@fastybird/smart-panel-backend 1.0.0-beta.2 → 1.1.0-alpha.0

package/dist/modules/mcp/oauth/mcp-oauth-provider.factory.js

@@ -0,0 +1,324 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOAuthProviderFactory = void 0;
+const node_crypto_1 = require("node:crypto");
+const typeorm_1 = require("typeorm");
+const common_1 = require("@nestjs/common");
+const mcp_constants_1 = require("../mcp.constants");
+const mcp_oauth_client_service_1 = require("../services/mcp-oauth-client.service");
+const mcp_oauth_endpoint_rate_limit_service_1 = require("../services/mcp-oauth-endpoint-rate-limit.service");
+const mcp_oauth_provider_material_service_1 = require("../services/mcp-oauth-provider-material.service");
+const mcp_oauth_public_url_service_1 = require("../services/mcp-oauth-public-url.service");
+const mcp_oauth_route_gate_service_1 = require("../services/mcp-oauth-route-gate.service");
+const mcp_subscription_registry_service_1 = require("../services/mcp-subscription-registry.service");
+const mcp_oauth_metadata_1 = require("./mcp-oauth-metadata");
+const mcp_oauth_provider_adapter_1 = require("./mcp-oauth-provider.adapter");
+const mcp_oauth_provider_loader_1 = require("./mcp-oauth-provider.loader");
+const toSeconds = (milliseconds) => Math.floor(milliseconds / 1_000);
+let McpOAuthProviderFactory = class McpOAuthProviderFactory {
+    constructor(dataSource, clientsService, publicUrlService, providerMaterial, subscriptions, endpointRateLimit, routeGate) {
+        this.dataSource = dataSource;
+        this.clientsService = clientsService;
+        this.publicUrlService = publicUrlService;
+        this.providerMaterial = providerMaterial;
+        this.subscriptions = subscriptions;
+        this.endpointRateLimit = endpointRateLimit;
+        this.routeGate = routeGate;
+    }
+    async create(options = {}) {
+        const urls = this.publicUrlService.getUrls();
+        if (!urls) {
+            throw new common_1.ServiceUnavailableException('MCP OAuth public URL is not configured');
+        }
+        const persistentMaterial = process.env.NODE_ENV !== 'test' && (!options.cookieKeys || !options.jwks) ? this.providerMaterial.get() : null;
+        const cookieKeys = options.cookieKeys ?? persistentMaterial?.cookieKeys;
+        const jwks = options.jwks ?? persistentMaterial?.jwks;
+        if (process.env.NODE_ENV !== 'test' && options.allowInsecureTestCookies === true) {
+            throw new common_1.ServiceUnavailableException('Insecure MCP OAuth cookies are permitted only by explicit test setups');
+        }
+        const oidcProvider = await (0, mcp_oauth_provider_loader_1.loadMcpOAuthProvider)();
+        const testPrivateKey = jwks
+            ? null
+            : (0, node_crypto_1.generateKeyPairSync)('rsa', { modulusLength: 2048 }).privateKey.export({ format: 'jwk' });
+        const adapter = (0, mcp_oauth_provider_adapter_1.createMcpOAuthProviderAdapter)(this.dataSource, this.clientsService, {
+            allowTestInMemory: options.allowTestInMemory,
+            artifactReuseError: () => new oidcProvider.errors.InvalidGrant('OAuth artifact already used'),
+            artifactLifecycleHook: options.artifactLifecycleHook,
+            beforeArtifactUpsert: options.beforeArtifactUpsert,
+        });
+        const provider = new oidcProvider.default(urls.issuer, {
+            adapter,
+            routes: {
+                authorization: new URL(urls.authorizationEndpoint).pathname,
+                token: new URL(urls.tokenEndpoint).pathname,
+                revocation: new URL(urls.revocationEndpoint).pathname,
+            },
+            clientAuthMethods: ['none'],
+            responseTypes: ['code'],
+            scopes: [mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS],
+            extraParams: {
+                state: async (context, state) => {
+                    if (context.oidc.route === 'authorization' && !state) {
+                        throw new oidcProvider.errors.InvalidRequest('The OAuth state parameter is required');
+                    }
+                    if (context.oidc.route !== 'authorization')
+                        return;
+                    const clientIdentifier = context.oidc.params.client_id;
+                    const registeredClient = typeof clientIdentifier === 'string'
+                        ? await this.clientsService.findActiveByIdentifier(clientIdentifier)
+                        : null;
+                    if (!registeredClient)
+                        return;
+                    const requestedScope = context.oidc.params.scope;
+                    const scopeWasProvided = context.query.scope !== undefined;
+                    if (!requestedScope && !scopeWasProvided) {
+                        context.oidc.params.scope = registeredClient.maximumScopes
+                            .filter((scope) => scope !== mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS)
+                            .join(' ');
+                        return;
+                    }
+                    if (!requestedScope) {
+                        throw new oidcProvider.errors.InvalidScope('requested scope contains no capability scope', mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS);
+                    }
+                    if (typeof requestedScope !== 'string')
+                        return;
+                    const requestedScopes = requestedScope.split(' ').filter(Boolean);
+                    if (!requestedScopes.some((scope) => scope !== String(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS))) {
+                        throw new oidcProvider.errors.InvalidScope('requested scope contains no capability scope', mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS);
+                    }
+                    const disallowedScopes = requestedScopes.filter((scope) => !registeredClient.maximumScopes.includes(scope));
+                    if (disallowedScopes.length > 0) {
