@fragno-dev/mcp-fragment 0.0.0-stage → 0.0.3

package/dist/node/definition.d.ts

@@ -0,0 +1,260 @@
+import { McpFragmentConfig as McpFragmentConfig$1 } from "./mcp-types.js";
+import { AuthPersistenceChanges } from "./services.js";
+import { HookContext, HookFn } from "@fragno-dev/db";
+//#region src/definition.d.ts
+export interface McpServerConfigurationChangedPayload {
+  serverId: string;
+  current: {
+    tools: unknown[];
+  };
+}
+export interface McpServerConfigurationDeletedPayload {
+  serverId: string;
+}
+export interface McpServerReadinessChangedPayload {
+  serverId: string;
+  /** Whether stored auth can authorize operations; the server can still reject it. */
+  ready: boolean;
+}
+/**
+ * A readiness change as delivered. The server is read at delivery rather than stored with the hook,
+ * so it is the current configuration, or null after it was deleted.
+ */
+export interface McpServerReadinessChange extends McpServerReadinessChangedPayload {
+  server: {
+    name: string | null;
+    authMode: string;
+  } | null;
+}
+export interface McpFragmentHooksConfig {
+  onServerConfigurationChanged?: (payload: McpServerConfigurationChangedPayload, context: HookContext) => Promise<void> | void;
+  onServerConfigurationDeleted?: (payload: McpServerConfigurationDeletedPayload, context: HookContext) => Promise<void> | void;
+  /**
+   * Fires when a write changes whether the server can authorize operations, including creation
+   * and credentials the server invalidates during an operation, and when an access token without a
+   * refresh token expires.
+   */
+  onServerReadinessChanged?: (payload: McpServerReadinessChange, context: HookContext) => Promise<void> | void;
+}
+export type McpFragmentConfig = McpFragmentConfig$1 & McpFragmentHooksConfig;
+export interface McpInternalRefreshServerConfigurationPayload {
+  serverId: string;
+}
+/** The token stored when expiry was scheduled; a later write replaces it and reports itself. */
+interface McpInternalAuthExpiredPayload {
+  serverId: string;
+  expiresAt: string;
+}
+export type McpHooksMap = {
+  internalRefreshServerConfiguration: HookFn<McpInternalRefreshServerConfigurationPayload>;
+  internalAuthExpired: HookFn<McpInternalAuthExpiredPayload>;
+  onServerConfigurationChanged: HookFn<McpServerConfigurationChangedPayload>;
+  onServerConfigurationDeleted: HookFn<McpServerConfigurationDeletedPayload>;
+  onServerReadinessChanged: HookFn<McpServerReadinessChangedPayload>;
+};
+/** Expiry changes readiness without a write, so a write that starts the countdown schedules it. */
+export declare function scheduleMcpAuthExpiry(uow: {
+  triggerHook(name: "internalAuthExpired", payload: McpInternalAuthExpiredPayload, options: {
+    processAt: Date;
+  }): void;
+}, serverId: string, authMode: string, after: {
+  payload: string;
+  expiresAt: Date | null;
+}): void;
+export declare const mcpFragmentDefinition: import("@fragno-dev/core").FragmentDefinition<McpFragmentConfig, import("@fragno-dev/db").FragnoPublicConfigWithDatabase, import("@fragno-dev/db").ImplicitDatabaseDependencies<import("@fragno-dev/db/schema").Schema<{
+  server_configuration: import("@fragno-dev/db/schema").Table<Record<"id", import("@fragno-dev/db/schema").IdColumn<"varchar(128)", string | import("@fragno-dev/db/schema").FragnoId | null, import("@fragno-dev/db/schema").FragnoId>> & Record<"name", import("@fragno-dev/db/schema").Column<"string", string | null, string | null>> & Record<"endpointUrl", import("@fragno-dev/db/schema").Column<"string", string, string>> & Record<"authMode", import("@fragno-dev/db/schema").Column<"string", string, string>> & Record<"createdAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date>> & Record<"updatedAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date>>, {}>;
