@itm-platform/mcp-server 1.0.0

package/dist/server.js

@@ -0,0 +1,243 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createServer } from 'node:http';
+import { randomUUID } from 'node:crypto';
+import { createLogger } from './logger.js';
+import { resolveIdentity } from './auth/api-key-auth.js';
+import { createClients } from './clients/index.js';
+import { registerProjectTools } from './tools/projects.js';
+import { registerServiceTools } from './tools/services.js';
+import { registerTaskTools } from './tools/tasks.js';
+import { registerFinancialTools } from './tools/financials.js';
+import { registerRisksIssuesTools } from './tools/risks-issues.js';
+import { registerPortfolioTools } from './tools/portfolio.js';
+import { registerDataMartTool } from './tools/datamart.js';
+import { registerUserTools } from './tools/users.js';
+import { registerReferenceDataTools } from './tools/reference-data.js';
+import { registerWriteTools } from './tools/write-tools.js';
+import { registerSchemaResources } from './resources/schemas.js';
+import { registerCalendarResources } from './resources/calendars.js';
+import { registerProjectStatusPrompt } from './prompts/project-status.js';
+import { registerPortfolioOverviewPrompt } from './prompts/portfolio-overview.js';
+import { registerTeamWorkloadPrompt } from './prompts/team-workload.js';
+import { registerRiskAnalysisPrompt } from './prompts/risk-analysis.js';
+import { buildProtectedResourceMetadata, buildResourceMetadataUrl } from './auth/oauth-metadata.js';
+import { resolveRoute } from './gateway.js';
+import { extractBearerToken } from './auth/token-extraction.js';
+import { exchangeToken, buildEffectiveUserContextFromExchange } from './auth/oauth-auth.js';
+import { createAuditClient } from './clients/audit-client.js';
+import { hasScope } from './auth/effective-user-context.js';
+import { isAuditEnabled } from './audit-config.js';
+import { instrumentServer } from './instrument-server.js';
+import { resolveStartupMode } from './startup-mode.js';
+const log = createLogger('mcp');
+function createMcpServer(clients, writeCtx, userContext) {
+    const server = new McpServer({ name: 'itm-platform', version: '1.0.0' }, { capabilities: { tools: {}, resources: {}, prompts: {} } });
+    instrumentServer(server, log, writeCtx, clients.audit);
+    registerProjectTools(server, clients);
+    registerServiceTools(server, clients);
+    registerTaskTools(server, clients);
+    registerFinancialTools(server, clients);
+    registerRisksIssuesTools(server, clients);
+    registerPortfolioTools(server, clients);
+    registerDataMartTool(server, clients);
+    registerUserTools(server, clients);
+    registerReferenceDataTools(server, clients);
+    if (hasScope(userContext, 'mcp:write')) {
+        registerWriteTools(server, clients, userContext);
+    }
+    registerSchemaResources(server, clients);
+    registerCalendarResources(server, clients);
+    registerProjectStatusPrompt(server);
+    registerPortfolioOverviewPrompt(server);
+    registerTeamWorkloadPrompt(server);
+    registerRiskAnalysisPrompt(server);
+    return server;
+}
+function buildClientsForUser(userContext) {
+    const auditEnabled = isAuditEnabled();
+    const audit = auditEnabled
+        ? createAuditClient({
+            apiUrl: process.env.ITM_API_URL,
+            company: userContext.company,
+            authHeaders: userContext.authHeaders,
+            log,
+        })
+        : undefined;
+    return createClients({
+        apiUrl: process.env.ITM_API_URL,
+        company: userContext.company,
+        authHeaders: userContext.authHeaders,
+        log,
+    }, audit);
+}
+async function main() {
+    log.info('ITM Platform MCP server starting...');
+    const startupMode = resolveStartupMode(process.env, process.argv);
+    if (startupMode.mode === 'stdio') {
+        let userContext;
+        try {
+            userContext = await resolveIdentity();
+            log.info({ userId: userContext.userId, email: userContext.email, access: userContext.dataMartAccess }, 'Identity resolved');
+        }
+        catch (err) {
+            log.fatal({ err }, 'Failed to resolve identity');
+            process.exit(1);
+        }
+        const clients = buildClientsForUser(userContext);
+        const writeCtx = {
+            userId: userContext.userId,
+            accountId: userContext.accountId,
+            aiClientId: 'stdio',
+        };
+        const server = createMcpServer(clients, writeCtx, userContext);
+        const transport = new StdioServerTransport();
+        await server.connect(transport);
+        log.info({ transport: 'stdio' }, 'MCP server connected via stdio');
+        return;
+    }
+    // HTTP modes: http-dev or http-oauth
+    const { port } = startupMode;
+    let fallbackContext;
+    let fallbackClients;
+    if (startupMode.mode === 'http-dev') {
+        log.warn('HTTP mode without OAuth -- all sessions use startup identity (dev only)');
+        try {
+            fallbackContext = await resolveIdentity();
+            fallbackClients = buildClientsForUser(fallbackContext);
+            log.info({ userId: fallbackContext.userId, email: fallbackContext.email, access: fallbackContext.dataMartAccess }, 'Identity resolved');
+        }
+        catch (err) {
+            log.fatal({ err }, 'Failed to resolve identity');
+            process.exit(1);
+        }
+    }
+    const oauthConfig = startupMode.mode === 'http-oauth' ? startupMode.oauthConfig : undefined;
+    const sessions = new Map();
+    if (oauthConfig) {
+        log.info('OAuth configured -- per-session auth enabled');
