src/modules/mcp/listeners/mcp-config.listener.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoE;AACpE,yDAAgD;AAEhD,mDAA+D;AAC/D,oEAA0D;AAC1D,yEAAqE;AACrE,oDAAkE;AAElE,uEAAkE;AAa3D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI7B,YACkB,aAA4B,EAC5B,aAA+B;QAD/B,kBAAa,GAAb,aAAa,CAAe;QAC5B,kBAAa,GAAb,aAAa,CAAkB;QALhC,WAAM,GAAG,IAAA,8BAAqB,EAAC,+BAAe,EAAE,mBAAmB,CAAC,CAAC;IAMnF,CAAC;IAEJ,sBAAsB;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC,CAAC;IAC1G,CAAC;IAGD,eAAe,CAAC,KAAyB;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,+BAAe,EAAE,CAAC;YACjE,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAiB,+BAAe,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;QAE9B,MAAM,mBAAmB,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7G,MAAM,YAAY,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC,CAAC;QACnH,MAAM,gBAAgB,GACrB,CAAC,QAAQ;YACT,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,6BAAa,CAAC,IAAI,CAAC,CAAC;gBACvE,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,6BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QAExC,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAGD,aAAa;QACZ,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,gBAAgB,CAAC,6CAA6C,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,gBAAgB,CAAC,iDAAiD,EAAE,GAAG,EAAE,CAC7E,IAAI,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAC3C,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC;IAC7C,CAAC;IAEO,QAAQ,CAAC,MAAsB;QACtC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;IAC5E,CAAC;IAEO,gBAAgB,CAAC,KAAsB,EAAE,MAAuB;QACvE,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACnG,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,QAAoB;QAC5D,IAAI,CAAC;YACJ,QAAQ,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACzF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,EAAE,EAAE;gBACpD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAEO,eAAe,CAAC,MAAc;QACrC,KAAK,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC3D,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,MAAM,EAAE,EAAE;gBAChE,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AApFY,8CAAiB;AAc7B;IADC,IAAA,uBAAO,EAAC,4BAAS,CAAC,cAAc,CAAC;;;;wDA8BjC;AAGD;IADC,IAAA,uBAAO,EAAC,4BAAS,CAAC,YAAY,CAAC;;;;sDAQ/B;4BArDW,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAMqB,8BAAa;QACb,qCAAgB;GANrC,iBAAiB,CAoF7B"}

package/dist/modules/mcp/mcp.constants.d.ts

@@ -0,0 +1,68 @@
+export declare const MCP_MODULE_PREFIX = "mcp";
+export declare const MCP_MODULE_NAME = "mcp-module";
+export declare const MCP_MODULE_API_TAG_NAME = "MCP module";
+export declare const MCP_MODULE_API_TAG_DESCRIPTION = "Model Context Protocol integration for exposing a curated, capability-scoped smart home agent surface.";
+export declare const MCP_CATALOG_REGISTRAR: unique symbol;