+  secret: import("@fragno-dev/db/schema").Table<Record<"id", import("@fragno-dev/db/schema").IdColumn<"varchar(128)", string | import("@fragno-dev/db/schema").FragnoId | null, import("@fragno-dev/db/schema").FragnoId>> & Record<"serverId", import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>> & Record<"kind", import("@fragno-dev/db/schema").Column<"string", string, string>> & Record<"payload", import("@fragno-dev/db/schema").Column<"text", string, string>> & Record<"expiresAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date | null>> & Record<"updatedAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date>>, Record<"idx_secret_server_kind", import("@fragno-dev/db/schema").Index<readonly [import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>, import("@fragno-dev/db/schema").Column<"string", string, string>] & import("@fragno-dev/db/schema").AnyColumn[], readonly ["serverId", "kind"]>>>;
+  oauthState: import("@fragno-dev/db/schema").Table<Record<"id", import("@fragno-dev/db/schema").IdColumn<"varchar(128)", string | import("@fragno-dev/db/schema").FragnoId | null, import("@fragno-dev/db/schema").FragnoId>> & Record<"serverId", import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>> & Record<"codeVerifier", import("@fragno-dev/db/schema").Column<"text", string, string>> & Record<"redirectUri", import("@fragno-dev/db/schema").Column<"string", string, string>> & Record<"scope", import("@fragno-dev/db/schema").Column<"string", string | null, string | null>> & Record<"expiresAt", import("@fragno-dev/db/schema").Column<"timestamp", Date | import("@fragno-dev/db").DbNow, Date>> & Record<"consumedAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date | null>> & Record<"authorizationUrl", import("@fragno-dev/db/schema").Column<"text", string | null, string | null>>, Record<"idx_oauth_state_server", import("@fragno-dev/db/schema").Index<readonly [import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>] & import("@fragno-dev/db/schema").AnyColumn[], readonly ["serverId"]>> & Record<"idx_oauth_state_pending", import("@fragno-dev/db/schema").Index<readonly [import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>, import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date | null>, import("@fragno-dev/db/schema").Column<"timestamp", Date | import("@fragno-dev/db").DbNow, Date>] & import("@fragno-dev/db/schema").AnyColumn[], readonly ["serverId", "consumedAt", "expiresAt"]>>>;
+  server_connection_cache: import("@fragno-dev/db/schema").Table<Record<"id", import("@fragno-dev/db/schema").IdColumn<"varchar(128)", string | import("@fragno-dev/db/schema").FragnoId | null, import("@fragno-dev/db/schema").FragnoId>> & Record<"serverId", import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>> & Record<"protocolVersion", import("@fragno-dev/db/schema").Column<"string", string | null, string | null>> & Record<"serverInfo", import("@fragno-dev/db/schema").Column<"json", unknown, unknown>> & Record<"capabilities", import("@fragno-dev/db/schema").Column<"json", unknown, unknown>> & Record<"tools", import("@fragno-dev/db/schema").Column<"json", unknown, unknown>> & Record<"updatedAt", import("@fragno-dev/db/schema").Column<"timestamp", (Date | import("@fragno-dev/db").DbNow) | null, Date>>, Record<"idx_server_connection_cache_server", import("@fragno-dev/db/schema").Index<readonly [import("@fragno-dev/db/schema").Column<"bigint", string | bigint | import("@fragno-dev/db/schema").FragnoId | import("@fragno-dev/db/schema").FragnoReference, import("@fragno-dev/db/schema").FragnoReference>] & import("@fragno-dev/db/schema").AnyColumn[], readonly ["serverId"]>>>;
+}>>, {
+  startOAuth: (input: {
+    serverId: string;
+    stateId: string;
+    redirectUri: string;
+    scope?: string;
+    clientId?: string;
+    clientSecret?: string;
+    discardTokens: boolean;
+  }) => import("@fragno-dev/db").TxResult<{
+    found: true;
+    authorizationUrl: string;
+  } | {
+    found: false;
+    authorizationUrl?: undefined;
+  }, {
+    found: false;
+    authorizationUrl?: undefined;
+    serverId?: undefined;
+    authMode?: undefined;
+    secrets?: undefined;
+    changes?: undefined;
+  } | {
+    found: true;
+    authorizationUrl: string;
+    serverId: string;
+    authMode: string;
+    secrets: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      kind: string;
+      payload: string;
+      expiresAt: Date | null;
+      updatedAt: Date;
+    }[];
+    changes: {
+      clientChange: {
+        action: "keep";
+      } | {
+        action: "save";
+        payload: string;
+      } | {
+        action: "remove";
+      };
+      discoveryChange: {
+        action: "keep";
+      } | {
