@lenne.tech/nest-server 11.42.16 → 11.43.1

package/.claude/rules/better-auth.md

@@ -483,6 +483,27 @@ normalise them away; mutation `openapi-plugin-routable` drops `serverOnlyPlugin(
 red) and the "framework routes" cases in `tests/unit/swagger-helper.spec.ts`, which run against the
 REAL generator output rather than a fixture.
 
+## 10. Direct `api.*` calls must hand Better-Auth the request — or its CSRF protection does not run
+
+`signInEmail` and `signUpEmail` carry Better-Auth's `formCsrfMiddleware`: it refuses a cross-site navigation
+(`Sec-Fetch-Site: cross-site` + `Sec-Fetch-Mode: navigate`) and validates a present `Origin` / `Referer` against
+`trustedOrigins`. It reads them from `ctx.request`. `CoreBetterAuthController` called both via `api.*({ body })` — no
+request, so the check was skipped and a hostile page could sign a visitor in to the attacker's account (login CSRF,
+fixed in 11.43.0; on the MCP consent page that turned into "approve a client for the attacker's account").
+
+| Rule | Why |
+|------|-----|
+| Pass `request: this.csrfCheckedRequest(req, '<path>')` AND `asResponse: false` | with a request Better-Auth answers a `Response` by default; the controller reads the data |
+| Forward `Origin`, `Referer`, `Sec-Fetch-*` only — never the cookie | a cookie alone makes Better-Auth demand an `Origin`, refusing non-browser clients with a cookie jar |
+| Forward them only from a BROWSER request: one carrying `Origin`, `Referer` or `Sec-Fetch-Site` | Node's built-in `fetch` (undici) sends a lone `Sec-Fetch-Mode: cors` and no `Origin`; Better-Auth reads any fetch metadata without an origin as `MISSING_OR_NULL_ORIGIN`, so forwarding it unconditionally answered every server-side `fetch` sign-in with 403. A browser always sends `Origin` on a POST and `Sec-Fetch-Site` with its metadata, so nothing a hostile page can make it send escapes the check (mutations `iam-signin-csrf-nonbrowser-metadata-forwarded`, `iam-signin-csrf-site-not-a-browser-signal`) |
+| Use `globalThis.Request`, not `Request` | the file imports Express's `Request` type; under Vitest (Vite SSR) the bare name resolves to that import, which is `undefined` at runtime — tsc happens to emit the global |
+| Map `CROSS_SITE_NAVIGATION_LOGIN_BLOCKED` / `INVALID_ORIGIN` / `MISSING_OR_NULL_ORIGIN` to 403 (`rethrowCsrfRefusal`) | "invalid credentials" would send whoever debugs a missing `trustedOrigins` entry looking at the password |
+
+**Tests:** Better-Auth skips its origin/CSRF checks under a test runner (`skipOriginCheck: isTest()`). A spec that pins
+this protection must set `betterAuth.options.advanced.disableOriginCheck: false` — otherwise it is green with the check
+removed. `tests/better-auth-signin-csrf.e2e-spec.ts` does; mutations `iam-signin-csrf-check-skipped` /
+`iam-signup-csrf-check-skipped`.
+
 ## Summary
 
 | Principle | Requirement |
@@ -496,3 +517,4 @@ REAL generator output rather than a fixture.
 | Session cookie | Always the opaque session token — never the body JWT (§7) |
 | `account` reads / writes | Reads filter on `providerId` alone, never `issuer`. Writes set `issuer` only on better-auth 1.7.0–1.7.2, via the helper (§8) |
 | `openAPI()` plugin | Registered internally for `setupSwagger()`, kept off the router (`SERVER_ONLY`) unless the project registered it — never by a path check (§9) |
+| Direct `api.*` calls | Hand Better-Auth the request (CSRF headers only) + `asResponse: false`, or its login-CSRF check is skipped (§10) |