+export declare enum McpCapability {
+    READ = "read",
+    WRITE = "write",
+    TRIGGER = "trigger"
+}
+export declare enum McpOAuthScope {
+    READ = "mcp:read",
+    WRITE = "mcp:write",
+    TRIGGER = "mcp:trigger",
+    OFFLINE_ACCESS = "offline_access"
+}
+export declare const MCP_DEFAULT_ENABLED = false;
+export declare const MCP_DEFAULT_CAPABILITIES: readonly McpCapability[];
+export declare const MCP_DEFAULT_ALLOWED_ORIGINS: readonly string[];
+export declare const MCP_DEFAULT_OAUTH_PUBLIC_BASE_URL: string | null;
+export declare const MCP_DEFAULT_OAUTH_ENABLED = false;
+export declare const MCP_OAUTH_PROVIDER_MATERIAL_FILENAME = ".mcp-oauth-provider.json";
+export declare const MCP_OAUTH_PRINCIPAL_TYPE = "mcp_oauth";
+export declare const MCP_OAUTH_SERVER_STATE_KEY = "primary";
+export declare const MCP_OAUTH_RESOURCE_PATH = "/api/v1/modules/mcp";
+export declare const MCP_OAUTH_ISSUER_PATH = "/api/v1/modules/mcp/oauth";
+export declare const MCP_OAUTH_PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/api/v1/modules/mcp";
+export declare const MCP_OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server/api/v1/modules/mcp/oauth";
+export declare const MCP_OAUTH_AUTHORIZATION_PATH = "/api/v1/modules/mcp/oauth/authorize";
+export declare const MCP_OAUTH_TOKEN_PATH = "/api/v1/modules/mcp/oauth/token";
+export declare const MCP_OAUTH_REVOCATION_PATH = "/api/v1/modules/mcp/oauth/token/revocation";
+export declare const MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS: number;
+export declare const MCP_OAUTH_REFRESH_FAMILY_LIFETIME_MS: number;
+export declare const MCP_OAUTH_GRANT_LIFETIME_MS: number;
+export declare const MCP_OAUTH_INTERACTION_RATE_LIMIT = 10;
+export declare const MCP_OAUTH_AUTHORIZE_RATE_LIMIT = 20;
+export declare const MCP_OAUTH_TOKEN_RATE_LIMIT = 30;
+export declare const MCP_OAUTH_REVOCATION_RATE_LIMIT = 30;
+export declare const MCP_OAUTH_RATE_LIMIT_TTL_MS: number;
+export declare const MCP_DEFAULT_TOKEN_EXPIRATION_DAYS = 90;
+export declare const MCP_MAX_TOKEN_EXPIRATION_DAYS = 3650;
+export declare const IS_MCP_ENDPOINT_KEY = "isMcpEndpoint";
+export declare const MCP_REQUEST_BODY_LIMIT_BYTES: number;
+export declare const MCP_TOOL_CALL_TIMEOUT_MS = 30000;
+export declare const MCP_MAX_ACTIVE_SUBSCRIPTIONS = 100;
+export declare const MCP_MAX_SUBSCRIPTIONS_PER_CLIENT = 5;
+export declare const MCP_SUBSCRIPTION_IDLE_TIMEOUT_MS: number;
+export declare const MCP_SUBSCRIPTION_CLOSE_TIMEOUT_MS = 5000;
+export declare const MCP_AUTHENTICATED_RATE_LIMIT = 120;
+export declare const MCP_UNAUTHENTICATED_RATE_LIMIT = 10;
+export declare const MCP_RATE_LIMIT_TTL_MS: number;
+export declare const MCP_MAX_CONTEXT_SPACES: number;
+export declare const MCP_MAX_CONTEXT_DEVICES: number;