+                        throw new oidcProvider.errors.InvalidScope('requested scope is not allowed', disallowedScopes.join(' '));
+                    }
+                },
+            },
+            allowOmittingSingleRegisteredRedirectUri: false,
+            acceptQueryParamAccessTokens: false,
+            cookies: {
+                keys: cookieKeys ?? [(0, node_crypto_1.randomBytes)(32).toString('base64url')],
+                long: {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    path: '/',
+                    secure: options.allowInsecureTestCookies !== true,
+                },
+                short: {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    path: '/',
+                    secure: options.allowInsecureTestCookies !== true,
+                },
+            },
+            features: {
+                devInteractions: { enabled: false },
+                dPoP: { enabled: false },
+                pushedAuthorizationRequests: { enabled: false },
+                rpInitiatedLogout: { enabled: false },
+                userinfo: { enabled: false },
+                introspection: { enabled: false },
+                registration: { enabled: false },
+                clientCredentials: { enabled: false },
+                deviceFlow: { enabled: false },
+                revocation: {
+                    enabled: true,
+                    allowedPolicy: (_context, client, token) => token.clientId === client.clientId,
+                },
+                resourceIndicators: {
+                    enabled: true,
+                    defaultResource: () => {
+                        throw new oidcProvider.errors.InvalidTarget('The MCP resource parameter is required');
+                    },
+                    useGrantedResource: () => false,
+                    getResourceServerInfo: (context, requestedResource) => {
+                        if (requestedResource !== urls.resource) {
+                            throw new oidcProvider.errors.InvalidTarget('The MCP resource does not match this installation');
+                        }
+                        const grantExpiresAt = context.oidc.entities.Grant?.exp;
+                        const remainingGrantLifetime = typeof grantExpiresAt === 'number'
+                            ? Math.max(1, grantExpiresAt - Math.floor(Date.now() / 1_000))
+                            : undefined;
+                        return {
+                            scope: [mcp_constants_1.McpOAuthScope.READ, mcp_constants_1.McpOAuthScope.WRITE, mcp_constants_1.McpOAuthScope.TRIGGER].join(' '),
+                            audience: urls.resource,
+                            accessTokenTTL: Math.min(toSeconds(mcp_constants_1.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS), remainingGrantLifetime ?? Number.POSITIVE_INFINITY),
+                            accessTokenFormat: 'opaque',
+                        };
+                    },
+                },
+            },
+            pkce: { required: () => true },
+            issueRefreshToken: (_context, _client, code) => code.scopes.has(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS),
+            rotateRefreshToken: true,
+            renderError: (context, out) => {
+                context.status = 400;
+                context.type = 'application/json';
+                context.body = {
+                    error: out.error,
+                    ...(out.error_description ? { error_description: out.error_description } : {}),
+                };
+            },
+            interactions: {
+                url: (_context, interaction) => options.interactionUrl?.(interaction.uid) ??
+                    `${urls.publicBaseUrl}/mcp-oauth-consent?interaction=${encodeURIComponent(interaction.uid)}`,
+            },
+            findAccount: (_context, accountId) => ({
+                accountId,
+                claims: () => ({ sub: accountId }),
+            }),
+            loadExistingGrant: (context) => {
+                const consentGrantId = context.oidc.result?.consent?.grantId;
+                return consentGrantId ? context.oidc.provider.Grant.find(consentGrantId) : undefined;
+            },
+            ttl: {
+                AccessToken: toSeconds(mcp_constants_1.MCP_OAUTH_ACCESS_TOKEN_LIFETIME_MS),
+                AuthorizationCode: 60,
+                RefreshToken: (context, refreshToken) => {
+                    const grantExpiresAt = context.oidc.entities.Grant?.exp;
+                    const remainingGrantLifetime = typeof grantExpiresAt === 'number'
+                        ? Math.max(1, grantExpiresAt - Math.floor(Date.now() / 1_000))
+                        : Number.POSITIVE_INFINITY;
+                    const remainingFamilyLifetime = Math.max(1, toSeconds(mcp_constants_1.MCP_OAUTH_REFRESH_FAMILY_LIFETIME_MS) - refreshToken.totalLifetime() - 1);
+                    return Math.min(remainingFamilyLifetime, remainingGrantLifetime);
+                },
+                Grant: toSeconds(mcp_constants_1.MCP_OAUTH_GRANT_LIFETIME_MS),
+                Interaction: 10 * 60,
+                Session: 30 * 60,
+            },
+            jwks: jwks ??
+                { keys: [{ ...testPrivateKey, use: 'sig', alg: 'RS256', kid: 'mcp-oauth-internal-test' }] },
+        });
+        provider.proxy = true;
+        const providerCallback = provider.callback();
+        const callback = (request, response) => {
+            void this.dispatchProviderRequest(request, response, providerCallback, urls).catch(() => {
+                if (response.headersSent) {
+                    response.destroy();
+                    return;
+                }
+                response.statusCode = 500;
+                response.setHeader('content-type', 'application/json');
+                response.setHeader('cache-control', 'no-store');
+                response.end(JSON.stringify({ error: 'server_error' }));
+            });
+        };