package/.claude/rules/configurable-features.md

@@ -343,8 +343,8 @@ This pattern is currently applied to:
 | Outbound URL Guard (SSRF) | `security.allowPrivateOutboundTargets` | Explicit Boolean with DERIVED default | **Opt-in helper for URLs a USER entered** (webhooks, export targets, ERP addresses) — `outboundFetch()`, `assertOutboundUrlAllowed()`, `createOutboundDispatcher()` in `common/helpers/outbound-url.helper.ts` (11.42.0). Nothing is applied globally: configured targets (AI providers, SMTP, S3, Redis, Brevo) never go through it. Refuses loopback, RFC 1918, link-local incl. `169.254.169.254`, CGNAT, `0/8`, benchmarking, multicast/reserved, IPv6 unspecified/loopback/IPv4-compatible (`::/96`), NAT64, ULA, link-local and multicast, and IPv4-mapped IPv6 in every notation (canonicalised through the URL parser). Checked TWICE: on the URL before sending (readable `OutboundUrlBlockedError`) and on every connection through an undici `Agent` with a guarded connector — the only place that sees a redirect's next hop and a DNS answer at connect time (rebinding). **Unset → derived from the environment**: allowed in `local`, `e2e`, `ci`, refused everywhere else — deliberately including `test`, a DEPLOYED stage in starter-based projects; `true`/`false` (also the strings, from `NSC__SECURITY__ALLOW_PRIVATE_OUTBOUND_TARGETS`) decide explicitly. Per call, `allowedHosts` frees single internal hosts (`'erp.local:8443'` = that port, `'erp.local'` = any port) without opening the rest — re-checked per connection, so a redirect does not inherit it. `outboundFetch()` uses undici's OWN `fetch` (runtime dependency `undici` since 11.42.0), because Node 22's built-in fetch bundles a different undici major than the agent |
 | AI Egress Allowlist (SSRF) | `ai.allowedBaseUrlHosts` | Explicit Value — **unset = permissive**, malformed = INTERPRETED or reported, never silently off | `undefined` → no restriction, so a local provider (Ollama on `localhost:11434`) works out of the box. Set → only those hosts are reachable, matched against `URL.host` (incl. port) and `URL.hostname`. **Accepts an array OR a comma-separated string, and the string form is not a convenience** — it is what the framework's own env mapping produces: `NSC__AI__ALLOWED_BASE_URL_HOSTS` becomes `{ ai: { allowedBaseUrlHosts: '<string>' } }` and lodash `merge` assigns that scalar straight over a configured array. Until 11.39.x a bare `!Array.isArray(...) -> return` read that as "not configured" and skipped the check entirely, so the canonical `NSC__` spelling silently disabled SSRF egress control with no log line at all. Entries are trimmed, lowercased and stripped of a fully-qualifying trailing dot, and the SAME normalisation is applied to the URL, so neither side wins by spelling one DNS name differently; a bare hostname entry matches any port, and an entry naming the scheme's default port (`example.com:443` on https) also matches the portless URL. A value that is neither array nor string carries no hostnames — the allowlist is then inactive and that is LOGGED as an error, because from the outside it looks exactly like "correctly unset". Enforced on **all three** outbound paths (`chat()`, the capability `probe()`, and `probeContextWindow()` — the last was unguarded before 11.39.x and is reachable from an ordinary user prompt via `detectAndPersistCapabilities()`, before the rate limit). Implementation: `openai-compatible.provider.ts` → `assertBaseUrlAllowed()` / `resolveAllowedBaseUrlHosts()` |
 | AI Run Time Limit | `ai.maxRunMs` | **Numeric Sentinel — Family A** (`0` = no limit) | `0` (omitted = unbounded, the previous behaviour). Wall-clock ceiling for ONE prompt run, checked before each agent-loop iteration; once exceeded the run stops and answers with whatever it has. **Without it a run's only bound is `maxIterations` MULTIPLIED BY the connection's per-call timeout** — 8 iterations at the 120s default is a request that can legitimately hold a socket, its message buffer and a request context for 16 minutes, and compaction can add a call per iteration on top. Guarded as `maxRunMs > 0`, never `<= 0`: a value arriving as a non-numeric string through `NSC__AI__MAX_RUN_MS` (the reader coerces only `'true'`, `'false'` and numbers) yields `NaN`, and `NaN > 0` is `false`, so a misconfiguration degrades to "no limit" rather than to an instantly-expired deadline that would break every prompt. Set it to something a client would actually wait for. Implementation: `core-ai.service.ts` -> `runDeadlineExceeded()` |
-| AI Assistant | `ai` | Presence Implies Enabled | Core: `maxIterations: 5`, `defaultMode: 'auto'` (or `'plan'`), `rateLimit` (presence implies enabled: `max: 20`, `windowSeconds: 60`), `systemPrompt`, `documentation` (injected into the system prompt), `encryptionSecret`. **DB-backed LLM connections** (`aiConnections`, admin CRUD) with AES-256-GCM-encrypted API keys (`AiCryptoService`, secret from `ai.encryptionSecret` / `NSC__AI__ENCRYPTION_SECRET` / `SECRETS_ENCRYPTION_KEY`; `apiKeyEncrypted` is a global `secretFields` entry, never returned — only `hasApiKey`); optional `defaultConnection` one-time seed. **Provider abstraction** (`ILlmProvider`, default `OpenAiCompatibleProvider` for any OpenAI-compatible endpoint via `fetch`; per-connection `supportsNativeTools`/`supportsJsonResponse` capabilities, emulated tool calling when native tools are unavailable). **Tool registry** (`AiToolRegistry`, tools self-register, role-filtered — under multi-tenancy (11.42.0+) a tool's roles resolve like `@Roles()` in `CoreTenantGuard`: global roles against `user.roles`, tenant roles against the request's membership role, ADMIN bypass only where `adminBypass` grants it, so chat and MCP never exceed the user's own rights; an MCP session reads the user per request, so a revoked role stops working without a reconnect; tools may be `mutating`/`destructive` and define `authorize()` for pre-flight data-level checks). **Plan mode** (`input.mode: 'plan'`): full plan → pre-flight authorize ALL steps → all-or-nothing execution with a translated (de/en) error when any step is not permitted. **Confirmation policy**: `confirmation.mutating: { default, enforced }` + client `input.requireConfirmation` (ignored when enforced); `destructive` always confirms. **Client metadata** (`input.metadata`: URL/nav/console logs, untrusted+capped). **Multi-turn conversations** (`aiConversations`, owner-scoped). **SSE streaming** (`POST /ai/stream`). **Audit** (`audit: false` → persist to `aiInteractions`, admin-readable). **Token budgets** (`budget: { period: 'day'|'month'|'none', user: { maxTokens?, maxPrompts? }, tenant: { maxTokens?, maxPrompts? } }`, requires audit): per-user AND per-tenant limits with config defaults; admins override per user/tenant at runtime (`aiBudgetLimits`, `CoreAiBudgetService`). Resolution: override → default → unlimited (missing/0 = unlimited). Enforced before the run (HTTP 429 + translated). Each response carries a compact `budget` summary (promptTokens, usedTokens, remainingTokens, resetAt); full breakdown via `aiUsage` query / `GET /ai/usage`. **Self-optimizing prompts**: the system prompt is assembled from keyed fragments (`CoreAiPromptBuilderService` ships built-in defaults; works with zero rows). Admin-editable overrides per slot (`aiSlots`, admin CRUD, `/ai/slots`) scoped by `key`/`locale`/`capability`/`tenantId`, with tenant override/reset semantics and placeholder tokens resolved at run time via the placeholder registry. **Governed learning loop** (`promptLearning: { enabled: true, autoApply: false }`): tool errors record `suggested` hints (`aiPromptHints`, admin CRUD, `/ai/prompt-hints`) that only reach the prompt once admin-approved (or auto-approved when `autoApply`); hints only ADD guidance, never relax permissions. **Context window** (`contextWindow`, default 8192; auto-detected per connection via `ILlmProvider.detectContextWindow()` — Ollama `/api/show` probe / known-model table / Claude alias — and persisted): per-user/session history is trimmed (oldest non-system turns dropped, last truncated) and tool-results capped to `maxToolResultChars` (default 12000) so a session never overflows the model. A connection's window can be seeded via `ai.defaultConnection.contextWindow` (validated: a non-positive/non-integer value is dropped with a warning). **Capability drift check** (`capabilityDriftCheck`, default `false`): opt-in boot self-check that probes each enabled connection with an EXPLICIT `supportsNativeTools`/`supportsJsonResponse` (built with those flags cleared so the endpoint is actually re-probed) and logs a warning on mismatch — the stored value is never changed. OFF by default because it makes outbound calls to the LLM endpoints on every boot; also skipped in the ci/e2e runners. **Deferred tool schemas** (`deferToolSchemas`, default `false`): the system-prompt tool catalog then lists only tool NAMES + descriptions instead of full JSON schemas, and the model fetches a schema on demand via the built-in `search_tools` meta-tool — with a large registry the schemas alone can dominate a small context window. `deferToolSummaryChars` (default `0` = untruncated) additionally caps each description in that DEFERRED catalog: whole sentences up to the cap (always at least the first), word-boundary cut when the first sentence already exceeds it, and a `…` marker appended ON TOP of the cap. The default of `0` keeps the saving opt-in, so enabling `deferToolSchemas` alone never changes what a description says; set roughly 200–400 alongside it to actually reclaim the context. Both apply to EMULATED providers only — a connection with `supportsNativeTools: true` receives every full description + schema via `buildToolSchemas()` regardless, so truncation and the banner are skipped there rather than asserting a cut the tool payload contradicts. The omitted tail is where preconditions and role restrictions usually live — the catalog banner tells the model to fetch the full text via `search_tools` first, but this is model GUIDANCE only: authorization is enforced server-side by the registry's role filter (`forUser()`), the execution-time re-check, and the `mutating`/`destructive` flags read by the confirmation gate — never by what the catalog shows. (`AiTool.authorize()` runs in PLAN MODE only; in auto mode and over MCP, data-level checks must live inside `execute()`.) **MCP server** (`mcp: false` → `/ai/mcp` Streamable HTTP, Bearer auth, lazy `@modelcontextprotocol/sdk`; `mcp: { oauth: true, oauthSecret }` adds OAuth 2.1 — HMAC tokens + PKCE S256 + dynamic registration via `mountAiMcpOAuth(app)` in main.ts). Overrides via `CoreModule.forRoot(env, { ai: { budgetService, connectionResolver, connectionService, controller, conversationService, interactionService, mcpClientService, modeService, placeholderRegistry, preferenceService, promptBuilder, promptHintService, promptService, resolver, service, slotService, toolGrantService, toolPolicyService } })` |
-| Swagger API-Token View | `setupSwagger(app, { apiTokenView })` (helper option, not server config) | Boolean Shorthand / Presence Implies Enabled | **Off without the option** (11.42.7+). `true` / `{}` serves a second document with only the routes that release a scope via `@ApiTokenScopes()`: UI at `swagger-api-tokens`, JSON at `/api-docs-api-tokens-json`, title `<title> — API tokens`, bearer as the only scheme, unused schemas pruned; the tenant header stays while `apiTokens.userTokens` is on (a personal token chooses the company like a session) and is dropped with company tokens only. Keep its path OUTSIDE the full UI's path: Swagger UI serves its assets below its own path. The full document's enrichment (global bearer + session-cookie requirement, `security: []` on public routes, `x-api-token-scopes` + description line, `TenantHeader` parameter) is not optional — it is what `setupSwagger()` is for, and it reads the same metadata as the guards. Implementation: `common/helpers/swagger.helper.ts` **Better-Auth routes (11.42.9):** the full document also lists every route Better-Auth serves itself under the base path — whatever the configured plugins add — from Better-Auth's own generator, under the project's Better-Auth controller (its tags and `operationTags`, ids `<Controller>_betterAuth_<id>`, schemas prefixed `BetterAuth`, OpenAPI 3.1 constructs converted to 3.0). Their security is what Better-Auth enforces, not the generator's blanket bearer-only: a route behind one of Better-Auth's session middlewares (or one of the three social-account routes in `HANDLER_SESSION_PATHS`, which check in the handler) gets the global requirement, every other route `security: []` — except routes of plugins nest-server does not register itself (`BUILT_IN_BETTER_AUTH_PLUGIN_IDS`), which always keep the global requirement — and if the instance's middlewares cannot be identified (two copies of better-auth), all of them keep the global requirement rather than risk documenting a session route as public. They carry the "not allowed" API-token line, and never reach the API-token view. The `openAPI()` plugin this needs is registered internally; its routes answer 404 (see `.claude/rules/better-auth.md` §9). **Only usable operations (11.42.9):** an operation that answers an error to every caller under the running configuration is left out — `@ApiMethods()` on `@All()` handlers (TUS), legacy `/auth/*` while `auth.legacyEndpoints` keeps REST closed, Better-Auth routes refused by the configuration or the live instance, Hub endpoints of switched-off panels. `/ai/mcp` and the MCP OAuth endpoints `mountAiMcpOAuth()` mounted are documented. An explicit `@ApiBearerAuth()` keeps a guard-public route from being documented as public. Rules: `isSwitchedOffOperation()` in `swagger.helper.ts` |