+export declare const MCP_MAX_CHANNELS_PER_DEVICE: number;
+export declare const MCP_MAX_PROPERTIES_PER_CHANNEL: number;
+export declare const MCP_MAX_CONTEXT_SCENES: number;
+export declare const MCP_MAX_WRITABLE_PROPERTIES: number;
+export declare const MCP_MAX_WRITABLE_PROPERTY_CANDIDATES: number;
+export declare const MCP_MAX_TRIGGER_SCENES: number;
+export declare const MCP_MAX_TRIGGER_SPACES: number;
+export declare const MCP_MAX_SECURITY_ALERTS: number;
+export declare const MCP_MAX_SECURITY_DEVICES: number;
+export declare const MCP_MAX_SECURITY_CHANNELS_PER_DEVICE: number;
+export declare const MCP_MAX_SECURITY_PROPERTIES_PER_CHANNEL: number;
+export declare const MCP_MAX_FORECAST_DAYS: number;
+export declare const MCP_MAX_TIMESERIES_RANGE_DAYS: number;
+export declare const MCP_MAX_TIMESERIES_POINTS: number;
+export declare const MCP_MAX_ENERGY_RANGE_DAYS: number;

package/dist/modules/mcp/mcp.constants.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_MAX_TRIGGER_SCENES = exports.MCP_MAX_WRITABLE_PROPERTY_CANDIDATES = exports.MCP_MAX_WRITABLE_PROPERTIES = exports.MCP_MAX_CONTEXT_SCENES = exports.MCP_MAX_PROPERTIES_PER_CHANNEL = exports.MCP_MAX_CHANNELS_PER_DEVICE = exports.MCP_MAX_CONTEXT_DEVICES = exports.MCP_MAX_CONTEXT_SPACES = exports.MCP_RATE_LIMIT_TTL_MS = exports.MCP_UNAUTHENTICATED_RATE_LIMIT = exports.MCP_AUTHENTICATED_RATE_LIMIT = exports.MCP_SUBSCRIPTION_CLOSE_TIMEOUT_MS = exports.MCP_SUBSCRIPTION_IDLE_TIMEOUT_MS = exports.MCP_MAX_SUBSCRIPTIONS_PER_CLIENT = exports.MCP_MAX_ACTIVE_SUBSCRIPTIONS = exports.MCP_TOOL_CALL_TIMEOUT_MS = exports.MCP_REQUEST_BODY_LIMIT_BYTES = exports.IS_MCP_ENDPOINT_KEY = exports.MCP_MAX_TOKEN_EXPIRATION_DAYS = exports.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS = exports.MCP_OAUTH_RATE_LIMIT_TTL_MS = exports.MCP_OAUTH_REVOCATION_RATE_LIMIT = exports.MCP_OAUTH_TOKEN_RATE_LIMIT = exports.MCP_OAUTH_AUTHORIZE_RATE_LIMIT = exports.MCP_OAUTH_INTERACTION_RATE_LIMIT = exports.MCP_OAUTH_GRANT_LIFETIME_MS = exports.MCP_OAUTH_REFRESH_FAMILY_LIFETIME_MS = exports.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS = exports.MCP_OAUTH_REVOCATION_PATH = exports.MCP_OAUTH_TOKEN_PATH = exports.MCP_OAUTH_AUTHORIZATION_PATH = exports.MCP_OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = exports.MCP_OAUTH_PROTECTED_RESOURCE_METADATA_PATH = exports.MCP_OAUTH_ISSUER_PATH = exports.MCP_OAUTH_RESOURCE_PATH = exports.MCP_OAUTH_SERVER_STATE_KEY = exports.MCP_OAUTH_PRINCIPAL_TYPE = exports.MCP_OAUTH_PROVIDER_MATERIAL_FILENAME = exports.MCP_DEFAULT_OAUTH_ENABLED = exports.MCP_DEFAULT_OAUTH_PUBLIC_BASE_URL = exports.MCP_DEFAULT_ALLOWED_ORIGINS = exports.MCP_DEFAULT_CAPABILITIES = exports.MCP_DEFAULT_ENABLED = exports.McpOAuthScope = exports.McpCapability = exports.MCP_CATALOG_REGISTRAR = exports.MCP_MODULE_API_TAG_DESCRIPTION = exports.MCP_MODULE_API_TAG_NAME = exports.MCP_MODULE_NAME = exports.MCP_MODULE_PREFIX = void 0;