+        action: "save";
+        payload: string;
+      } | {
+        action: "remove";
+      };
+      authorizationUrl?: URL;
+      clientInformation?: import("@modelcontextprotocol/server").OAuthClientInformationMixed;
+      tokens?: import("@modelcontextprotocol/server").OAuthTokens;
+      discoveryState?: import("@modelcontextprotocol/client").OAuthDiscoveryState;
+      oauthState?: {
+        id: string;
+        codeVerifier: string;
+        redirectUri: string;
+        scope?: string;
+        expiresAt: Date;
+      };
+      consumeStateId?: string;
+      tokensInvalidated?: boolean;
+      clientInvalidated?: boolean;
+      discoveryInvalidated?: boolean;
+    };
+  }>;
+  completeOAuthCallback: (input: {
+    stateId: string;
+    code: string;
+    iss: string | undefined;
+  }) => import("@fragno-dev/db").TxResult<{
+    found: true;
+    reason?: undefined;
+  } | {
+    found: false;
+    reason: "invalid_state" | "server_not_found";
+  }, {
+    found: false;
+    reason: "invalid_state";
+    server?: undefined;
+    secrets?: undefined;
+    cache?: undefined;
+    changes?: undefined;
+  } | {
+    found: false;
+    reason: "server_not_found";
+    server?: undefined;
+    secrets?: undefined;
+    cache?: undefined;
+    changes?: undefined;
+  } | {
+    found: true;
+    server: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      name: string | null;
+      endpointUrl: string;
+      authMode: string;
+      createdAt: Date;
+      updatedAt: Date;
+    };
+    secrets: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      kind: string;
+      payload: string;
+      expiresAt: Date | null;
+      updatedAt: Date;
+    }[];
+    cache: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      protocolVersion: string | null;
+      serverInfo: unknown;
+      capabilities: unknown;
+      tools: unknown;
+      updatedAt: Date;
+    } | null;
+    changes: AuthPersistenceChanges;
+    reason?: undefined;
+  }>;
+  prepareMcpOperation: (input: {
+    serverId: string;
+  }) => import("@fragno-dev/db").TxResult<{
+    found: true;
+    endpointUrl: string;
+    token: string | undefined;
+    secrets: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      kind: string;
+      payload: string;
+      expiresAt: Date | null;
+      updatedAt: Date;
+    }[];
+    cache: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      protocolVersion: string | null;
+      serverInfo: unknown;
+      capabilities: unknown;
+      tools: unknown;
+      updatedAt: Date;
+    } | null;
+    authChanges: AuthPersistenceChanges | undefined;
+    serverId: string;
+  } | {
+    found: false;
+    endpointUrl?: undefined;
+    token?: undefined;
+    secrets?: undefined;
+    cache?: undefined;
+    authChanges?: undefined;
+    serverId?: undefined;
+  }, {
+    found: false;
+    serverId?: undefined;
+    endpointUrl?: undefined;
+    token?: undefined;
+    secrets?: undefined;
+    cache?: undefined;
+    authChanges?: undefined;
+  } | {
+    found: true;
+    serverId: string;
+    endpointUrl: string;
+    token: string | undefined;
+    secrets: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      kind: string;
+      payload: string;
+      expiresAt: Date | null;
+      updatedAt: Date;
+    }[];
+    cache: {
+      id: import("@fragno-dev/db/schema").FragnoId;
+      serverId: import("@fragno-dev/db/schema").FragnoReference;
+      protocolVersion: string | null;
+      serverInfo: unknown;
+      capabilities: unknown;
+      tools: unknown;
+      updatedAt: Date;
+    } | null;
+    authChanges: AuthPersistenceChanges | undefined;
+  }>;
+}, {}, {}, {}, import("@fragno-dev/db").DatabaseServiceContext<McpHooksMap>, import("@fragno-dev/db").DatabaseRequestContext<McpHooksMap>, import("@fragno-dev/db/fragment-definition-builder").DatabaseRequestStorage, []>;
+//#endregion
+export {};
+//# sourceMappingURL=definition.d.ts.map