+        return { provider, callback, urls, metadata: (0, mcp_oauth_metadata_1.buildMcpOAuthAuthorizationServerMetadata)(urls) };
+    }
+    assertTokenRequestResource(parameters) {
+        const grantType = parameters.get('grant_type');
+        if ((grantType === 'authorization_code' || grantType === 'refresh_token') && !parameters.get('resource')) {
+            throw new Error('invalid_target: The MCP resource parameter is required at the token endpoint');
+        }
+    }
+    async dispatchProviderRequest(request, response, providerCallback, urls) {
+        const pathname = new URL(request.url ?? '/', urls.issuer).pathname;
+        const tokenPathname = new URL(urls.tokenEndpoint).pathname;
+        const rateLimitedEndpoint = this.getRateLimitedEndpoint(pathname, urls);
+        const routeGeneration = this.routeGate.assertOpen();
+        if (rateLimitedEndpoint) {
+            const decision = await this.endpointRateLimit.consume(rateLimitedEndpoint, request.socket?.remoteAddress);
+            if (!decision.allowed) {
+                this.writeRateLimitError(request, response, decision.retryAfterSeconds);
+                return;
+            }
+        }
+        if (request.method === 'GET' && pathname === new URL(urls.authorizationEndpoint).pathname) {
+            this.ensureOfflineAccessConsentPrompt(request, urls);
+        }
+        if (request.method === 'POST' && (pathname === tokenPathname || pathname === '/token')) {
+            const contentType = request.headers['content-type']?.split(';', 1)[0]?.trim().toLowerCase();
+            if (contentType === 'application/x-www-form-urlencoded') {
+                const rawBody = await this.readRequestBody(request);
+                request.body = rawBody;
+                try {
+                    this.assertTokenRequestResource(new URLSearchParams(rawBody));
+                }
+                catch {
+                    this.writeBoundaryError(response, 'invalid_target', 'The MCP resource parameter is required at the token endpoint');
+                    return;
+                }
+            }
+        }
+        await this.subscriptions.runOAuthMutation(async () => {
+            if (this.isDisconnected(request, response))
+                return;
+            this.routeGate.assertOpenGeneration(routeGeneration);
+            await providerCallback(request, response);
+        });
+    }
+    ensureOfflineAccessConsentPrompt(request, urls) {
+        const authorizationUrl = new URL(request.url ?? '/', urls.issuer);
+        const requestedScopes = authorizationUrl.searchParams.get('scope')?.split(/\s+/).filter(Boolean) ?? [];
+        if (requestedScopes.includes(mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS) && !authorizationUrl.searchParams.has('prompt')) {
+            authorizationUrl.searchParams.set('prompt', 'consent');
+            request.url = `${authorizationUrl.pathname}${authorizationUrl.search}`;
+        }
+    }
+    isDisconnected(request, response) {
+        return request.aborted || response.destroyed || response.closed || response.writableEnded;
+    }
+    async readRequestBody(request) {
+        const chunks = [];
+        let length = 0;
+        for await (const chunk of request) {
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            length += buffer.length;
+            if (length > 56 * 1_024) {
+                throw new Error('OAuth token request body exceeds the supported limit');
+            }
+            chunks.push(buffer);
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    writeBoundaryError(response, error, description) {
+        response.statusCode = 400;
+        response.setHeader('content-type', 'application/json');
+        response.setHeader('cache-control', 'no-store');
+        response.setHeader('pragma', 'no-cache');
+        response.end(JSON.stringify({ error, error_description: description }));
+    }
+    getRateLimitedEndpoint(pathname, urls) {
+        if (pathname === new URL(urls.authorizationEndpoint).pathname ||
+            pathname === '/authorize' ||
+            pathname === '/auth' ||
+            pathname.startsWith('/auth/')) {
+            return mcp_oauth_endpoint_rate_limit_service_1.McpOAuthRateLimitedEndpoint.AUTHORIZE;
+        }
+        if (pathname === new URL(urls.tokenEndpoint).pathname || pathname === '/token') {
+            return mcp_oauth_endpoint_rate_limit_service_1.McpOAuthRateLimitedEndpoint.TOKEN;
+        }
+        if (pathname === new URL(urls.revocationEndpoint).pathname || pathname === '/token/revocation') {
+            return mcp_oauth_endpoint_rate_limit_service_1.McpOAuthRateLimitedEndpoint.REVOCATION;
+        }
+        return null;
+    }
+    writeRateLimitError(request, response, retryAfterSeconds) {
+        response.statusCode = 429;
+        response.setHeader('content-type', 'application/json');
+        response.setHeader('cache-control', 'no-store');
+        response.setHeader('pragma', 'no-cache');
+        response.setHeader('retry-after', retryAfterSeconds.toString());
+        response.setHeader('connection', 'close');
+        response.end(JSON.stringify({ error: 'temporarily_unavailable', error_description: 'Too many OAuth requests' }), () => request.destroy());
+    }
+};
+exports.McpOAuthProviderFactory = McpOAuthProviderFactory;
+exports.McpOAuthProviderFactory = McpOAuthProviderFactory = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource,
+        mcp_oauth_client_service_1.McpOAuthClientService,
+        mcp_oauth_public_url_service_1.McpOAuthPublicUrlService,
+        mcp_oauth_provider_material_service_1.McpOAuthProviderMaterialService,
+        mcp_subscription_registry_service_1.McpSubscriptionRegistryService,
+        mcp_oauth_endpoint_rate_limit_service_1.McpOAuthEndpointRateLimitService,
+        mcp_oauth_route_gate_service_1.McpOAuthRouteGateService])
+], McpOAuthProviderFactory);
+//# sourceMappingURL=mcp-oauth-provider.factory.js.map