+exports.MCP_MAX_ENERGY_RANGE_DAYS = exports.MCP_MAX_TIMESERIES_POINTS = exports.MCP_MAX_TIMESERIES_RANGE_DAYS = exports.MCP_MAX_FORECAST_DAYS = exports.MCP_MAX_SECURITY_PROPERTIES_PER_CHANNEL = exports.MCP_MAX_SECURITY_CHANNELS_PER_DEVICE = exports.MCP_MAX_SECURITY_DEVICES = exports.MCP_MAX_SECURITY_ALERTS = exports.MCP_MAX_TRIGGER_SPACES = void 0;
+const home_context_constants_1 = require("../home-context/home-context.constants");
+const MCP_HOME_CONTEXT_LIMITS = home_context_constants_1.HOME_CONTEXT_LIMIT_PROFILES[home_context_constants_1.HOME_CONTEXT_PROFILE_MCP_COMPATIBILITY];
+exports.MCP_MODULE_PREFIX = 'mcp';
+exports.MCP_MODULE_NAME = 'mcp-module';
+exports.MCP_MODULE_API_TAG_NAME = 'MCP module';
+exports.MCP_MODULE_API_TAG_DESCRIPTION = 'Model Context Protocol integration for exposing a curated, capability-scoped smart home agent surface.';
+exports.MCP_CATALOG_REGISTRAR = Symbol('MCP_CATALOG_REGISTRAR');
+var McpCapability;
+(function (McpCapability) {
+    McpCapability["READ"] = "read";
+    McpCapability["WRITE"] = "write";
+    McpCapability["TRIGGER"] = "trigger";
+})(McpCapability || (exports.McpCapability = McpCapability = {}));
+var McpOAuthScope;
+(function (McpOAuthScope) {
+    McpOAuthScope["READ"] = "mcp:read";
+    McpOAuthScope["WRITE"] = "mcp:write";
+    McpOAuthScope["TRIGGER"] = "mcp:trigger";
+    McpOAuthScope["OFFLINE_ACCESS"] = "offline_access";
+})(McpOAuthScope || (exports.McpOAuthScope = McpOAuthScope = {}));
+exports.MCP_DEFAULT_ENABLED = false;
+exports.MCP_DEFAULT_CAPABILITIES = [McpCapability.READ];
+exports.MCP_DEFAULT_ALLOWED_ORIGINS = [];
+exports.MCP_DEFAULT_OAUTH_PUBLIC_BASE_URL = null;
+exports.MCP_DEFAULT_OAUTH_ENABLED = false;
+exports.MCP_OAUTH_PROVIDER_MATERIAL_FILENAME = '.mcp-oauth-provider.json';
+exports.MCP_OAUTH_PRINCIPAL_TYPE = 'mcp_oauth';
+exports.MCP_OAUTH_SERVER_STATE_KEY = 'primary';
+exports.MCP_OAUTH_RESOURCE_PATH = '/api/v1/modules/mcp';
+exports.MCP_OAUTH_ISSUER_PATH = `${exports.MCP_OAUTH_RESOURCE_PATH}/oauth`;
+exports.MCP_OAUTH_PROTECTED_RESOURCE_METADATA_PATH = `/.well-known/oauth-protected-resource${exports.MCP_OAUTH_RESOURCE_PATH}`;
+exports.MCP_OAUTH_AUTHORIZATION_SERVER_METADATA_PATH = `/.well-known/oauth-authorization-server${exports.MCP_OAUTH_ISSUER_PATH}`;
+exports.MCP_OAUTH_AUTHORIZATION_PATH = `${exports.MCP_OAUTH_ISSUER_PATH}/authorize`;
+exports.MCP_OAUTH_TOKEN_PATH = `${exports.MCP_OAUTH_ISSUER_PATH}/token`;
+exports.MCP_OAUTH_REVOCATION_PATH = `${exports.MCP_OAUTH_TOKEN_PATH}/revocation`;
+exports.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS = 10 * 60 * 1000;