+    }
+    const httpServer = createServer(async (req, res) => {
+        try {
+            const route = resolveRoute(req.url ?? '/');
+            if (req.method === 'GET' && route === '/.well-known/oauth-protected-resource') {
+                if (!oauthConfig) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'OAuth not configured' }));
+                    return;
+                }
+                const metadata = buildProtectedResourceMetadata({
+                    mcpServerUrl: process.env.MCP_SERVER_URL,
+                    authorizationServerUrl: process.env.ITM_AUTH_PUBLIC_URL || process.env.ITM_AUTH_URL,
+                });
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(metadata));
+                return;
+            }
+            if (req.method === 'POST' && route === '/') {
+                const body = await new Promise((resolve) => {
+                    let data = '';
+                    req.on('data', (chunk) => { data += chunk.toString(); });
+                    req.on('end', () => resolve(data));
+                });
+                const parsed = JSON.parse(body);
+                const sessionId = req.headers['mcp-session-id'];
+                let transport;
+                if (sessionId && sessions.has(sessionId)) {
+                    transport = sessions.get(sessionId).transport;
+                }
+                else if (!sessionId && parsed.method === 'initialize') {
+                    let sessionUserContext;
+                    let sessionClients;
+                    const aiClientId = parsed.params?.clientInfo?.name ?? 'unknown';
+                    if (oauthConfig) {
+                        const oauthToken = extractBearerToken(req.headers);
+                        if (!oauthToken) {
+                            const resourceMetadataUrl = buildResourceMetadataUrl(process.env.MCP_SERVER_URL);
+                            res.writeHead(401, {
+                                'Content-Type': 'application/json',
+                                'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl}"`,
+                            });
+                            res.end(JSON.stringify({ error: 'Authentication required' }));
+                            return;
+                        }
+                        try {
+                            const exchangeResult = await exchangeToken(oauthToken, oauthConfig, log);
+                            sessionUserContext = buildEffectiveUserContextFromExchange(exchangeResult);
+                            sessionClients = buildClientsForUser(sessionUserContext);
+                            log.info({ userId: sessionUserContext.userId, email: sessionUserContext.email }, 'Per-session auth resolved');
+                        }
+                        catch (err) {
+                            log.error({ err }, 'OAuth token exchange failed');
+                            const resourceMetadataUrl = buildResourceMetadataUrl(process.env.MCP_SERVER_URL);
+                            res.writeHead(401, {
+                                'Content-Type': 'application/json',
+                                'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl}"`,
+                            });
+                            res.end(JSON.stringify({ error: 'Authentication failed' }));
+                            return;
+                        }
+                    }
+                    else {
+                        sessionUserContext = fallbackContext;
+                        sessionClients = fallbackClients;
+                    }
+                    const writeCtx = {
+                        userId: sessionUserContext.userId,
+                        accountId: sessionUserContext.accountId,
+                        aiClientId,
+                    };
+                    const server = createMcpServer(sessionClients, writeCtx, sessionUserContext);
+                    transport = new StreamableHTTPServerTransport({
+                        sessionIdGenerator: () => randomUUID(),
+                        enableJsonResponse: true,
+                    });
+                    transport.onclose = () => {
+                        if (transport.sessionId)
+                            sessions.delete(transport.sessionId);
+                    };
+                    await server.connect(transport);
+                    await transport.handleRequest(req, res, parsed);
+                    if (transport.sessionId) {
+                        sessions.set(transport.sessionId, { server, transport });
+                        log.debug({ sessionId: transport.sessionId, aiClientId }, 'Session created');
+                    }
+                    return;
+                }
+                else {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Missing or invalid session' }));
+                    return;
+                }
+                await transport.handleRequest(req, res, parsed);
+            }
+            else if (req.method === 'GET' && route === '/health') {
+                const health = { status: 'ok' };
+                if (fallbackContext)
+                    health.user = fallbackContext.email;
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(health));
+            }
+            else {
+                res.writeHead(404);
+                res.end();
+            }
+        }
+        catch (err) {
+            log.error({ err }, 'HTTP request error');
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Internal server error' }));
+            }
+        }
+    });
+    httpServer.listen(port, () => {