package/dist/modules/mcp/oauth/mcp-oauth-provider.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-provider.factory.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-provider.factory.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA+D;AAI/D,qCAAqC;AAErC,2CAAyE;AAEzE,oDAK0B;AAC1B,mFAA6E;AAC7E,6GAG2D;AAC3D,yGAAkG;AAClG,2FAAoF;AACpF,2FAAoF;AACpF,qGAA+F;AAE/F,6DAAqH;AACrH,6EAAkH;AAClH,2EAAmE;AAGnE,MAAM,SAAS,GAAG,CAAC,YAAoB,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC;AAoB9E,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACnC,YACkB,UAAsB,EACtB,cAAqC,EACrC,gBAA0C,EAC1C,gBAAiD,EACjD,aAA6C,EAC7C,iBAAmD,EACnD,SAAmC;QANnC,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAuB;QACrC,qBAAgB,GAAhB,gBAAgB,CAA0B;QAC1C,qBAAgB,GAAhB,gBAAgB,CAAiC;QACjD,kBAAa,GAAb,aAAa,CAAgC;QAC7C,sBAAiB,GAAjB,iBAAiB,CAAkC;QACnD,cAAS,GAAT,SAAS,CAA0B;IAClD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,UAA0C,EAAE;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,IAAI,oCAA2B,CAAC,wCAAwC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,EAAE,UAAU,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,EAAE,IAAI,CAAC;QAEtD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;YAClF,MAAM,IAAI,oCAA2B,CAAC,uEAAuE,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAA,gDAAoB,GAAE,CAAC;QAClD,MAAM,cAAc,GAAG,IAAI;YAC1B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAA,iCAAmB,EAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,OAAO,GAAG,IAAA,0DAA6B,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE;YACnF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,6BAA6B,CAAC;YAC7F,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;YACpD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;SAClD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE;YACtD,OAAO;YACP,MAAM,EAAE;gBACP,aAAa,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ;gBAC3D,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ;gBAC3C,UAAU,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ;aACrD;YACD,iBAAiB,EAAE,CAAC,MAAM,CAAC;YAC3B,aAAa,EAAE,CAAC,MAAM,CAAC;YAGvB,MAAM,EAAE,CAAC,6BAAa,CAAC,cAAc,CAAC;YACtC,WAAW,EAAE;gBACZ,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;oBAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe,IAAI,CAAC,KAAK,EAAE,CAAC;wBACtD,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,uCAAuC,CAAC,CAAC;oBACvF,CAAC;oBAED,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,eAAe;wBAAE,OAAO;oBAEnD,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;oBACvD,MAAM,gBAAgB,GACrB,OAAO,gBAAgB,KAAK,QAAQ;wBACnC,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,gBAAgB,CAAC;wBACpE,CAAC,CAAC,IAAI,CAAC;oBAET,IAAI,CAAC,gBAAgB;wBAAE,OAAO;oBAE9B,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;oBAE3D,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBAG1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,gBAAgB,CAAC,aAAa;6BACxD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,6BAAa,CAAC,cAAc,CAAC;6BACzD,IAAI,CAAC,GAAG,CAAC,CAAC;wBACZ,OAAO;oBACR,CAAC;oBAED,IAAI,CAAC,cAAc,EAAE,CAAC;wBACrB,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,CACzC,8CAA8C,EAC9C,6BAAa,CAAC,cAAc,CAC5B,CAAC;oBACH,CAAC;oBAED,IAAI,OAAO,cAAc,KAAK,QAAQ;wBAAE,OAAO;oBAE/C,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAElE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,6BAAa,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;wBACtF,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,CACzC,8CAA8C,EAC9C,6BAAa,CAAC,cAAc,CAC5B,CAAC;oBACH,CAAC;oBAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAC9C,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAsB,CAAC,CAC3E,CAAC;oBAEF,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1G,CAAC;gBACF,CAAC;aACD;YACD,wCAAwC,EAAE,KAAK;YAC/C,4BAA4B,EAAE,KAAK;YACnC,OAAO,EAAE;gBACR,IAAI,EAAE,UAAU,IAAI,CAAC,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC3D,IAAI,EAAE;oBACL,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,OAAO,CAAC,wBAAwB,KAAK,IAAI;iBACjD;gBACD,KAAK,EAAE;oBACN,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,GAAG;oBACT,MAAM,EAAE,OAAO,CAAC,wBAAwB,KAAK,IAAI;iBACjD;aACD;YACD,QAAQ,EAAE;gBACT,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACnC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACxB,2BAA2B,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC/C,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC5B,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACjC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAChC,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACrC,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBAC9B,UAAU,EAAE;oBACX,OAAO,EAAE,IAAI;oBACb,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;iBAC9E;gBACD,kBAAkB,EAAE;oBACnB,OAAO,EAAE,IAAI;oBACb,eAAe,EAAE,GAAG,EAAE;wBACrB,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC;oBACvF,CAAC;oBACD,kBAAkB,EAAE,GAAG,EAAE,CAAC,KAAK;oBAC/B,qBAAqB,EAAE,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE;wBACrD,IAAI,iBAAiB,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACzC,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,mDAAmD,CAAC,CAAC;wBAClG,CAAC;wBAED,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;wBACxD,MAAM,sBAAsB,GAC3B,OAAO,cAAc,KAAK,QAAQ;4BACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;4BAC9D,CAAC,CAAC,SAAS,CAAC;wBAEd,OAAO;4BACN,KAAK,EAAE,CAAC,6BAAa,CAAC,IAAI,EAAE,6BAAa,CAAC,KAAK,EAAE,6BAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;4BACjF,QAAQ,EAAE,IAAI,CAAC,QAAQ;4BACvB,cAAc,EAAE,IAAI,CAAC,GAAG,CACvB,SAAS,CAAC,kDAAkC,CAAC,EAC7C,sBAAsB,IAAI,MAAM,CAAC,iBAAiB,CAClD;4BACD,iBAAiB,EAAE,QAAQ;yBAC3B,CAAC;oBACH,CAAC;iBACD;aACD;YACD,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YAC9B,iBAAiB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAAa,CAAC,cAAc,CAAC;YAC7F,kBAAkB,EAAE,IAAI;YACxB,WAAW,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;gBAC7B,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;gBACrB,OAAO,CAAC,IAAI,GAAG,kBAAkB,CAAC;gBAClC,OAAO,CAAC,IAAI,GAAG;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC;YACH,CAAC;YACD,YAAY,EAAE;gBACb,GAAG,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CAC9B,OAAO,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;oBACzC,GAAG,IAAI,CAAC,aAAa,kCAAkC,kBAAkB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE;aAC7F;YACD,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACtC,SAAS;gBACT,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;aAClC,CAAC;YACF,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;gBAC9B,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;gBAE7D,OAAO,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,CAAC;YACD,GAAG,EAAE;gBACJ,WAAW,EAAE,SAAS,CAAC,kDAAkC,CAAC;gBAC1D,iBAAiB,EAAE,EAAE;gBACrB,YAAY,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE;oBACvC,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC;oBACxD,MAAM,sBAAsB,GAC3B,OAAO,cAAc,KAAK,QAAQ;wBACjC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;wBAC9D,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;oBAG7B,MAAM,uBAAuB,GAAG,IAAI,CAAC,GAAG,CACvC,CAAC,EACD,SAAS,CAAC,oDAAoC,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAClF,CAAC;oBAEF,OAAO,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;gBAClE,CAAC;gBACD,KAAK,EAAE,SAAS,CAAC,2CAA2B,CAAC;gBAC7C,WAAW,EAAE,EAAE,GAAG,EAAE;gBACpB,OAAO,EAAE,EAAE,GAAG,EAAE;aAChB;YACD,IAAI,EACH,IAAI;gBACH,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,EAExF;SACH,CAAC,CAAC;QAIH,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;QAEtB,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvD,KAAK,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBACvF,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO;gBACR,CAAC;gBAED,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAA,6DAAwC,EAAC,IAAI,CAAC,EAAE,CAAC;IAC/F,CAAC;IAED,0BAA0B,CAAC,UAA2B;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAE/C,IAAI,CAAC,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACjG,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACpC,OAAwB,EACxB,QAAwB,EACxB,gBAAuF,EACvF,IAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACnE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC;QAC3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAEpD,IAAI,mBAAmB,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YAE1G,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACvB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBACxE,OAAO;YACR,CAAC;QACF,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3F,IAAI,CAAC,gCAAgC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAE5F,IAAI,WAAW,KAAK,mCAAmC,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBACnD,OAA+C,CAAC,IAAI,GAAG,OAAO,CAAC;gBAEhE,IAAI,CAAC;oBACJ,IAAI,CAAC,0BAA0B,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;oBACR,IAAI,CAAC,kBAAkB,CACtB,QAAQ,EACR,gBAAgB,EAChB,8DAA8D,CAC9D,CAAC;oBACF,OAAO;gBACR,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,IAAI,EAAE;YACpD,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAAE,OAAO;YACnD,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAErD,MAAM,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,gCAAgC,CAAC,OAAwB,EAAE,IAAwB;QAC1F,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAEvG,IAAI,eAAe,CAAC,QAAQ,CAAC,6BAAa,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAI5G,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,GAAG,GAAG,gBAAgB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACxE,CAAC;IACF,CAAC;IAEO,cAAc,CAAC,OAAwB,EAAE,QAAwB;QACxE,OAAO,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC;IAC3F,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAAwB;QACrD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YACjF,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;YAExB,IAAI,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAEO,kBAAkB,CAAC,QAAwB,EAAE,KAAa,EAAE,WAAmB;QACtF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAEO,sBAAsB,CAAC,QAAgB,EAAE,IAAwB;QACxE,IACC,QAAQ,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,QAAQ;YACzD,QAAQ,KAAK,YAAY;YACzB,QAAQ,KAAK,OAAO;YACpB,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC5B,CAAC;YACF,OAAO,mEAA2B,CAAC,SAAS,CAAC;QAC9C,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChF,OAAO,mEAA2B,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAChG,OAAO,mEAA2B,CAAC,UAAU,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,mBAAmB,CAAC,OAAwB,EAAE,QAAwB,EAAE,iBAAyB;QACxG,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzC,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC1C,QAAQ,CAAC,GAAG,CACX,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,CAAC,EAClG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CACvB,CAAC;IACH,CAAC;CACD,CAAA;AArXY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGkB,oBAAU;QACN,gDAAqB;QACnB,uDAAwB;QACxB,qEAA+B;QAClC,kEAA8B;QAC1B,wEAAgC;QACxC,uDAAwB;GARzC,uBAAuB,CAqXnC"}