package/dist/node/definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition.d.ts","names":["BaseMcpFragmentConfig"],"sources":["../../src/definition.ts"],"mappings":";;;;iBAmBiB;EACf;EACA;IACE;;;iBAIa;EACf;;iBAGe;EACf;;EAEA;;;;;;iBAOe,iCAAiC;EAChD;IAAU;IAAqB;;;iBAGhB;EACf,gCACE,SAAS,sCACT,SAAS,gBACN;EACL,gCACE,SAAS,sCACT,SAAS,gBACN;;;;;;EAML,4BACE,SAAS,0BACT,SAAS,gBACN;;YAGK,oBAAoBA,sBAAwB;iBAEvC;EACf;;;UAIQ;EACR;EACA;;YAGU;EACV,oCAAoC,OAAO;EAC3C,qBAAqB,OAAO;EAC5B,8BAA8B,OAAO;EACrC,8BAA8B,OAAO;EACrC,0BAA0B,OAAO;;;wBAInB,sBAEd;EACE,YACE,6BACA,SAAS,+BACT;IAAW,WAAW;;GAG1B,kBACA,kBACA;EAAS;EAAiB,WAAW;;qBAY1B,kDAAqB,mBAAA,4CAAA,yDAAA,6DAAA;;;;;;EAoLC,aAAA;IAC3B;IACA;IACA;IACA;IACA;IACA;IACA;iCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAnQsB;;;;;;;;;EA+WiB,wBAAA;IACtC;IACA;IACA;iCACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwGqC,sBAAA;IAAE;iCAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCA8CtD,uBAAA,uCAAA,uBAAA,mEAAA"}

package/dist/node/definition.js

@@ -0,0 +1,330 @@
+import { listMcpTools } from "./mcp-api.js";
+import { mcpSchema } from "./schema.js";
+import { createMcpOperationAuth, createOAuthCallbackSnapshot, createOAuthStartSnapshot, isMcpAuthReady, mcpAuthReadyUntil, resolveMcpOperationAuth, resolveOAuthStartClient, withoutOAuthConsent, writeOAuthSecretChanges } from "./services.js";
+import { defineFragment } from "@fragno-dev/core";
+import { withDatabase } from "@fragno-dev/db";
+//#region src/definition.ts
+/** Expiry changes readiness without a write, so a write that starts the countdown schedules it. */
+function scheduleMcpAuthExpiry(uow, serverId, authMode, after) {
+	const readyUntil = mcpAuthReadyUntil(authMode, after);
+	if (readyUntil && after.expiresAt && isMcpAuthReady(authMode, after)) uow.triggerHook("internalAuthExpired", {
+		serverId,
+		expiresAt: after.expiresAt.toISOString()
+	}, { processAt: readyUntil });
+}
+const mcpFragmentDefinition = defineFragment("mcp-fragment").extend(withDatabase(mcpSchema)).provideHooks(({ defineHook, config }) => ({
+	internalRefreshServerConfiguration: defineHook(async function({ serverId }) {
+		let prepared;
+		const result = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId)))).afterRetrieve(async (_uow, [server, secrets]) => {
+			if (!server) return;
+			const auth = await createMcpOperationAuth({
+				config,
+				server,
+				secrets
+			});
+			const toolsOperation = await listMcpTools({
+				endpointUrl: server.endpointUrl,
+				auth,
+				fetchImplementation: config.fetch
+			});
+			prepared = {
+				authChanges: toolsOperation.authChanges,
+				toolsOperation
+			};
+		}).mutate(({ forSchema, retrieveResult: [server, secrets, cache] }) => {
+			if (!server) return { action: "missing" };
+			if (!prepared) throw new Error("MCP refresh operation was not prepared");
+			const preparedOperation = prepared;
+			const uow = forSchema(mcpSchema);
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${serverId}:${kind}`,
+					serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			if (preparedOperation.authChanges) writeOAuthSecretChanges(preparedOperation.authChanges, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			if (preparedOperation.authChanges?.authPayload) {
+				const after = {
+					payload: preparedOperation.authChanges.authPayload,
+					expiresAt: preparedOperation.authChanges.authExpiresAt ?? null
+				};
+				upsertSecret("auth", after.payload, after.expiresAt);
+				const before = secrets.find((secret) => secret.kind === "auth");
+				const ready = isMcpAuthReady(server.authMode, after);
+				if (ready !== isMcpAuthReady(server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+					serverId,
+					ready
+				});
+				scheduleMcpAuthExpiry(uow, serverId, server.authMode, after);
+			}
+			if (!preparedOperation.toolsOperation.ok) return {
+				action: "error",
+				error: preparedOperation.toolsOperation.error instanceof Error ? preparedOperation.toolsOperation.error.message : String(preparedOperation.toolsOperation.error)
+			};
+			const tools = Array.isArray(preparedOperation.toolsOperation.result.tools) ? preparedOperation.toolsOperation.result.tools : [];
+			const previousTools = Array.isArray(cache?.tools) ? cache.tools : null;
+			if (!previousTools || JSON.stringify(previousTools) !== JSON.stringify(tools)) uow.triggerHook("onServerConfigurationChanged", {
+				serverId,
+				current: { tools }
+			});
+			uow.delete("server_connection_cache", serverId);
+			uow.create("server_connection_cache", {
+				id: serverId,
+				serverId,