+| AI Assistant | `ai` | Presence Implies Enabled | Core: `maxIterations: 5`, `defaultMode: 'auto'` (or `'plan'`), `rateLimit` (presence implies enabled: `max: 20`, `windowSeconds: 60`), `systemPrompt`, `documentation` (injected into the system prompt), `encryptionSecret`. **DB-backed LLM connections** (`aiConnections`, admin CRUD) with AES-256-GCM-encrypted API keys (`AiCryptoService`, secret from `ai.encryptionSecret` / `NSC__AI__ENCRYPTION_SECRET` / `SECRETS_ENCRYPTION_KEY`; `apiKeyEncrypted` is a global `secretFields` entry, never returned — only `hasApiKey`); optional `defaultConnection` one-time seed. **Provider abstraction** (`ILlmProvider`, default `OpenAiCompatibleProvider` for any OpenAI-compatible endpoint via `fetch`; per-connection `supportsNativeTools`/`supportsJsonResponse` capabilities, emulated tool calling when native tools are unavailable). **Tool registry** (`AiToolRegistry`, tools self-register, role-filtered — under multi-tenancy (11.42.0+) a tool's roles resolve like `@Roles()` in `CoreTenantGuard`: global roles against `user.roles`, tenant roles against the request's membership role, ADMIN bypass only where `adminBypass` grants it, so chat and MCP never exceed the user's own rights; an MCP session reads the user per request, so a revoked role stops working without a reconnect; tools may be `mutating`/`destructive` and define `authorize()` for pre-flight data-level checks). **Plan mode** (`input.mode: 'plan'`): full plan → pre-flight authorize ALL steps → all-or-nothing execution with a translated (de/en) error when any step is not permitted. **Confirmation policy**: `confirmation.mutating: { default, enforced }` + client `input.requireConfirmation` (ignored when enforced); `destructive` always confirms. **Client metadata** (`input.metadata`: URL/nav/console logs, untrusted+capped). **Multi-turn conversations** (`aiConversations`, owner-scoped). **SSE streaming** (`POST /ai/stream`). **Audit** (`audit: false` → persist to `aiInteractions`, admin-readable). **Token budgets** (`budget: { period: 'day'|'month'|'none', user: { maxTokens?, maxPrompts? }, tenant: { maxTokens?, maxPrompts? } }`, requires audit): per-user AND per-tenant limits with config defaults; admins override per user/tenant at runtime (`aiBudgetLimits`, `CoreAiBudgetService`). Resolution: override → default → unlimited (missing/0 = unlimited). Enforced before the run (HTTP 429 + translated). Each response carries a compact `budget` summary (promptTokens, usedTokens, remainingTokens, resetAt); full breakdown via `aiUsage` query / `GET /ai/usage`. **Self-optimizing prompts**: the system prompt is assembled from keyed fragments (`CoreAiPromptBuilderService` ships built-in defaults; works with zero rows). Admin-editable overrides per slot (`aiSlots`, admin CRUD, `/ai/slots`) scoped by `key`/`locale`/`capability`/`tenantId`, with tenant override/reset semantics and placeholder tokens resolved at run time via the placeholder registry. **Governed learning loop** (`promptLearning: { enabled: true, autoApply: false }`): tool errors record `suggested` hints (`aiPromptHints`, admin CRUD, `/ai/prompt-hints`) that only reach the prompt once admin-approved (or auto-approved when `autoApply`); hints only ADD guidance, never relax permissions. **Context window** (`contextWindow`, default 8192; auto-detected per connection via `ILlmProvider.detectContextWindow()` — Ollama `/api/show` probe / known-model table / Claude alias — and persisted): per-user/session history is trimmed (oldest non-system turns dropped, last truncated) and tool-results capped to `maxToolResultChars` (default 12000) so a session never overflows the model. A connection's window can be seeded via `ai.defaultConnection.contextWindow` (validated: a non-positive/non-integer value is dropped with a warning). **Capability drift check** (`capabilityDriftCheck`, default `false`): opt-in boot self-check that probes each enabled connection with an EXPLICIT `supportsNativeTools`/`supportsJsonResponse` (built with those flags cleared so the endpoint is actually re-probed) and logs a warning on mismatch — the stored value is never changed. OFF by default because it makes outbound calls to the LLM endpoints on every boot; also skipped in the ci/e2e runners. **Deferred tool schemas** (`deferToolSchemas`, default `false`): the system-prompt tool catalog then lists only tool NAMES + descriptions instead of full JSON schemas, and the model fetches a schema on demand via the built-in `search_tools` meta-tool — with a large registry the schemas alone can dominate a small context window. `deferToolSummaryChars` (default `0` = untruncated) additionally caps each description in that DEFERRED catalog: whole sentences up to the cap (always at least the first), word-boundary cut when the first sentence already exceeds it, and a `…` marker appended ON TOP of the cap. The default of `0` keeps the saving opt-in, so enabling `deferToolSchemas` alone never changes what a description says; set roughly 200–400 alongside it to actually reclaim the context. Both apply to EMULATED providers only — a connection with `supportsNativeTools: true` receives every full description + schema via `buildToolSchemas()` regardless, so truncation and the banner are skipped there rather than asserting a cut the tool payload contradicts. The omitted tail is where preconditions and role restrictions usually live — the catalog banner tells the model to fetch the full text via `search_tools` first, but this is model GUIDANCE only: authorization is enforced server-side by the registry's role filter (`forUser()`), the execution-time re-check, and the `mutating`/`destructive` flags read by the confirmation gate — never by what the catalog shows. (`AiTool.authorize()` runs in PLAN MODE only; in auto mode and over MCP, data-level checks must live inside `execute()`.) **MCP server** (`mcp: false` → `/ai/mcp` Streamable HTTP, Bearer auth, lazy `@modelcontextprotocol/sdk`; `mcp: { oauth: true, oauthSecret }` adds OAuth 2.1 — HMAC tokens + PKCE S256 + dynamic registration. **Since 11.43.0 `CoreAiMcpOAuthInitializer` mounts the endpoints during `app.init()` (`onModuleInit`)** — behind the Nest middleware and routes, ahead of Nest's not-found handler; `mountAiMcpOAuth(app)` after `app.init()`, the documented way before, sat behind that handler and answered 404 everywhere, and is a no-op now. The protected resource is described at the path Nest registered `/ai/mcp` at (global prefix + exclusions, URI versioning, `RouterModule`, via Nest's own `RoutePathFactory`), and the MCP 401 names that metadata URL — plain `Bearer` without OAuth. Issuer: `mcp.oauthBaseUrl` (its origin is added to Better-Auth's `trustedOrigins`, explicit list included, via `withMcpOAuthIssuerOrigin()`), else `baseUrl`; a deployed environment with neither fails the boot. Signing secret required everywhere except `local` / `ci` / `e2e` (`allowsDevelopmentSecret()` → `isLocalEnv`), deployed `develop` / `test` stages included. Under a global prefix the consent page resolves the session itself (the Better-Auth middleware runs below the prefix only) and signs in at the prefixed IAM path. Express only (boot error otherwise); an application context without HTTP server mounts nothing. Consent: a built-in page (`authorizeConsent()` default) — sign-in through Better-Auth on the API origin (password + TOTP/backup code; passkey/social via `mcp.oauthLoginUrl`, default `<appUrl>/auth/login`), then Allow/Deny as a form POST with a CSRF token signed and bound to user, client, redirect URI and PKCE challenge (10 min); Allow is `disabled` until a nonce'd guard arms it and counts a click only after intent (visible + focused + pointer move / key / touch ≥ 600 ms later — against double-clickjacking); the account is shown first with "use another account"; own CSP with nonces + `frame-ancestors 'none'`, everything escaped; boot warning without Better-Auth; restyle via `renderConsentPage()`, replace via the `mcpOAuthService` override. A code saved while answering a GET to `/authorize` is refused for every consent implementation. Refusals are SDK `OAuthError` classes (`invalid_grant` etc.), never a plain `Error`, which the SDK answers as 500). Overrides via `CoreModule.forRoot(env, { ai: { budgetService, connectionResolver, connectionService, controller, conversationService, interactionService, mcpClientService, mcpOAuthService, modeService, placeholderRegistry, preferenceService, promptBuilder, promptHintService, promptService, resolver, service, slotService, toolGrantService, toolPolicyService } })` |
+| Swagger API-Token View | `setupSwagger(app, { apiTokenView })` (helper option, not server config) | Boolean Shorthand / Presence Implies Enabled | **Off without the option** (11.42.7+). `true` / `{}` serves a second document with only the routes that release a scope via `@ApiTokenScopes()`: UI at `swagger-api-tokens`, JSON at `/api-docs-api-tokens-json`, title `<title> — API tokens`, bearer as the only scheme, unused schemas pruned; the tenant header stays while `apiTokens.userTokens` is on (a personal token chooses the company like a session) and is dropped with company tokens only. Keep its path OUTSIDE the full UI's path: Swagger UI serves its assets below its own path. The full document's enrichment (global bearer + session-cookie requirement, `security: []` on public routes, `x-api-token-scopes` + description line, `TenantHeader` parameter) is not optional — it is what `setupSwagger()` is for, and it reads the same metadata as the guards. Implementation: `common/helpers/swagger.helper.ts` **Better-Auth routes (11.42.9):** the full document also lists every route Better-Auth serves itself under the base path — whatever the configured plugins add — from Better-Auth's own generator, under the project's Better-Auth controller (its tags and `operationTags`, ids `<Controller>_betterAuth_<id>`, schemas prefixed `BetterAuth`, OpenAPI 3.1 constructs converted to 3.0). Their security is what Better-Auth enforces, not the generator's blanket bearer-only: a route behind one of Better-Auth's session middlewares (or one of the three social-account routes in `HANDLER_SESSION_PATHS`, which check in the handler) gets the global requirement, every other route `security: []` — except routes of plugins nest-server does not register itself (`BUILT_IN_BETTER_AUTH_PLUGIN_IDS`), which always keep the global requirement — and if the instance's middlewares cannot be identified (two copies of better-auth), all of them keep the global requirement rather than risk documenting a session route as public. They carry the "not allowed" API-token line, and never reach the API-token view. The `openAPI()` plugin this needs is registered internally; its routes answer 404 (see `.claude/rules/better-auth.md` §9). **Only usable operations (11.42.9):** an operation that answers an error to every caller under the running configuration is left out — `@ApiMethods()` on `@All()` handlers (TUS), legacy `/auth/*` while `auth.legacyEndpoints` keeps REST closed, Better-Auth routes refused by the configuration or the live instance, Hub endpoints of switched-off panels. `/ai/mcp` and the MCP OAuth endpoints that are actually mounted are documented. An explicit `@ApiBearerAuth()` keeps a guard-public route from being documented as public. Rules: `isSwitchedOffOperation()` in `swagger.helper.ts` |
 