package/dist/modules/mcp/oauth/mcp-oauth-provider.loader.d.ts

@@ -0,0 +1,4 @@
+import type * as OidcProvider from 'oidc-provider';
+type OidcProviderModule = typeof OidcProvider;
+export declare const loadMcpOAuthProvider: () => Promise<OidcProviderModule>;
+export {};

package/dist/modules/mcp/oauth/mcp-oauth-provider.loader.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadMcpOAuthProvider = void 0;
+const nativeImport = new Function('specifier', 'return import(specifier);');
+const loadMcpOAuthProvider = async () => nativeImport('oidc-provider');
+exports.loadMcpOAuthProvider = loadMcpOAuthProvider;
+//# sourceMappingURL=mcp-oauth-provider.loader.js.map

package/dist/modules/mcp/oauth/mcp-oauth-provider.loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-provider.loader.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-provider.loader.ts"],"names":[],"mappings":";;;AASA,MAAM,YAAY,GAAG,IAAI,QAAQ,CAAC,WAAW,EAAE,2BAA2B,CAAiB,CAAC;AAErF,MAAM,oBAAoB,GAAG,KAAK,IAAiC,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;AAA9F,QAAA,oBAAoB,wBAA0E"}

package/dist/modules/mcp/oauth/mcp-oauth-redaction.d.ts

@@ -0,0 +1 @@
+export declare function redactMcpOAuthLogValue(value: unknown): unknown;

package/dist/modules/mcp/oauth/mcp-oauth-redaction.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactMcpOAuthLogValue = redactMcpOAuthLogValue;
+const SENSITIVE_KEY = /(?:authorization|code|cookie|password|pkce|secret|token|verifier|hash)/i;
+function redactMcpOAuthLogValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => redactMcpOAuthLogValue(item));
+    }
+    if (!value || typeof value !== 'object') {
+        return value;
+    }
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+        key,
+        SENSITIVE_KEY.test(key) ? '[REDACTED]' : redactMcpOAuthLogValue(entry),
+    ]));
+}
+//# sourceMappingURL=mcp-oauth-redaction.js.map

package/dist/modules/mcp/oauth/mcp-oauth-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-redaction.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-redaction.ts"],"names":[],"mappings":";;AAEA,wDAeC;AAjBD,MAAM,aAAa,GAAG,yEAAyE,CAAC;AAEhG,SAAgB,sBAAsB,CAAC,KAAc;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3C,GAAG;QACH,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC;KACtE,CAAC,CACF,CAAC;AACH,CAAC"}

package/dist/modules/mcp/oauth/mcp-oauth-scope.utils.d.ts

@@ -0,0 +1,3 @@
+import { McpCapability, McpOAuthScope } from '../mcp.constants';
+export declare const toMcpCapability: (scope: McpOAuthScope) => McpCapability | undefined;
+export declare const toMcpOAuthScope: (capability: McpCapability) => McpOAuthScope;

package/dist/modules/mcp/oauth/mcp-oauth-scope.utils.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toMcpOAuthScope = exports.toMcpCapability = void 0;
+const mcp_constants_1 = require("../mcp.constants");
+const toMcpCapability = (scope) => {
+    switch (scope) {
+        case mcp_constants_1.McpOAuthScope.READ:
+            return mcp_constants_1.McpCapability.READ;
+        case mcp_constants_1.McpOAuthScope.WRITE:
+            return mcp_constants_1.McpCapability.WRITE;
+        case mcp_constants_1.McpOAuthScope.TRIGGER:
+            return mcp_constants_1.McpCapability.TRIGGER;
+        case mcp_constants_1.McpOAuthScope.OFFLINE_ACCESS:
+            return undefined;
+    }
+};
+exports.toMcpCapability = toMcpCapability;
+const toMcpOAuthScope = (capability) => {
+    switch (capability) {
+        case mcp_constants_1.McpCapability.READ:
+            return mcp_constants_1.McpOAuthScope.READ;
+        case mcp_constants_1.McpCapability.WRITE:
+            return mcp_constants_1.McpOAuthScope.WRITE;
+        case mcp_constants_1.McpCapability.TRIGGER:
+            return mcp_constants_1.McpOAuthScope.TRIGGER;
+    }
+};
+exports.toMcpOAuthScope = toMcpOAuthScope;
+//# sourceMappingURL=mcp-oauth-scope.utils.js.map