+				protocolVersion: preparedOperation.toolsOperation.metadata.protocolVersion ?? null,
+				serverInfo: preparedOperation.toolsOperation.metadata.serverInfo ?? null,
+				capabilities: preparedOperation.toolsOperation.metadata.capabilities ?? null,
+				tools
+			});
+			return { action: "refreshed" };
+		}).execute();
+		if (result.action === "error") throw new Error(result.error);
+	}),
+	onServerConfigurationChanged: defineHook(async function(payload) {
+		await config.onServerConfigurationChanged?.(payload, this);
+	}),
+	onServerConfigurationDeleted: defineHook(async function(payload) {
+		await config.onServerConfigurationDeleted?.(payload, this);
+	}),
+	onServerReadinessChanged: defineHook(async function(payload) {
+		const server = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", payload.serverId)))).transformRetrieve(([server]) => server && {
+			name: server.name,
+			authMode: server.authMode
+		}).execute();
+		await config.onServerReadinessChanged?.({
+			...payload,
+			server
+		}, this);
+	}),
+	internalAuthExpired: defineHook(async function({ serverId, expiresAt }) {
+		const expired = await this.handlerTx().retrieve(({ forSchema }) => forSchema(mcpSchema).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).findFirst("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb.and(eb("serverId", "=", serverId), eb("kind", "=", "auth"))))).transformRetrieve(([server, secret]) => server !== null && secret !== null && secret.expiresAt?.getTime() === Date.parse(expiresAt) && mcpAuthReadyUntil(server.authMode, secret) !== null ? {
+			name: server.name,
+			authMode: server.authMode
+		} : null).execute();
+		if (expired) await config.onServerReadinessChanged?.({
+			serverId,
+			ready: false,
+			server: expired
+		}, this);
+	})
+})).providesBaseService(({ defineService, config }) => defineService({
+	startOAuth: function(input) {
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", input.serverId)))).transformRetrieve(async ([server, secrets]) => {
+			if (!server) return { found: false };
+			const { authorizationUrl, changes } = await createOAuthStartSnapshot({
+				config,
+				server,
+				secrets,
+				stateId: input.stateId,
+				redirectUri: input.redirectUri,
+				...resolveOAuthStartClient(secrets, input)
+			});
+			return {
+				found: true,
+				authorizationUrl: authorizationUrl.toString(),
+				serverId: server.id.toString(),
+				authMode: server.authMode,
+				secrets,
+				changes
+			};
+		}).mutate(({ uow, retrieveResult }) => {
+			if (!retrieveResult.found) return { found: false };
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${retrieveResult.serverId}:${kind}`,
+					serverId: retrieveResult.serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			writeOAuthSecretChanges(retrieveResult.changes, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			const authSecret = retrieveResult.secrets.find((secret) => secret.kind === "auth");
+			if (input.discardTokens && authSecret) {
+				const payload = withoutOAuthConsent(authSecret.payload);
+				uow.update("secret", authSecret.id, (b) => b.set({
+					payload,
+					expiresAt: null,
+					updatedAt: b.now()
+				}).check());
+				const { authMode } = retrieveResult;
+				const ready = isMcpAuthReady(authMode, {
+					payload,
+					expiresAt: null
+				});
+				if (ready !== isMcpAuthReady(authMode, authSecret)) uow.triggerHook("onServerReadinessChanged", {
+					serverId: retrieveResult.serverId,
+					ready
+				});
+			}
+			if (retrieveResult.changes.oauthState) uow.create("oauthState", {
+				id: retrieveResult.changes.oauthState.id,
+				serverId: retrieveResult.serverId,
+				authorizationUrl: retrieveResult.authorizationUrl,
+				codeVerifier: retrieveResult.changes.oauthState.codeVerifier,
+				redirectUri: retrieveResult.changes.oauthState.redirectUri,
+				scope: retrieveResult.changes.oauthState.scope ?? null,
+				expiresAt: retrieveResult.changes.oauthState.expiresAt,
+				consumedAt: null
+			});
+			return { found: true };
+		}).transform(({ retrieveResult }) => retrieveResult.found ? {
+			found: true,
+			authorizationUrl: retrieveResult.authorizationUrl
+		} : { found: false }).build();
+	},
+	completeOAuthCallback: function(input) {
+		const serverId = input.stateId.split(":")[0] ?? "";