+        log.info({ port, transport: 'http' }, `MCP server listening on http://localhost:${port}/`);
+    });
+}
+main().catch((err) => {
+    log.fatal({ err }, 'Unhandled error');
+    process.exit(1);
+});
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAgB,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,qCAAqC,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAA6B,MAAM,kCAAkC,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;AAQhC,SAAS,eAAe,CAAC,OAAgB,EAAE,QAA0B,EAAE,WAAiC;IACtG,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAC1C,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC;IAEF,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEvD,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QACvC,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE3C,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACpC,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACxC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnC,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAiC;IAC5D,MAAM,YAAY,GAAG,cAAc,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,YAAY;QACxB,CAAC,CAAC,iBAAiB,CAAC;YAChB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAY;YAChC,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,GAAG;SACJ,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAY;QAChC,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,GAAG;KACJ,EAAE,KAAK,CAAC,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,GAAG,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,WAAiC,CAAC;QACtC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,eAAe,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC9H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAqB;YACjC,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU,EAAE,OAAO;SACpB,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;IAC7B,IAAI,eAAiD,CAAC;IACtD,IAAI,eAAoC,CAAC;IAEzC,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACpF,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,eAAe,EAAE,CAAC;YAC1C,eAAe,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,cAAc,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC1I,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2E,CAAC;IAEpG,IAAI,WAAW,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAE3C,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK,uCAAuC,EAAE,CAAC;gBAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBACD,MAAM,QAAQ,GAAG,8BAA8B,CAAC;oBAC9C,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,cAAe;oBACzC,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,YAAa;iBACrF,CAAC,CAAC;gBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAClC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;oBACjD,IAAI,IAAI,GAAG,EAAE,CAAC;oBACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACjE,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEhC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,IAAI,SAAwC,CAAC;gBAE7C,IAAI,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBACzC,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,SAAS,CAAC;gBACjD,CAAC;qBAAM,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;oBACxD,IAAI,kBAAwC,CAAC;oBAC7C,IAAI,cAAuB,CAAC;oBAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,IAAI,SAAS,CAAC;oBAEhE,IAAI,WAAW,EAAE,CAAC;wBAChB,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAA6C,CAAC,CAAC;wBACzF,IAAI,CAAC,UAAU,EAAE,CAAC;4BAChB,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC,CAAC;4BAClF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gCACjB,cAAc,EAAE,kBAAkB;gCAClC,kBAAkB,EAAE,6BAA6B,mBAAmB,GAAG;6BACxE,CAAC,CAAC;4BACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;4BAC9D,OAAO;wBACT,CAAC;wBACD,IAAI,CAAC;4BACH,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;4BACzE,kBAAkB,GAAG,qCAAqC,CAAC,cAAc,CAAC,CAAC;4BAC3E,cAAc,GAAG,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;4BACzD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;wBAChH,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,6BAA6B,CAAC,CAAC;4BAClD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAe,CAAC,CAAC;4BAClF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gCACjB,cAAc,EAAE,kBAAkB;gCAClC,kBAAkB,EAAE,6BAA6B,mBAAmB,GAAG;6BACxE,CAAC,CAAC;4BACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;4BAC5D,OAAO;wBACT,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,kBAAkB,GAAG,eAAgB,CAAC;wBACtC,cAAc,GAAG,eAAgB,CAAC;oBACpC,CAAC;oBAED,MAAM,QAAQ,GAAqB;wBACjC,MAAM,EAAE,kBAAkB,CAAC,MAAM;wBACjC,SAAS,EAAE,kBAAkB,CAAC,SAAS;wBACvC,UAAU;qBACX,CAAC;oBAEF,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;oBAC7E,SAAS,GAAG,IAAI,6BAA6B,CAAC;wBAC5C,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;wBACtC,kBAAkB,EAAE,IAAI;qBACzB,CAAC,CAAC;oBACH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;wBACvB,IAAI,SAAS,CAAC,SAAS;4BAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAChE,CAAC,CAAC;oBACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;oBAChD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;wBACxB,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;wBACzD,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,iBAAiB,CAAC,CAAC;oBAC/E,CAAC;oBACD,OAAO;gBACT,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC,CAAC;oBACjE,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAClD,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACvD,MAAM,MAAM,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACxD,IAAI,eAAe;oBAAE,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC;gBACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,4CAA4C,IAAI,GAAG,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/auth/api-key-auth.d.ts