package/dist/modules/mcp/oauth/mcp-oauth-scope.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-scope.utils.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth-scope.utils.ts"],"names":[],"mappings":";;;AAAA,oDAAgE;AAEzD,MAAM,eAAe,GAAG,CAAC,KAAoB,EAA6B,EAAE;IAClF,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,6BAAa,CAAC,IAAI;YACtB,OAAO,6BAAa,CAAC,IAAI,CAAC;QAC3B,KAAK,6BAAa,CAAC,KAAK;YACvB,OAAO,6BAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,6BAAa,CAAC,OAAO;YACzB,OAAO,6BAAa,CAAC,OAAO,CAAC;QAC9B,KAAK,6BAAa,CAAC,cAAc;YAChC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC,CAAC;AAXW,QAAA,eAAe,mBAW1B;AAEK,MAAM,eAAe,GAAG,CAAC,UAAyB,EAAiB,EAAE;IAC3E,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,6BAAa,CAAC,IAAI;YACtB,OAAO,6BAAa,CAAC,IAAI,CAAC;QAC3B,KAAK,6BAAa,CAAC,KAAK;YACvB,OAAO,6BAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,6BAAa,CAAC,OAAO;YACzB,OAAO,6BAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;AACF,CAAC,CAAC;AATW,QAAA,eAAe,mBAS1B"}

package/dist/modules/mcp/oauth/mcp-oauth.types.d.ts

@@ -0,0 +1,31 @@
+import { MCP_OAUTH_PRINCIPAL_TYPE, McpCapability, McpOAuthScope } from '../mcp.constants';
+export interface McpOAuthPrincipal {
+    type: typeof MCP_OAUTH_PRINCIPAL_TYPE;
+    accessTokenId: string;
+    approverAuthorityGeneration: number;
+    approverId: string;
+    authorizationDeadline: number;
+    clientId: string;
+    clientGeneration: number;
+    effectiveScopes: McpOAuthScope[];
+    grantId: string;
+    grantGeneration: number;
+    installationId: string;
+    modulePolicyGeneration: number;
+    oauthEnabledGeneration: number;
+    publicIdentityGeneration: number;
+    refreshFamilyId?: string;
+    serverSecretVersion: number;
+    scopes: McpOAuthScope[];
+    effectiveCapabilities: McpCapability[];
+}
+export interface McpOAuthPublicUrls {
+    publicBaseUrl: string;
+    resource: string;
+    protectedResourceMetadata: string;
+    issuer: string;
+    authorizationServerMetadata: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    revocationEndpoint: string;
+}

package/dist/modules/mcp/oauth/mcp-oauth.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=mcp-oauth.types.js.map

package/dist/modules/mcp/oauth/mcp-oauth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.types.js","sourceRoot":"","sources":["../../../../src/modules/mcp/oauth/mcp-oauth.types.ts"],"names":[],"mappings":""}

package/dist/modules/mcp/providers/mcp-stats.provider.d.ts

@@ -0,0 +1,19 @@
+import { StatsProvider } from '../../stats/stats.interfaces';
+import { McpAuditService } from '../services/mcp-audit.service';
+interface StatValue {
+    value: number;
+    last_updated: Date;
+}
+export interface McpStatsSnapshot {
+    [metric: string]: StatValue;
+    activeSubscriptions: StatValue;
+    failures: StatValue;
+    denials: StatValue;
+    timeouts: StatValue;
+}
+export declare class McpStatsProvider implements StatsProvider<McpStatsSnapshot> {
+    private readonly auditService;
+    constructor(auditService: McpAuditService);
+    getStats(): Promise<McpStatsSnapshot>;
+}
+export {};

package/dist/modules/mcp/providers/mcp-stats.provider.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpStatsProvider = void 0;
+const common_1 = require("@nestjs/common");
+const mcp_audit_service_1 = require("../services/mcp-audit.service");
+let McpStatsProvider = class McpStatsProvider {
+    constructor(auditService) {
+        this.auditService = auditService;
+    }
+    getStats() {
+        const snapshot = this.auditService.getMetricsSnapshot();
+        const lastUpdated = new Date();
+        const values = (prefix, entries) => Object.fromEntries(Object.entries(entries).map(([key, value]) => [`${prefix}_${key}`, { value, last_updated: lastUpdated }]));
+        return Promise.resolve({
+            activeSubscriptions: { value: snapshot.activeSubscriptions, last_updated: lastUpdated },
+            ...values('callsByCapability', snapshot.callsByCapability),
+            ...values('callsByTool', snapshot.callsByTool),
+            failures: { value: snapshot.failures, last_updated: lastUpdated },
+            denials: { value: snapshot.denials, last_updated: lastUpdated },
+            timeouts: { value: snapshot.timeouts, last_updated: lastUpdated },
+        });
+    }
+};
+exports.McpStatsProvider = McpStatsProvider;
+exports.McpStatsProvider = McpStatsProvider = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [mcp_audit_service_1.McpAuditService])
+], McpStatsProvider);
+//# sourceMappingURL=mcp-stats.provider.js.map