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("oauthState", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.stateId))).findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", serverId)))).transformRetrieve(async ([state, server, secrets, cache]) => {
+			if (!state || state.consumedAt || new Date(state.expiresAt).getTime() < Date.now()) return {
+				found: false,
+				reason: "invalid_state"
+			};
+			if (!server) return {
+				found: false,
+				reason: "server_not_found"
+			};
+			return {
+				found: true,
+				server,
+				secrets,
+				cache,
+				changes: await createOAuthCallbackSnapshot({
+					config,
+					stateId: input.stateId,
+					code: input.code,
+					iss: input.iss,
+					state,
+					server,
+					secrets
+				})
+			};
+		}).mutate(({ uow, retrieveResult }) => {
+			if (!retrieveResult.found) return {
+				found: false,
+				reason: retrieveResult.reason
+			};
+			const serverId = retrieveResult.server.id.toString();
+			const upsertSecret = (kind, payload, expiresAt) => {
+				const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+				if (existing) {
+					uow.update("secret", existing.id, (b) => b.set({
+						payload,
+						expiresAt,
+						updatedAt: b.now()
+					}).check());
+					return;
+				}
+				uow.create("secret", {
+					id: `${serverId}:${kind}`,
+					serverId,
+					kind,
+					payload,
+					expiresAt
+				});
+			};
+			writeOAuthSecretChanges(retrieveResult.changes, {
+				upsert: (kind, payload) => {
+					upsertSecret(kind, payload, null);
+				},
+				remove: (kind) => {
+					const existing = retrieveResult.secrets.find((secret) => secret.kind === kind);
+					if (existing) uow.delete("secret", existing.id);
+				}
+			});
+			if (retrieveResult.changes.authPayload) {
+				const after = {
+					payload: retrieveResult.changes.authPayload,
+					expiresAt: retrieveResult.changes.authExpiresAt ?? null
+				};
+				upsertSecret("auth", after.payload, after.expiresAt);
+				uow.update("server_configuration", retrieveResult.server.id, (b) => b.set({
+					authMode: "oauth",
+					updatedAt: b.now()
+				}).check());
+				const before = retrieveResult.secrets.find((secret) => secret.kind === "auth");
+				const ready = isMcpAuthReady("oauth", after);
+				if (ready !== isMcpAuthReady(retrieveResult.server.authMode, before)) uow.triggerHook("onServerReadinessChanged", {
+					serverId,
+					ready
+				});
+				scheduleMcpAuthExpiry(uow, serverId, "oauth", after);
+				if (retrieveResult.cache) uow.delete("server_connection_cache", retrieveResult.cache.id);
+				uow.triggerHook("internalRefreshServerConfiguration", { serverId });
+			}
+			if (retrieveResult.changes.consumeStateId) uow.update("oauthState", input.stateId, (b) => b.set({ consumedAt: b.now() }));
+			return { found: true };
+		}).transform(({ retrieveResult }) => retrieveResult.found ? { found: true } : {
+			found: false,
+			reason: retrieveResult.reason
+		}).build();
+	},
+	prepareMcpOperation: function(input) {
+		return this.serviceTx(mcpSchema).retrieve((uow) => uow.findFirst("server_configuration", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId))).find("secret", (b) => b.whereIndex("idx_secret_server_kind", (eb) => eb("serverId", "=", input.serverId))).findFirst("server_connection_cache", (b) => b.whereIndex("primary", (eb) => eb("id", "=", input.serverId)))).transformRetrieve(async ([server, secrets, cache]) => {
+			if (!server) return { found: false };
+			const resolved = await resolveMcpOperationAuth({
+				config,
+				server,
+				secrets
+			});
+			return {
+				found: true,
+				serverId: server.id.toString(),
+				endpointUrl: server.endpointUrl,
+				token: resolved.token,
+				secrets,
+				cache,
+				authChanges: resolved.authChanges
+			};
+		}).transform(({ retrieveResult }) => retrieveResult.found ? {
+			found: true,
+			endpointUrl: retrieveResult.endpointUrl,
+			token: retrieveResult.token,
+			secrets: retrieveResult.secrets,
+			cache: retrieveResult.cache,
+			authChanges: retrieveResult.authChanges,
+			serverId: retrieveResult.serverId
+		} : { found: false }).build();
+	}
+})).build();
+//#endregion
+export { mcpFragmentDefinition, scheduleMcpAuthExpiry };
+
+//# sourceMappingURL=definition.js.map