+exports.MCP_OAUTH_REFRESH_FAMILY_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
+exports.MCP_OAUTH_GRANT_LIFETIME_MS = 90 * 24 * 60 * 60 * 1000;
+exports.MCP_OAUTH_INTERACTION_RATE_LIMIT = 10;
+exports.MCP_OAUTH_AUTHORIZE_RATE_LIMIT = 20;
+exports.MCP_OAUTH_TOKEN_RATE_LIMIT = 30;
+exports.MCP_OAUTH_REVOCATION_RATE_LIMIT = 30;
+exports.MCP_OAUTH_RATE_LIMIT_TTL_MS = 60 * 1000;
+exports.MCP_DEFAULT_TOKEN_EXPIRATION_DAYS = 90;
+exports.MCP_MAX_TOKEN_EXPIRATION_DAYS = 3650;
+exports.IS_MCP_ENDPOINT_KEY = 'isMcpEndpoint';
+exports.MCP_REQUEST_BODY_LIMIT_BYTES = 1024 * 1024;
+exports.MCP_TOOL_CALL_TIMEOUT_MS = 30_000;
+exports.MCP_MAX_ACTIVE_SUBSCRIPTIONS = 100;
+exports.MCP_MAX_SUBSCRIPTIONS_PER_CLIENT = 5;
+exports.MCP_SUBSCRIPTION_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
+exports.MCP_SUBSCRIPTION_CLOSE_TIMEOUT_MS = 5_000;
+exports.MCP_AUTHENTICATED_RATE_LIMIT = 120;
+exports.MCP_UNAUTHENTICATED_RATE_LIMIT = 10;
+exports.MCP_RATE_LIMIT_TTL_MS = 60 * 1000;
+exports.MCP_MAX_CONTEXT_SPACES = MCP_HOME_CONTEXT_LIMITS.spaces;
+exports.MCP_MAX_CONTEXT_DEVICES = MCP_HOME_CONTEXT_LIMITS.devices;
+exports.MCP_MAX_CHANNELS_PER_DEVICE = MCP_HOME_CONTEXT_LIMITS.channelsPerDevice;
+exports.MCP_MAX_PROPERTIES_PER_CHANNEL = MCP_HOME_CONTEXT_LIMITS.propertiesPerChannel;
+exports.MCP_MAX_CONTEXT_SCENES = MCP_HOME_CONTEXT_LIMITS.scenes;
+exports.MCP_MAX_WRITABLE_PROPERTIES = MCP_HOME_CONTEXT_LIMITS.writableProperties;
+exports.MCP_MAX_WRITABLE_PROPERTY_CANDIDATES = MCP_HOME_CONTEXT_LIMITS.writablePropertyCandidates;
+exports.MCP_MAX_TRIGGER_SCENES = MCP_HOME_CONTEXT_LIMITS.triggerScenes;
+exports.MCP_MAX_TRIGGER_SPACES = MCP_HOME_CONTEXT_LIMITS.triggerSpaces;
+exports.MCP_MAX_SECURITY_ALERTS = MCP_HOME_CONTEXT_LIMITS.securityAlerts;
+exports.MCP_MAX_SECURITY_DEVICES = MCP_HOME_CONTEXT_LIMITS.securityDevices;
+exports.MCP_MAX_SECURITY_CHANNELS_PER_DEVICE = MCP_HOME_CONTEXT_LIMITS.securityChannelsPerDevice;
+exports.MCP_MAX_SECURITY_PROPERTIES_PER_CHANNEL = MCP_HOME_CONTEXT_LIMITS.securityPropertiesPerChannel;
+exports.MCP_MAX_FORECAST_DAYS = MCP_HOME_CONTEXT_LIMITS.forecastDays;
+exports.MCP_MAX_TIMESERIES_RANGE_DAYS = MCP_HOME_CONTEXT_LIMITS.timeseriesRangeDays;
+exports.MCP_MAX_TIMESERIES_POINTS = MCP_HOME_CONTEXT_LIMITS.timeseriesPoints;
+exports.MCP_MAX_ENERGY_RANGE_DAYS = MCP_HOME_CONTEXT_LIMITS.energyRangeDays;
+//# sourceMappingURL=mcp.constants.js.map

package/dist/modules/mcp/mcp.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.constants.