@@ -0,0 +1,3 @@
+import { EffectiveUserContext } from './effective-user-context.js';
+export declare function resolveIdentity(): Promise<EffectiveUserContext>;
+//# sourceMappingURL=api-key-auth.d.ts.map

package/dist/src/auth/api-key-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AA0BnE,wBAAsB,eAAe,IAAI,OAAO,CAAC,oBAAoB,CAAC,CA6CrE"}

package/dist/src/auth/api-key-auth.js

@@ -0,0 +1,53 @@
+import { resolveLicenseAccess } from './license-resolver.js';
+function resolveAuthHeaders() {
+    const apiKey = process.env.ITM_API_KEY;
+    const token = process.env.ITM_TOKEN;
+    if (apiKey) {
+        return { source: 'api-key', headers: { 'Authorization': `Bearer ${apiKey}` } };
+    }
+    if (token) {
+        return { source: 'token', headers: { 'Token': token } };
+    }
+    throw new Error('Missing required environment variable: ITM_API_KEY or ITM_TOKEN');
+}
+export async function resolveIdentity() {
+    const apiUrl = process.env.ITM_API_URL;
+    const company = process.env.ITM_COMPANY;
+    if (!apiUrl)
+        throw new Error('Missing required environment variable: ITM_API_URL');
+    if (!company)
+        throw new Error('Missing required environment variable: ITM_COMPANY');
+    const { source, headers: authHeaders } = resolveAuthHeaders();
+    const url = `${apiUrl}/v2/${company}/resolve/identity`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            ...authHeaders,
+            'Content-Type': 'application/json',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Identity resolution failed: ${response.status} ${response.statusText}`);
+    }
+    const identity = await response.json();
+    const { dataMartAccess, pmScopeUserId } = resolveLicenseAccess(identity.licenseTypeIds, identity.userId);
+    if (dataMartAccess === 'pm-scoped') {
+        throw new Error('PM-only access is not yet available for MCP. It will arrive with hosted MCP (Phase 2) or gateway scope injection.');
+    }
+    if (dataMartAccess === 'none') {
+        throw new Error('Team Member access is not available for MCP.');
+    }
+    return {
+        source,
+        company,
+        accountId: identity.accountId,
+        userId: identity.userId,
+        languageId: identity.languageId,
+        email: identity.email,
+        licenseTypeIds: identity.licenseTypeIds,
+        dataMartAccess,
+        pmScopeUserId,
+        authHeaders,
+    };
+}
+//# sourceMappingURL=api-key-auth.js.map