 ## Module Override Pattern (via `ICoreModuleOverrides`)
 
@@ -376,7 +376,7 @@ CoreModule.forRoot(CoreAuthService, AuthModule.forRoot(envConfig.jwt), envConfig
 
 | Module | Fields | Description |
 |--------|--------|-------------|
-| `ai` | `budgetService`, `connectionResolver`, `connectionService`, `controller`, `conversationService`, `interactionService`, `mcpClientService`, `modeService`, `placeholderRegistry`, `preferenceService`, `promptBuilder`, `promptHintService`, `promptService`, `resolver`, `service`, `slotService`, `toolGrantService`, `toolPolicyService` | Custom AI orchestrator, connection-resolution chain, connection/preference/budget/conversation/interaction/MCP-client services, slot + user-prompt + learning-hint stores, mode service, placeholder registry, tool-grant + tool-policy services, endpoints |
+| `ai` | `budgetService`, `connectionResolver`, `connectionService`, `controller`, `conversationService`, `interactionService`, `mcpClientService`, `mcpOAuthService`, `modeService`, `placeholderRegistry`, `preferenceService`, `promptBuilder`, `promptHintService`, `promptService`, `resolver`, `service`, `slotService`, `toolGrantService`, `toolPolicyService` | Custom AI orchestrator, connection-resolution chain, connection/preference/budget/conversation/interaction/MCP-client services, MCP OAuth service (the consent step), slot + user-prompt + learning-hint stores, mode service, placeholder registry, tool-grant + tool-policy services, endpoints |
 | `errorCode` | `controller`, `service` | Custom error code endpoint and/or service |
 | `betterAuth` | `controller`, `resolver` | Custom IAM REST controller and/or GraphQL resolver |
 | `hub` | `controller`, `actionsController`, `service`, `htmlService`, `actionsService` | Custom Hub page/actions controllers and aggregator/HTML/actions services (each must extend its `Core*` base) |

package/.claude/rules/testing.md

@@ -268,7 +268,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 137 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 165 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -287,7 +287,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 212 mutations.
+at 246 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -332,9 +332,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 75 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 81 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 212 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 246 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-17 (v11.42.16)
+> Auto-generated from source code as of 2026-10-20 (v11.43.1)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
@@ -131,7 +131,7 @@ When `passkey` is enabled, `trustedOrigins` is required (compile-time enforcemen
   - `maxRunMs?`: `number | undefined` (default: `0`) — Wall-clock ceiling for ONE prompt run, in milliseconds. Checked before each
   - `maxToolResultChars?`: `number | undefined` (default: `12000`) — Maximum characters of a tool-results payload fed back to the model.
   - `promptLearning?`: `{ autoApply?: boolean; enabled?: boolean; minOccurrences?: number; } | undefined` — Governed self-improvement loop for the system prompt. The orchestrator records
-  - `mcp?`: `boolean | { enabled?: boolean; oauth?: boolean; oauthSecret?: string; } | und...` (default: `false`) — Expose the tool registry as an MCP server at `/ai/mcp` (Streamable HTTP) for
+  - `mcp?`: `boolean | { enabled?: boolean; oauth?: boolean; oauthBaseUrl?: string; oauthL...` (default: `false`) — Expose the tool registry as an MCP server at `/ai/mcp` (Streamable HTTP) for
   - `rateLimit?`: `IAiRateLimit | undefined` — Rate limiting for prompts.
   - `systemPrompt?`: `string | undefined` — Base system prompt prepended to every conversation.
 

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -260,6 +260,8 @@ export interface IAi {
     mcp?: boolean | {
         enabled?: boolean;
         oauth?: boolean;
+        oauthBaseUrl?: string;
+        oauthLoginUrl?: string;
         oauthSecret?: string;
     };
     rateLimit?: IAiRateLimit;
@@ -532,6 +534,7 @@ export interface ICoreModuleOverrides {
         conversationService?: Type<any>;
         interactionService?: Type<any>;
         mcpClientService?: Type<any>;
+        mcpOAuthService?: Type<any>;
         modeService?: Type<any>;
         placeholderRegistry?: Type<any>;
         preferenceService?: Type<any>;

package/dist/core/modules/ai/core-ai-mcp-oauth.initializer.d.ts

@@ -0,0 +1,19 @@
+import { Logger, OnApplicationBootstrap, OnApplicationShutdown, OnModuleInit } from '@nestjs/common';
+import { HttpAdapterHost, ModuleRef, ModulesContainer } from '@nestjs/core';
+import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service';
+export declare class CoreAiMcpOAuthInitializer implements OnApplicationBootstrap, OnApplicationShutdown, OnModuleInit {
+    protected readonly oauthService: CoreAiMcpOAuthService;
+    protected readonly httpAdapterHost?: HttpAdapterHost;
+    protected readonly moduleRef?: ModuleRef;
+    protected readonly modulesContainer?: ModulesContainer;
+    protected readonly logger: Logger;
+    private mounted?;
+    constructor(oauthService: CoreAiMcpOAuthService, httpAdapterHost?: HttpAdapterHost, moduleRef?: ModuleRef, modulesContainer?: ModulesContainer);
+    onModuleInit(): Promise<void>;
+    onApplicationBootstrap(): void;
+    onApplicationShutdown(): void;
+    protected resolveMcpPath(): string;
+    protected resolveAuthBasePath(): string;
+    private controllerPath;
+    private modulePath;
+}