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.constants.ts"],"names":[],"mappings":";;;;AAAA,mFAGgD;AAEhD,MAAM,uBAAuB,GAAG,oDAA2B,CAAC,+DAAsC,CAAC,CAAC;AAEvF,QAAA,iBAAiB,GAAG,KAAK,CAAC;AAE1B,QAAA,eAAe,GAAG,YAAY,CAAC;AAE/B,QAAA,uBAAuB,GAAG,YAAY,CAAC;AAEvC,QAAA,8BAA8B,GAC1C,wGAAwG,CAAC;AAE7F,QAAA,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAErE,IAAY,aAIX;AAJD,WAAY,aAAa;IACxB,8BAAa,CAAA;IACb,gCAAe,CAAA;IACf,oCAAmB,CAAA;AACpB,CAAC,EAJW,aAAa,6BAAb,aAAa,QAIxB;AAED,IAAY,aAKX;AALD,WAAY,aAAa;IACxB,kCAAiB,CAAA;IACjB,oCAAmB,CAAA;IACnB,wCAAuB,CAAA;IACvB,kDAAiC,CAAA;AAClC,CAAC,EALW,aAAa,6BAAb,aAAa,QAKxB;AAEY,QAAA,mBAAmB,GAAG,KAAK,CAAC;AAE5B,QAAA,wBAAwB,GAA6B,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAE1E,QAAA,2BAA2B,GAAsB,EAAE,CAAC;AAEpD,QAAA,iCAAiC,GAAkB,IAAI,CAAC;AAExD,QAAA,yBAAyB,GAAG,KAAK,CAAC;AAElC,QAAA,oCAAoC,GAAG,0BAA0B,CAAC;AAElE,QAAA,wBAAwB,GAAG,WAAW,CAAC;AAEvC,QAAA,0BAA0B,GAAG,SAAS,CAAC;AAEvC,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAEhD,QAAA,qBAAqB,GAAG,GAAG,+BAAuB,QAAQ,CAAC;AAE3D,QAAA,0CAA0C,GAAG,wCAAwC,+BAAuB,EAAE,CAAC;AAE/G,QAAA,4CAA4C,GAAG,0CAA0C,6BAAqB,EAAE,CAAC;AAEjH,QAAA,4BAA4B,GAAG,GAAG,6BAAqB,YAAY,CAAC;AAEpE,QAAA,oBAAoB,GAAG,GAAG,6BAAqB,QAAQ,CAAC;AAExD,QAAA,yBAAyB,GAAG,GAAG,4BAAoB,aAAa,CAAC;AAEjE,QAAA,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,QAAA,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhE,QAAA,2BAA2B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,QAAA,gCAAgC,GAAG,EAAE,CAAC;AAEtC,QAAA,8BAA8B,GAAG,EAAE,CAAC;AAEpC,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAEhC,QAAA,+BAA+B,GAAG,EAAE,CAAC;AAErC,QAAA,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,QAAA,iCAAiC,GAAG,EAAE,CAAC;AAEvC,QAAA,6BAA6B,GAAG,IAAI,CAAC;AAErC,QAAA,mBAAmB,GAAG,eAAe,CAAC;AAEtC,QAAA,4BAA4B,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,QAAA,wBAAwB,GAAG,MAAM,CAAC;AAElC,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAEnC,QAAA,gCAAgC,GAAG,CAAC,CAAC;AAErC,QAAA,gCAAgC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,QAAA,iCAAiC,GAAG,KAAK,CAAC;AAE1C,QAAA,4BAA4B,GAAG,GAAG,CAAC;AAEnC,QAAA,8BAA8B,GAAG,EAAE,CAAC;AAEpC,QAAA,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAElC,QAAA,sBAAsB,GAAG,uBAAuB,CAAC,MAAM,CAAC;AAExD,QAAA,uBAAuB,GAAG,uBAAuB,CAAC,OAAO,CAAC;AAE1D,QAAA,2BAA2B,GAAG,uBAAuB,CAAC,iBAAiB,CAAC;AAExE,QAAA,8BAA8B,GAAG,uBAAuB,CAAC,oBAAoB,CAAC;AAE9E,QAAA,sBAAsB,GAAG,uBAAuB,CAAC,MAAM,CAAC;AAExD,QAAA,2BAA2B,GAAG,uBAAuB,CAAC,kBAAkB,CAAC;AAEzE,QAAA,oCAAoC,GAAG,uBAAuB,CAAC,0BAA0B,CAAC;AAE1F,QAAA,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;AAE/D,QAAA,sBAAsB,GAAG,uBAAuB,CAAC,aAAa,CAAC;AAE/D,QAAA,uBAAuB,GAAG,uBAAuB,CAAC,cAAc,CAAC;AAEjE,QAAA,wBAAwB,GAAG,uBAAuB,CAAC,eAAe,CAAC;AAEnE,QAAA,oCAAoC,GAAG,uBAAuB,CAAC,yBAAyB,CAAC;AAEzF,QAAA,uCAAuC,GAAG,uBAAuB,CAAC,4BAA4B,CAAC;AAE/F,QAAA,qBAAqB,GAAG,uBAAuB,CAAC,YAAY,CAAC;AAE7D,QAAA,6BAA6B,GAAG,uBAAuB,CAAC,mBAAmB,CAAC;AAE5E,QAAA,yBAAyB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC;AAErE,QAAA,yBAAyB,GAAG,uBAAuB,CAAC,eAAe,CAAC"}

package/dist/modules/mcp/mcp.exceptions.d.ts

@@ -0,0 +1,4 @@
+import { NotFoundException } from '@nestjs/common';