package/dist/src/auth/api-key-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-auth.js","sourceRoot":"","sources":["../../../src/auth/api-key-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAY7D,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;IAEpC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEpF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAE9D,MAAM,GAAG,GAAG,GAAG,MAAM,OAAO,OAAO,mBAAmB,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,GAAG,WAAW;YACd,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,QAAQ,GAAqB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzG,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,cAAc;QACd,aAAa;QACb,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/src/auth/effective-user-context.d.ts

@@ -0,0 +1,16 @@
+export interface EffectiveUserContext {
+    source: 'api-key' | 'token';
+    company: string;
+    accountId: number;
+    userId: number;
+    languageId: number;
+    email: string;
+    licenseTypeIds: number[];
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+    authHeaders: Record<string, string>;
+    grantedScopes?: string[];
+}
+export declare const WRITE_TOOL_NAMES: Set<string>;
+export declare function hasScope(ctx: EffectiveUserContext, scope: string): boolean;
+//# sourceMappingURL=effective-user-context.d.ts.map

package/dist/src/auth/effective-user-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-user-context.d.ts","sourceRoot":"","sources":["../../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,eAAO,MAAM,gBAAgB,aAE3B,CAAC;AAEH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAG1E"}

package/dist/src/auth/effective-user-context.js

@@ -0,0 +1,9 @@
+export const WRITE_TOOL_NAMES = new Set([
+    'create_task', 'update_task', 'create_risk', 'create_issue', 'update_project',
+]);
+export function hasScope(ctx, scope) {
+    if (!ctx.grantedScopes)
+        return true;
+    return ctx.grantedScopes.includes(scope);
+}
+//# sourceMappingURL=effective-user-context.js.map

package/dist/src/auth/effective-user-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-user-context.js","sourceRoot":"","sources":["../../../src/auth/effective-user-context.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB;CAC9E,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,GAAyB,EAAE,KAAa;IAC/D,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}

package/dist/src/auth/license-resolver.d.ts

@@ -0,0 +1,6 @@
+export interface LicenseAccessResult {
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+}
+export declare function resolveLicenseAccess(licenseTypeIds: number[], userId: number): LicenseAccessResult;
+//# sourceMappingURL=license-resolver.d.ts.map

package/dist/src/auth/license-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.d.ts","sourceRoot":"","sources":["../../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,mBAAmB,CAQlG"}

package/dist/src/auth/license-resolver.js

@@ -0,0 +1,12 @@
+const FULL_ACCESS_TYPES = new Set([0, 1]);
+const PM_TYPE = 2;
+export function resolveLicenseAccess(licenseTypeIds, userId) {
+    if (licenseTypeIds.some(id => FULL_ACCESS_TYPES.has(id))) {
+        return { dataMartAccess: 'full' };
+    }
+    if (licenseTypeIds.includes(PM_TYPE)) {
+        return { dataMartAccess: 'pm-scoped', pmScopeUserId: userId };
+    }
+    return { dataMartAccess: 'none' };
+}
+//# sourceMappingURL=license-resolver.js.map