package/dist/core/modules/ai/core-ai-mcp-oauth.initializer.js

@@ -0,0 +1,145 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreAiMcpOAuthInitializer_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreAiMcpOAuthInitializer = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const shared_utils_1 = require("@nestjs/common/utils/shared.utils");
+const core_1 = require("@nestjs/core");
+const route_path_factory_1 = require("@nestjs/core/router/route-path-factory");
+const config_service_1 = require("../../common/services/config.service");
+const core_better_auth_registry_1 = require("../better-auth/core-better-auth.registry");
+const core_ai_mcp_controller_1 = require("./core-ai-mcp.controller");
+const ai_mcp_oauth_helper_1 = require("./helpers/ai-mcp-oauth.helper");
+const ai_mcp_oauth_registry_1 = require("./helpers/ai-mcp-oauth.registry");
+const core_ai_mcp_oauth_service_1 = require("./services/core-ai-mcp-oauth.service");
+let CoreAiMcpOAuthInitializer = CoreAiMcpOAuthInitializer_1 = class CoreAiMcpOAuthInitializer {
+    oauthService;
+    httpAdapterHost;
+    moduleRef;
+    modulesContainer;
+    logger = new common_1.Logger(CoreAiMcpOAuthInitializer_1.name);
+    mounted;
+    constructor(oauthService, httpAdapterHost, moduleRef, modulesContainer) {
+        this.oauthService = oauthService;
+        this.httpAdapterHost = httpAdapterHost;
+        this.moduleRef = moduleRef;
+        this.modulesContainer = modulesContainer;
+    }
+    async onModuleInit() {
+        if (!this.oauthService.isOAuthEnabled()) {
+            return;
+        }
+        const adapter = this.httpAdapterHost?.httpAdapter;
+        if (!adapter) {
+            return;
+        }
+        this.oauthService.assertProductionSafe();
+        if (adapter.getType() !== 'express') {
+            throw new Error(`ai.mcp.oauth requires the Express adapter, but the application runs on "${adapter.getType()}": ` +
+                'the MCP OAuth endpoints are an Express router.');
+        }
+        this.mounted = await (0, ai_mcp_oauth_helper_1.mountAiMcpOAuthRouter)(adapter.getInstance(), (router) => adapter.use(router), this.oauthService, {
+            baseUrl: config_service_1.ConfigService.get('ai.mcp.oauthBaseUrl'),
+            authBasePath: this.resolveAuthBasePath(),
+            baseUrlSource: 'ai.mcp.oauthBaseUrl',
+            mcpPath: this.resolveMcpPath(),
+        });
+    }
+    onApplicationBootstrap() {
+        if (!this.mounted || !this.oauthService.usesBuiltInConsent() || (0, core_better_auth_registry_1.getBetterAuthTokenService)()) {
+            return;
+        }
+        this.logger.warn('ai.mcp.oauth is enabled, but Better-Auth is not active: the built-in consent page has no way to sign a user ' +
+            'in, so no MCP client can be authorized. Enable betterAuth, or register a CoreAiMcpOAuthService subclass ' +
+            'with an authorizeConsent() of your own via CoreModule.forRoot(env, { ai: { mcpOAuthService } }).');
+    }
+    onApplicationShutdown() {
+        if (this.mounted && (0, ai_mcp_oauth_registry_1.getMountedMcpOAuth)() === this.mounted) {
+            (0, ai_mcp_oauth_registry_1.setMountedMcpOAuth)(undefined);
+        }
+    }
+    resolveMcpPath() {
+        const container = this.moduleRef
+            ?.container;
+        const applicationConfig = container?.applicationConfig;
+        const ctrlPath = this.controllerPath();
+        if (!applicationConfig) {
+            return ctrlPath;
+        }
+        const versioningOptions = applicationConfig.getVersioning();
+        const controllerVersion = versioningOptions
+            ? (Reflect.getMetadata(constants_1.VERSION_METADATA, core_ai_mcp_controller_1.CoreAiMcpController) ?? versioningOptions.defaultVersion)
+            : undefined;
+        const paths = new route_path_factory_1.RoutePathFactory(applicationConfig).create({
+            controllerVersion,
+            ctrlPath,
+            globalPrefix: (0, shared_utils_1.addLeadingSlash)(applicationConfig.getGlobalPrefix()),
+            methodPath: '/',
+            modulePath: this.modulePath(),
+            versioningOptions,
+        }, common_1.RequestMethod.POST);
+        if (paths.length > 1) {
+            this.logger.warn(`The MCP endpoint is registered at ${paths.join(', ')}; the OAuth metadata describes the first one only.`);
+        }
+        return paths[0];
+    }
+    resolveAuthBasePath() {
+        const basePath = `/${String(config_service_1.ConfigService.get('betterAuth.basePath') || 'iam').replace(/^\//, '')}`;
+        const applicationConfig = this.moduleRef
+            ?.container?.applicationConfig;
+        if (!applicationConfig) {
+            return basePath;
+        }
+        const versioningOptions = applicationConfig.getVersioning();
+        const [signIn] = new route_path_factory_1.RoutePathFactory(applicationConfig).create({
+            controllerVersion: versioningOptions?.defaultVersion,
+            ctrlPath: basePath,
+            globalPrefix: (0, shared_utils_1.addLeadingSlash)(applicationConfig.getGlobalPrefix()),
+            methodPath: '/sign-in/email',
+            versioningOptions,
+        }, common_1.RequestMethod.POST);
+        return signIn.replace(/\/sign-in\/email$/, '');
+    }
+    controllerPath() {
+        const declared = Reflect.getMetadata(constants_1.PATH_METADATA, core_ai_mcp_controller_1.CoreAiMcpController);
+        const path = Array.isArray(declared) ? declared[0] : declared;
+        return `/${String(path ?? 'ai/mcp').replace(/^\//, '')}`;
+    }
+    modulePath() {
+        if (!this.modulesContainer) {
+            return undefined;
+        }
+        for (const module of this.modulesContainer.values()) {
+            if (module.controllers.has(core_ai_mcp_controller_1.CoreAiMcpController)) {
+                return (Reflect.getMetadata(constants_1.MODULE_PATH + this.modulesContainer.applicationId, module.metatype) ??
+                    Reflect.getMetadata(constants_1.MODULE_PATH, module.metatype));
+            }
+        }
+        return undefined;
+    }
+};
+exports.CoreAiMcpOAuthInitializer = CoreAiMcpOAuthInitializer;
+exports.CoreAiMcpOAuthInitializer = CoreAiMcpOAuthInitializer = CoreAiMcpOAuthInitializer_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService,
+        core_1.HttpAdapterHost,
+        core_1.ModuleRef,
+        core_1.ModulesContainer])
+], CoreAiMcpOAuthInitializer);
+//# sourceMappingURL=core-ai-mcp-oauth.initializer.js.map