+export declare class McpEndpointDisabledException extends NotFoundException {
+    constructor();
+}

package/dist/modules/mcp/mcp.exceptions.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpEndpointDisabledException = void 0;
+const common_1 = require("@nestjs/common");
+class McpEndpointDisabledException extends common_1.NotFoundException {
+    constructor() {
+        super('MCP endpoint is disabled');
+    }
+}
+exports.McpEndpointDisabledException = McpEndpointDisabledException;
+//# sourceMappingURL=mcp.exceptions.js.map

package/dist/modules/mcp/mcp.exceptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.exceptions.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.exceptions.ts"],"names":[],"mappings":";;;AAAA,2CAAmD;AAEnD,MAAa,4BAA6B,SAAQ,0BAAiB;IAClE;QACC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACnC,CAAC;CACD;AAJD,oEAIC"}

package/dist/modules/mcp/mcp.module.d.ts

@@ -0,0 +1,23 @@
+import { OnModuleInit } from '@nestjs/common';
+import { ModuleConfigMutationRegistryService } from '../config/services/module-config-mutation-registry.service';
+import { ModulesTypeMapperService } from '../config/services/modules-type-mapper.service';
+import { ExtensionsService } from '../extensions/services/extensions.service';
+import { StatsRegistryService } from '../stats/services/stats-registry.service';
+import { SwaggerModelsRegistryService } from '../swagger/services/swagger-models-registry.service';
+import { UserLifecycleMutationRegistryService } from '../users/services/user-lifecycle-mutation-registry.service';
+import { McpStatsProvider } from './providers/mcp-stats.provider';
+import { McpOAuthApproverAuthorityService } from './services/mcp-oauth-approver-authority.service';
+import { McpOAuthModuleConfigMutationService } from './services/mcp-oauth-module-config-mutation.service';
+export declare class McpModule implements OnModuleInit {
+    private readonly swaggerRegistry;
+    private readonly modulesMapperService;
+    private readonly moduleConfigMutations;
+    private readonly moduleConfigMutation;
+    private readonly userLifecycleMutations;
+    private readonly approverAuthority;
+    private readonly extensionsService;
+    private readonly statsRegistryService;
+    private readonly statsProvider;
+    constructor(swaggerRegistry: SwaggerModelsRegistryService, modulesMapperService: ModulesTypeMapperService, moduleConfigMutations: ModuleConfigMutationRegistryService, moduleConfigMutation: McpOAuthModuleConfigMutationService, userLifecycleMutations: UserLifecycleMutationRegistryService, approverAuthority: McpOAuthApproverAuthorityService, extensionsService: ExtensionsService, statsRegistryService: StatsRegistryService, statsProvider: McpStatsProvider);
+    onModuleInit(): void;
+}