package/dist/src/auth/license-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-resolver.js","sourceRoot":"","sources":["../../../src/auth/license-resolver.ts"],"names":[],"mappings":"AAKA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,UAAU,oBAAoB,CAAC,cAAwB,EAAE,MAAc;IAC3E,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/src/auth/oauth-auth.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from 'pino';
+import type { EffectiveUserContext } from './effective-user-context.js';
+export interface TokenExchangeResult {
+    sessionToken: string;
+    userId: number;
+    accountId: number;
+    company: string;
+    email: string;
+    languageId: number;
+    licenseTypeIds: number[];
+    dataMartAccess: 'full' | 'pm-scoped' | 'none';
+    pmScopeUserId?: number;
+    expiresAt: string;
+    scope: string;
+}
+export interface OAuthConfig {
+    tokenExchangeUrl: string;
+    audience: string;
+}
+export declare function exchangeToken(oauthToken: string, config: OAuthConfig, log?: Logger): Promise<TokenExchangeResult>;
+export declare function buildEffectiveUserContextFromExchange(result: TokenExchangeResult): EffectiveUserContext;
+//# sourceMappingURL=oauth-auth.d.ts.map

package/dist/src/auth/oauth-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC9C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,WAAW,EACnB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED,wBAAgB,qCAAqC,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,CAcvG"}

package/dist/src/auth/oauth-auth.js

@@ -0,0 +1,34 @@
+export async function exchangeToken(oauthToken, config, log) {
+    log?.debug({ url: config.tokenExchangeUrl }, 'Token exchange request');
+    const response = await fetch(config.tokenExchangeUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${oauthToken}`,
+        },
+        body: JSON.stringify({ audience: config.audience }),
+    });
+    if (!response.ok) {
+        log?.error({ status: response.status }, 'Token exchange failed');
+        throw new Error(`Token exchange failed: ${response.status} ${response.statusText}`);
+    }
+    const result = await response.json();
+    log?.info({ userId: result.userId, company: result.company }, 'Token exchange succeeded');
+    return result;
+}
+export function buildEffectiveUserContextFromExchange(result) {
+    return {
+        source: 'token',
+        company: result.company,
+        accountId: result.accountId,
+        userId: result.userId,
+        languageId: result.languageId,
+        email: result.email,
+        licenseTypeIds: result.licenseTypeIds,
+        dataMartAccess: result.dataMartAccess,
+        pmScopeUserId: result.pmScopeUserId,
+        grantedScopes: result.scope.split(' ').filter(Boolean),
+        authHeaders: { 'Token': result.sessionToken },
+    };
+}
+//# sourceMappingURL=oauth-auth.js.map

package/dist/src/auth/oauth-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-auth.js","sourceRoot":"","sources":["../../../src/auth/oauth-auth.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,MAAmB,EACnB,GAAY;IAEZ,GAAG,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,wBAAwB,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,UAAU,EAAE;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;KACpD,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;IAC5D,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qCAAqC,CAAC,MAA2B;IAC/E,OAAO;QACL,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;QACtD,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE;KAC9C,CAAC;AACJ,CAAC"}

package/dist/src/auth/oauth-metadata.d.ts

@@ -0,0 +1,10 @@
+export interface ProtectedResourceMetadata {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+}
+export declare function buildProtectedResourceMetadata(config: {
+    mcpServerUrl: string;
+    authorizationServerUrl: string;
+}): ProtectedResourceMetadata;
+//# sourceMappingURL=oauth-metadata.d.ts.map

package/dist/src/auth/oauth-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC;CAChC,GAAG,yBAAyB,CAM5B"}

package/dist/src/auth/oauth-metadata.js

@@ -0,0 +1,8 @@
+export function buildProtectedResourceMetadata(config) {
+    return {
+        resource: config.mcpServerUrl,
+        authorization_servers: [config.authorizationServerUrl],
+        scopes_supported: ['mcp:read', 'mcp:write'],
+    };
+}
+//# sourceMappingURL=oauth-metadata.js.map

package/dist/src/auth/oauth-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.js","sourceRoot":"","sources":["../../../src/auth/oauth-metadata.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,8BAA8B,CAAC,MAG9C;IACC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACtD,gBAAgB,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/src/auth/token-extraction.d.ts