package/dist/core/modules/ai/core-ai-mcp-oauth.initializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-ai-mcp-oauth.initializer.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/core-ai-mcp-oauth.initializer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,wDAAwF;AACxF,oEAAoE;AACpE,uCAA+F;AAC/F,+EAA0E;AAE1E,yEAAqE;AACrE,wFAAqF;AACrF,qEAA+D;AAC/D,uEAAsE;AACtE,2EAA2G;AAC3G,oFAA6E;AAsBtE,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAOf;IACY;IACA;IACA;IATd,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAG/D,OAAO,CAAoB;IAEnC,YACqB,YAAmC,EACvB,eAAiC,EACjC,SAAqB,EACrB,gBAAmC;QAH/C,iBAAY,GAAZ,YAAY,CAAuB;QACvB,oBAAe,GAAf,eAAe,CAAkB;QACjC,cAAS,GAAT,SAAS,CAAY;QACrB,qBAAgB,GAAhB,gBAAgB,CAAmB;IACjE,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YAEb,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,2EAA2E,OAAO,CAAC,OAAO,EAAE,KAAK;gBAC/F,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,MAAM,IAAA,2CAAqB,EACxC,OAAO,CAAC,WAAW,EAAE,EACrB,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAC/B,IAAI,CAAC,YAAY,EACjB;YACE,OAAO,EAAE,8BAAa,CAAC,GAAG,CAAU,qBAAqB,CAAC;YAC1D,YAAY,EAAE,IAAI,CAAC,mBAAmB,EAAE;YACxC,aAAa,EAAE,qBAAqB;YACpC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;SAC/B,CACF,CAAC;IACJ,CAAC;IAMD,sBAAsB;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,IAAI,IAAA,qDAAyB,GAAE,EAAE,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8GAA8G;YAC5G,0GAA0G;YAC1G,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAA,0CAAkB,GAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1D,IAAA,0CAAkB,EAAC,SAAS,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IASS,cAAc;QACtB,MAAM,SAAS,GAAI,IAAI,CAAC,SAAkF;YACxG,EAAE,SAAS,CAAC;QACd,MAAM,iBAAiB,GAAG,SAAS,EAAE,iBAAiB,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACvC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC;QAC5D,MAAM,iBAAiB,GAAG,iBAAiB;YACzC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,4BAAgB,EAAE,4CAAmB,CAAC,IAAI,iBAAiB,CAAC,cAAc,CAAC;YAClG,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,qCAAgB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAC1D;YACE,iBAAiB;YACjB,QAAQ;YACR,YAAY,EAAE,IAAA,8BAAe,EAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;YAClE,UAAU,EAAE,GAAG;YACf,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7B,iBAAiB;SAClB,EACD,sBAAa,CAAC,IAAI,CACnB,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAOS,mBAAmB;QAC3B,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,8BAAa,CAAC,GAAG,CAAS,qBAAqB,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5G,MAAM,iBAAiB,GAAI,IAAI,CAAC,SAAkF;YAChH,EAAE,SAAS,EAAE,iBAAiB,CAAC;QACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,qCAAgB,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAC7D;YACE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc;YACpD,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,IAAA,8BAAe,EAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;YAClE,UAAU,EAAE,gBAAgB;YAC5B,iBAAiB;SAClB,EACD,sBAAa,CAAC,IAAI,CACnB,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAGO,cAAc;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,4CAAmB,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAC3D,CAAC;IAOO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,4CAAmB,CAAC,EAAE,CAAC;gBAChD,OAAO,CACL,OAAO,CAAC,WAAW,CAAC,uBAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;oBACvF,OAAO,CAAC,WAAW,CAAC,uBAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAClD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA7JY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAHsB,iDAAqB;QACL,sBAAe;QACrB,gBAAS;QACF,uBAAgB;GAVzD,yBAAyB,CA6JrC"}

package/dist/core/modules/ai/core-ai-mcp.controller.js

@@ -23,6 +23,7 @@ const config_service_1 = require("../../common/services/config.service");
 const core_redis_service_1 = require("../../common/services/core-redis.service");
 const core_better_auth_module_1 = require("../better-auth/core-better-auth.module");
 const error_codes_1 = require("../error-code/error-codes");
+const ai_mcp_oauth_registry_1 = require("./helpers/ai-mcp-oauth.registry");
 const core_ai_mcp_oauth_service_1 = require("./services/core-ai-mcp-oauth.service");
 const core_ai_mcp_service_1 = require("./services/core-ai-mcp.service");
 let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
@@ -43,7 +44,7 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
     async handlePost(req, res) {
         const user = await this.resolveUser(req);
         if (!user?.id) {
-            this.unauthorized(req, res);
+            this.unauthorized(res);
             return;
         }
         const sessionId = req.headers['mcp-session-id'];
@@ -141,7 +142,7 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
     async handleSessionRequest(req, res) {
         const user = await this.resolveUser(req);
         if (!user?.id) {
-            this.unauthorized(req, res);
+            this.unauthorized(res);
             return;
         }
         const sessionId = req.headers['mcp-session-id'];
@@ -243,11 +244,11 @@ let CoreAiMcpController = CoreAiMcpController_1 = class CoreAiMcpController {
             statusCode: 503,
         });
     }
-    unauthorized(req, res) {
-        const baseUrl = `${req.protocol}://${req.get('host')}`;
+    unauthorized(res) {
+        const oauth = (0, ai_mcp_oauth_registry_1.getMountedMcpOAuth)();
         res
             .status(401)
-            .set({ 'WWW-Authenticate': `Bearer resource_metadata="${baseUrl}/ai/mcp"` })
+            .set({ 'WWW-Authenticate': oauth ? `Bearer resource_metadata="${oauth.resourceMetadataUrl}"` : 'Bearer' })
             .json({ error: 'Unauthorized: a valid Bearer token is required' });
     }
     evictIfNeeded(ownerId) {