package/dist/modules/mcp/providers/mcp-stats.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-stats.provider.js","sourceRoot":"","sources":["../../../../src/modules/mcp/providers/mcp-stats.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAG5C,qEAAgE;AAgBzD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC5B,YAA6B,YAA6B;QAA7B,iBAAY,GAAZ,YAAY,CAAiB;IAAG,CAAC;IAE9D,QAAQ;QACP,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,OAA+B,EAA6B,EAAE,CAC7F,MAAM,CAAC,WAAW,CACjB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CACzG,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,CAAC;YACtB,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,mBAAmB,EAAE,YAAY,EAAE,WAAW,EAAE;YACvF,GAAG,MAAM,CAAC,mBAAmB,EAAE,QAAQ,CAAC,iBAAiB,CAAC;YAC1D,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;YAC9C,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE;YACjE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE;YAC/D,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE;SACjE,CAAC,CAAC;IACJ,CAAC;CACD,CAAA;AApBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAE+B,mCAAe;GAD9C,gBAAgB,CAoB5B"}

package/dist/modules/mcp/services/mcp-audit.service.d.ts

@@ -0,0 +1,74 @@
+import { McpCapability } from '../mcp.constants';
+export declare enum McpAuditOutcome {
+    COMPLETED = "completed",
+    PARTIAL = "partial",
+    FAILED = "failed",
+    TIMED_OUT = "timed_out",
+    DENIED = "denied"
+}
+export type McpAuditDenialReason = 'authentication_required' | 'invalid_credential' | 'authentication_error' | 'endpoint_disabled' | 'origin_denied' | 'policy_changed' | 'capability_denied' | 'request_denied';
+export type McpAuditRequestFailureReason = 'policy_resolution_error';
+export type McpOAuthManagementArtifact = 'access_token' | 'client' | 'grant' | 'refresh_family';
+export type McpOAuthManagementAction = 'disabled' | 'revoked' | 'scopes_updated';
+export type McpOAuthInvalidationReason = 'approver_authority_changed' | 'module_disabled' | 'module_enabled_reconciliation' | 'module_policy_changed' | 'oauth_disabled' | 'oauth_enabled_reconciliation' | 'public_identity_changed';
+export type McpOAuthAuthorizationProfile = 'all' | 'oauth';
+export type McpSubscriptionCloseReason = 'authorization_expired' | 'authorization_revoked' | 'cancelled' | 'client_closed' | 'completed' | 'error' | 'idle' | 'shutdown';
+export interface McpAuditMetricsSnapshot {
+    activeSubscriptions: number;
+    callsByCapability: Record<McpCapability, number>;
+    callsByTool: Record<string, number>;
+    failures: number;
+    denials: number;
+    timeouts: number;
+}
+interface RequestIdentity {
+    requestId: string;
+    clientId?: string;
+}
+interface ToolResult extends RequestIdentity {
+    tool: string;
+    capability: McpCapability;
+    durationMs: number;
+    outcome: McpAuditOutcome;
+    arguments?: Record<string, unknown>;
+}
+export declare class McpAuditService {
+    private readonly logger;
+    private readonly requestIdHmacKey;
+    private activeSubscriptions;
+    private readonly callsByCapability;
+    private readonly callsByTool;
+    private failures;
+    private denials;
+    private timeouts;
+    recordAuthenticationFailure(identity: RequestIdentity, reason: McpAuditDenialReason): void;
+    recordPolicyDenial(identity: RequestIdentity, reason: McpAuditDenialReason, options?: {
+        capability?: McpCapability;
+        tool?: string;
+    }): void;
+    recordRequestFailure(identity: RequestIdentity, reason: McpAuditRequestFailureReason): void;
+    recordProtocolRequest(identity: RequestIdentity, options: {
+        kind: 'discovery' | 'initialization';
+        method: string;
+        protocolVersion?: string;
+    }): void;
+    recordSubscriptionOpened(identity: RequestIdentity, subscriptionId: string): void;
+    recordSubscriptionClosed(identity: RequestIdentity, subscriptionId: string, reason: McpSubscriptionCloseReason): void;
+    recordOAuthManagementAction(actorId: string, artifact: McpOAuthManagementArtifact, artifactId: string, action: McpOAuthManagementAction): void;
+    recordOAuthGlobalRevocation(actorId: string): void;
+    recordOAuthAuthorizationInvalidation(input: {
+        reasons: McpOAuthInvalidationReason[];
+        authorizationProfile: McpOAuthAuthorizationProfile;
+        outcome: McpAuditOutcome.COMPLETED | McpAuditOutcome.PARTIAL;
+        target?: {
+            type: 'approver';
+            id: string;
+        };
+    }): void;
+    recordToolResult(result: ToolResult): void;
+    getMetricsSnapshot(): McpAuditMetricsSnapshot;
+    getRequestId(body: unknown): string;
+    private getTargetIds;
+    private log;
+}
+export {};