@@ -0,0 +1,2 @@
+export declare function extractBearerToken(headers: Record<string, string | undefined>): string | undefined;
+//# sourceMappingURL=token-extraction.d.ts.map

package/dist/src/auth/token-extraction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-extraction.d.ts","sourceRoot":"","sources":["../../../src/auth/token-extraction.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAIlG"}

package/dist/src/auth/token-extraction.js

@@ -0,0 +1,7 @@
+export function extractBearerToken(headers) {
+    const auth = headers.authorization;
+    if (auth?.startsWith('Bearer '))
+        return auth.slice(7);
+    return undefined;
+}
+//# sourceMappingURL=token-extraction.js.map

package/dist/src/auth/token-extraction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-extraction.js","sourceRoot":"","sources":["../../../src/auth/token-extraction.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,kBAAkB,CAAC,OAA2C;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IACnC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/clients/audit-client.d.ts

@@ -0,0 +1,25 @@
+import type { Logger } from 'pino';
+export interface AuditClientConfig {
+    apiUrl: string;
+    company: string;
+    authHeaders: Record<string, string>;
+    log?: Logger;
+}
+export interface AuditEntry {
+    timestamp: string;
+    userId: number;
+    accountId: number;
+    toolName: string;
+    parametersHash: string;
+    success: boolean;
+    error?: string;
+    aiClientId: string;
+    durationMs: number;
+}
+export interface AuditClient {
+    log(entry: AuditEntry): Promise<void>;
+}
+export declare function hashParameters(params: unknown): string;
+export declare function createAuditClient(config: AuditClientConfig): AuditClient;
+export declare function createNoOpAuditClient(): AuditClient;
+//# sourceMappingURL=audit-client.d.ts.map

package/dist/src/clients/audit-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-client.d.ts","sourceRoot":"","sources":["../../../src/clients/audit-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA0BxE;AAED,wBAAgB,qBAAqB,IAAI,WAAW,CAInD"}

package/dist/src/clients/audit-client.js

@@ -0,0 +1,37 @@
+import { createHash } from 'node:crypto';
+export function hashParameters(params) {
+    return createHash('sha256').update(JSON.stringify(params)).digest('hex');
+}
+export function createAuditClient(config) {
+    const url = `${config.apiUrl}/v2/${config.company}/mcp/audit`;
+    const headers = {
+        ...config.authHeaders,
+        'Content-Type': 'application/json',
+    };
+    const log = config.log;
+    return {
+        async log(entry) {
+            try {
+                const response = await fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: JSON.stringify(entry),
+                });
+                if (!response.ok) {
+                    log?.warn({ status: response.status, toolName: entry.toolName }, 'Audit POST failed');
+                    return;
+                }
+                log?.debug({ toolName: entry.toolName }, 'Audit entry logged');
+            }
+            catch (err) {
+                log?.warn({ err, toolName: entry.toolName }, 'Audit POST error');
+            }
+        },
+    };
+}
+export function createNoOpAuditClient() {
+    return {
+        async log() { },
+    };
+}
+//# sourceMappingURL=audit-client.js.map

package/dist/src/clients/audit-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-client.js","sourceRoot":"","sources":["../../../src/clients/audit-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA0BzC,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,YAAY,CAAC;IAC9D,MAAM,OAAO,GAA2B;QACtC,GAAG,MAAM,CAAC,WAAW;QACrB,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAEvB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,KAAiB;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC5B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;oBACtF,OAAO;gBACT,CAAC;gBACD,GAAG,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,CAAC,GAAG,KAAmB,CAAC;KAC9B,CAAC;AACJ,CAAC"}

package/dist/src/clients/datamart-client.d.ts

@@ -0,0 +1,16 @@
+import type { Logger } from 'pino';
+export interface DataMartClientConfig {
+    apiUrl: string;
+    company: string;
+    authHeaders: Record<string, string>;
+    log?: Logger;
+}
+export interface DataMartQuery {
+    query: string;
+    variables: Record<string, unknown>;
+}
+export interface DataMartClient {
+    query(body: DataMartQuery): Promise<Record<string, unknown>>;
+}
+export declare function createDataMartClient(config: DataMartClientConfig): DataMartClient;
+//# sourceMappingURL=datamart-client.d.ts.map

package/dist/src/clients/datamart-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datamart-client.d.ts","sourceRoot":"","sources":["../../../src/clients/datamart-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAmCjF"}