package/dist/core/modules/ai/core-ai-mcp.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-ai-mcp.controller.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/core-ai-mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,6CAAuE;AAEvE,qCAAmC;AAEnC,6EAAgE;AAChE,4DAAwD;AACxD,yEAAqE;AACrE,iFAA4E;AAC5E,oFAA8E;AAC9E,2DAAsD;AACtD,oFAA6E;AAC7E,wEAAkE;AA0D3D,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAsCX;IACA;IACc;IAvCd,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAYhD,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAShD,kBAAkB,GAAG,EAAE,CAAC;IAGxB,WAAW,GAAG,GAAG,CAAC;IAGhB,UAAU,GAAG,GAAG,IAAA,kBAAQ,GAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAO5C,iBAAiB,GAAG,IAAI,CAAC;IAE5C,YACmB,UAA4B,EAC5B,YAAmC,EACrB,YAA+B;QAF7C,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAuB;QACrB,iBAAY,GAAZ,YAAY,CAAmB;IAC7D,CAAC;IASE,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY,EAAS,GAAa;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAKnE,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,GAAG,SAAS,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAkBD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,6BAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,CAAC,EAAE,6BAA6B,EAAE,GAAG,2CAAa,oDAAoD,EAAC,CAAC,CAAC;YAC3G,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAQb,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAY,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,2CAAa,aAAa,EAAC,CAAC;YACnD,MAAM,SAAS,GAAQ,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAGrG,MAAM,OAAO,GAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAIhC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC5C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,CAAC;YACF,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAGxD,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY,EAAS,GAAa;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY,EAAS,GAAa;QAC1D,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAQS,KAAK,CAAC,WAAW,CAAC,GAAY;QACtC,MAAM,WAAW,GAAI,GAAW,CAAC,IAAI,CAAC;QACtC,IAAI,WAAW,EAAE,EAAE,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAGpF,MAAM,YAAY,GAAG,8CAAoB,CAAC,uBAAuB,EAAE,CAAC;QACpE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QAGD,IAAI,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAOS,mBAAmB,CAAC,IAAS;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,OAAY,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC;IACvC,CAAC;IAKS,YAAY;QACpB,MAAM,GAAG,GAAG,8BAAa,CAAC,GAAG,CAAsB,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IACxD,CAAC;IAKO,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,eAAe,CAAC,SAAmB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAG,GAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAeS,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAc;QACnE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IASS,iBAAiB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,MAAM,EAAE,UAAU,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAGS,eAAe,CAAC,SAAiB,EAAE,MAAc;QACzD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY;aACd,SAAS,EAAE;aACX,GAAG,CACF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EACvD,IAAI,EACJ,IAAI,CAAC,iBAAiB,CACvB;aACA,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAGS,cAAc,CAAC,SAAiB;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY;aACrB,SAAS,EAAE;aACX,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;aAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAWD,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAES,UAAU,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,YAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAOS,cAAc,CAAC,GAAa,EAAE,KAAa;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EACH,mDAAmD,KAAK,uBAAuB,IAAI,CAAC,UAAU,IAAI;gBAClG,+FAA+F;gBAC/F,wEAAwE;YAC1E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAoBO,cAAc,CAAC,GAAa,EAAE,GAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EACH,GAAG,uBAAS,CAAC,mBAAmB,6BAA6B;gBAC7D,6EAA6E;gBAC7E,kFAAkF;gBAClF,8EAA8E;YAChF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAKO,YAAY,CAAC,GAAY,EAAE,GAAa;QAC9C,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,EAAE,kBAAkB,EAAE,6BAA6B,OAAO,UAAU,EAAE,CAAC;aAC3E,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IACvE,CAAC;IAWO,aAAa,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9C,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAKO,aAAa,CAAC,UAAgC;QACpD,IAAI,SAA6B,CAAC;QAClC,IAAI,MAAM,GAAG,QAAQ,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;gBACrC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACxB,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;CACF,CAAA;AA1dY,kDAAmB;AAkDxB;IAPL,IAAA,sBAAY,EAAC;QACZ,WAAW,EACT,wHAAwH;YACxH,4IAA4I;QAC9I,OAAO,EAAE,aAAa;KACvB,CAAC;IACD,IAAA,aAAI,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDA+F3C;AAOK;IALL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,gGAAgG;QAC7G,OAAO,EAAE,kBAAkB;KAC5B,CAAC;IACD,IAAA,YAAG,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAE1C;AAOK;IALL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,yEAAyE;QACtF,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,eAAM,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAE7C;8BAnKU,mBAAmB;IAJ/B,IAAA,uBAAa,EAAC,QAAQ,CAAC;IACvB,IAAA,iBAAO,EAAC,QAAQ,CAAC;IACjB,IAAA,mBAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,uBAAK,EAAC,oBAAQ,CAAC,UAAU,CAAC;IAyCtB,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAFkB,sCAAgB;QACd,iDAAqB;QACN,qCAAgB;GAxCrD,mBAAmB,CA0d/B"}
+{"version":3,"file":"core-ai-mcp.controller.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/core-ai-mcp.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,6CAAuE;AAEvE,qCAAmC;AAEnC,6EAAgE;AAChE,4DAAwD;AACxD,yEAAqE;AACrE,iFAA4E;AAC5E,oFAA8E;AAC9E,2DAAsD;AACtD,2EAAqE;AACrE,oFAA6E;AAC7E,wEAAkE;AA2D3D,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAsCX;IACA;IACc;IAvCd,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAYhD,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAShD,kBAAkB,GAAG,EAAE,CAAC;IAGxB,WAAW,GAAG,GAAG,CAAC;IAGhB,UAAU,GAAG,GAAG,IAAA,kBAAQ,GAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAO5C,iBAAiB,GAAG,IAAI,CAAC;IAE5C,YACmB,UAA4B,EAC5B,YAAmC,EACrB,YAA+B;QAF7C,eAAU,GAAV,UAAU,CAAkB;QAC5B,iBAAY,GAAZ,YAAY,CAAuB;QACrB,iBAAY,GAAZ,YAAY,CAAmB;IAC7D,CAAC;IASE,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAY,EAAS,GAAa;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,IAAI,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAKnE,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,GAAG,SAAS,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YAkBD,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,6BAAkC,CAAC;YACvC,IAAI,CAAC;gBACH,CAAC,EAAE,6BAA6B,EAAE,GAAG,2CAAa,oDAAoD,EAAC,CAAC,CAAC;YAC3G,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAQb,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAY,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,2CAAa,aAAa,EAAC,CAAC;YACnD,MAAM,SAAS,GAAQ,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAGrG,MAAM,OAAO,GAAoB,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAIhC,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;gBACvB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC5C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,CAAC;YACF,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE5B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAGxD,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAOK,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAY,EAAS,GAAa;QACvD,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAQ,GAAY,EAAS,GAAa;QAC1D,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAQS,KAAK,CAAC,WAAW,CAAC,GAAY;QACtC,MAAM,WAAW,GAAI,GAAW,CAAC,IAAI,CAAC;QACtC,IAAI,WAAW,EAAE,EAAE,EAAE,CAAC;YACpB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAGpF,MAAM,YAAY,GAAG,8CAAoB,CAAC,uBAAuB,EAAE,CAAC;QACpE,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBAC5D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QAGD,IAAI,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAOS,mBAAmB,CAAC,IAAS;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,OAAY,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,IAAI,EAAE,MAAM,KAAK,YAAY,CAAC;IACvC,CAAC;IAKS,YAAY;QACpB,MAAM,GAAG,GAAG,8BAAa,CAAC,GAAG,CAAsB,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IACxD,CAAC;IAKO,KAAK,CAAC,oBAAoB,CAAC,GAAY,EAAE,GAAa;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpE,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,eAAe,CAAC,SAAmB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAG,GAAW,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IAeS,KAAK,CAAC,mBAAmB,CAAC,SAAiB,EAAE,MAAc;QACnE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9E,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IASS,iBAAiB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,MAAM,EAAE,UAAU,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAGS,eAAe,CAAC,SAAiB,EAAE,MAAc;QACzD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY;aACd,SAAS,EAAE;aACX,GAAG,CACF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EACvD,IAAI,EACJ,IAAI,CAAC,iBAAiB,CACvB;aACA,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IAGS,cAAc,CAAC,SAAiB;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,YAAY;aACrB,SAAS,EAAE;aACX,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;aAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrB,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAWD,KAAK,CAAC,eAAe;QACnB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAES,UAAU,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,YAAa,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAC7D,CAAC;IAOS,cAAc,CAAC,GAAa,EAAE,KAAa;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EACH,mDAAmD,KAAK,uBAAuB,IAAI,CAAC,UAAU,IAAI;gBAClG,+FAA+F;gBAC/F,wEAAwE;YAC1E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAoBO,cAAc,CAAC,GAAa,EAAE,GAAU;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EACH,GAAG,uBAAS,CAAC,mBAAmB,6BAA6B;gBAC7D,6EAA6E;gBAC7E,kFAAkF;gBAClF,8EAA8E;YAChF,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAUO,YAAY,CAAC,GAAa;QAChC,MAAM,KAAK,GAAG,IAAA,0CAAkB,GAAE,CAAC;QACnC,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,6BAA6B,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;aACzG,IAAI,CAAC,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;IACvE,CAAC;IAWO,aAAa,CAAC,OAAe;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnE,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9C,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAKO,aAAa,CAAC,UAAgC;QACpD,IAAI,SAA6B,CAAC;QAClC,IAAI,MAAM,GAAG,QAAQ,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,GAAG,MAAM,EAAE,CAAC;gBACrC,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;gBACxB,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;CACF,CAAA;AA/dY,kDAAmB;AAkDxB;IAPL,IAAA,sBAAY,EAAC;QACZ,WAAW,EACT,wHAAwH;YACxH,4IAA4I;QAC9I,OAAO,EAAE,aAAa;KACvB,CAAC;IACD,IAAA,aAAI,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;qDA+F3C;AAOK;IALL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,gGAAgG;QAC7G,OAAO,EAAE,kBAAkB;KAC5B,CAAC;IACD,IAAA,YAAG,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAE1C;AAOK;IALL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,yEAAyE;QACtF,OAAO,EAAE,iBAAiB;KAC3B,CAAC;IACD,IAAA,eAAM,GAAE;IACW,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;uDAE7C;8BAnKU,mBAAmB;IAJ/B,IAAA,uBAAa,EAAC,QAAQ,CAAC;IACvB,IAAA,iBAAO,EAAC,QAAQ,CAAC;IACjB,IAAA,mBAAU,EAAC,QAAQ,CAAC;IACpB,IAAA,uBAAK,EAAC,oBAAQ,CAAC,UAAU,CAAC;IAyCtB,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAFkB,sCAAgB;QACd,iDAAqB;QACN,qCAAgB;GAxCrD,mBAAmB,CA+d/B"}

package/dist/core/modules/ai/core-ai.module.d.ts

@@ -1,6 +1,7 @@
 import { DynamicModule, Type } from '@nestjs/common';
 import { CoreAiController } from './core-ai.controller';
 import { CoreAiResolver } from './core-ai.resolver';
+import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service';
 import { CoreAiBudgetService } from './services/core-ai-budget.service';
 import { CoreAiConnectionPreferenceService } from './services/core-ai-connection-preference.service';
 import { CoreAiConnectionResolverService } from './services/core-ai-connection-resolver.service';
@@ -25,6 +26,7 @@ export interface CoreAiModuleOptions {
     conversationService?: Type<CoreAiConversationService>;
     interactionService?: Type<CoreAiInteractionService>;
     mcpEnabled?: boolean;
+    mcpOAuthService?: Type<CoreAiMcpOAuthService>;
     preferenceService?: Type<CoreAiConnectionPreferenceService>;
     placeholderRegistry?: Type<CoreAiPlaceholderRegistry>;
     promptBuilder?: Type<CoreAiPromptBuilderService>;

package/dist/core/modules/ai/core-ai.module.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreAiModule = void 0;
 const common_1 = require("@nestjs/common");
 const mongoose_1 = require("@nestjs/mongoose");
+const core_ai_mcp_oauth_initializer_1 = require("./core-ai-mcp-oauth.initializer");
 const core_ai_mcp_controller_1 = require("./core-ai-mcp.controller");
 const core_ai_controller_1 = require("./core-ai.controller");
 const core_ai_resolver_1 = require("./core-ai.resolver");
@@ -68,9 +69,12 @@ let CoreAiModule = CoreAiModule_1 = class CoreAiModule {
         const ToolPolicyServiceClass = options.toolPolicyService || core_ai_tool_policy_service_1.CoreAiToolPolicyService;
         const ModeServiceClass = options.modeService || core_ai_mode_service_1.CoreAiModeService;
         const McpClientServiceClass = options.mcpClientService || core_ai_mcp_client_service_1.CoreAiMcpClientService;
+        const McpOAuthServiceClass = options.mcpOAuthService || core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService;
         const controllers = [ControllerClass];
+        const mcpProviders = [];
         if (options.mcpEnabled) {
             controllers.push(core_ai_mcp_controller_1.CoreAiMcpController);
+            mcpProviders.push(core_ai_mcp_oauth_initializer_1.CoreAiMcpOAuthInitializer);
         }
         return {
             controllers,
@@ -137,7 +141,7 @@ let CoreAiModule = CoreAiModule_1 = class CoreAiModule {
                 { provide: core_ai_conversation_service_1.CoreAiConversationService, useClass: ConversationServiceClass },
                 { provide: core_ai_interaction_service_1.CoreAiInteractionService, useClass: InteractionServiceClass },
                 core_ai_mcp_service_1.CoreAiMcpService,
-                core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService,
+                ...mcpProviders,
                 { provide: core_ai_connection_preference_service_1.CoreAiConnectionPreferenceService, useClass: PreferenceServiceClass },
                 { provide: core_ai_connection_resolver_service_1.CoreAiConnectionResolverService, useClass: ConnectionResolverClass },
                 { provide: core_ai_connection_service_1.CoreAiConnectionService, useClass: ConnectionServiceClass },
@@ -151,6 +155,7 @@ let CoreAiModule = CoreAiModule_1 = class CoreAiModule {
                 { provide: core_ai_tool_policy_service_1.CoreAiToolPolicyService, useClass: ToolPolicyServiceClass },
                 { provide: core_ai_mode_service_1.CoreAiModeService, useClass: ModeServiceClass },
                 { provide: core_ai_mcp_client_service_1.CoreAiMcpClientService, useClass: McpClientServiceClass },
+                { provide: core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService, useClass: McpOAuthServiceClass },
                 ResolverClass,
             ],
         };

package/dist/core/modules/ai/core-ai.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-ai.module.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/core-ai.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAqE;AACrE,+CAAkD;AAElD,qEAA+D;AAC/D,6DAAwD;AACxD,yDAAoD;AACpD,oFAA6E;AAC7E,wEAAkE;AAClE,oFAA6F;AAC7F,sGAAwH;AACxH,gFAAyF;AACzF,oFAA+F;AAC/F,kFAA4F;AAC5F,kFAA0F;AAC1F,wEAA6E;AAC7E,oEAAuE;AACvE,oEAAuE;AACvE,gFAAuF;AACvF,kFAA0F;AAC1F,2EAAsE;AACtE,oEAA+D;AAC/D,8EAAsH;AACtH,4GAI0D;AAC1D,wGAAiG;AACjG,sFAI+C;AAC/C,0FAIiD;AACjD,wFAIgD;AAChD,0FAAoF;AACpF,8FAAuF;AACvF,wFAIgD;AAChD,8EAA0G;AAC1G,0EAAkG;AAClG,sFAI+C;AAC/C,wFAIgD;AAChD,0EAAkG;AAClG,sFAA+E;AAC/E,gEAA2D;AAC3D,+DAA0D;AAC1D,2EAAuE;AACvE,iEAA8D;AAC9D,+DAA0D;AAwFnD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACvB,MAAM,CAAC,OAAO,CAAC,UAA+B,EAAE;QAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,4CAAmB,CAAC;QACxE,MAAM,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,qEAA+B,CAAC;QAC9F,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,oDAAuB,CAAC;QACpF,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,qCAAgB,CAAC;QAC/D,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,IAAI,wDAAyB,CAAC;QAC1F,MAAM,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,sDAAwB,CAAC;QACvF,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,yEAAiC,CAAC;QAC9F,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,IAAI,wDAAyB,CAAC;QAC1F,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,2DAA0B,CAAC;QAC/E,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qDAAuB,CAAC;QACpF,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,4CAAmB,CAAC;QACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,IAAI,wCAAiB,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,iCAAc,CAAC;QACzD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,+BAAa,CAAC;QACtD,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mDAAsB,CAAC;QACjF,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qDAAuB,CAAC;QACpF,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,IAAI,wCAAiB,CAAC;QAClE,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mDAAsB,CAAC;QAGjF,MAAM,WAAW,GAAgB,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,4CAAmB,CAAC,CAAC;QACxC,CAAC;QAED,OAAO;YACL,WAAW;YACX,OAAO,EAAE;gBACP,mCAAe;gBACf,iCAAc;gBACd,iCAAc;gBACd,4CAAmB;gBACnB,yEAAiC;gBACjC,qEAA+B;gBAC/B,oDAAuB;gBACvB,wDAAyB;gBACzB,sDAAwB;gBACxB,iDAAqB;gBACrB,sCAAgB;gBAChB,wDAAyB;gBACzB,2DAA0B;gBAC1B,qDAAuB;gBACvB,4CAAmB;gBACnB,wCAAiB;gBACjB,+BAAa;gBACb,mDAAsB;gBACtB,qDAAuB;gBACvB,wCAAiB;gBACjB,mDAAsB;gBACtB,yCAAkB;gBAClB,yBAAc;aACf;YACD,OAAO,EAAE;gBACP,yBAAc,CAAC,UAAU,CAAC;oBACxB,EAAE,IAAI,EAAE,8CAAqB,EAAE,MAAM,EAAE,gDAAmB,EAAE;oBAC5D,EAAE,IAAI,EAAE,gDAAmB,EAAE,MAAM,EAAE,6CAAkB,EAAE;oBACzD,EAAE,IAAI,EAAE,sEAA8B,EAAE,MAAM,EAAE,kEAA4B,EAAE;oBAC9E,EAAE,IAAI,EAAE,oDAAqB,EAAE,MAAM,EAAE,iDAAoB,EAAE;oBAC7D,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,+CAAmB,EAAE;oBAC3D,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,8CAAkB,EAAE;oBAC1D,EAAE,IAAI,EAAE,wCAAe,EAAE,MAAM,EAAE,qCAAc,EAAE;oBACjD,EAAE,IAAI,EAAE,oCAAa,EAAE,MAAM,EAAE,iCAAY,EAAE;oBAC7C,EAAE,IAAI,EAAE,gDAAmB,EAAE,MAAM,EAAE,4CAAiB,EAAE;oBACxD,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,8CAAkB,EAAE;oBAC1D,EAAE,IAAI,EAAE,oCAAa,EAAE,MAAM,EAAE,iCAAY,EAAE;iBAC9C,CAAC;aACH;YACD,MAAM,EAAE,cAAY;YACpB,SAAS,EAAE;gBACT,mCAAe;gBACf,iCAAc;gBACd,iCAAc;gBACd,8CAAqB;gBACrB,qCAAiB;gBACjB,yCAAkB;gBAClB,EAAE,OAAO,EAAE,8CAAqB,EAAE,QAAQ,EAAE,8CAAiB,EAAE;gBAC/D,EAAE,OAAO,EAAE,gDAAmB,EAAE,QAAQ,EAAE,2CAAgB,EAAE;gBAC5D,EAAE,OAAO,EAAE,sEAA8B,EAAE,QAAQ,EAAE,gEAA0B,EAAE;gBACjF,EAAE,OAAO,EAAE,oDAAqB,EAAE,QAAQ,EAAE,+CAAkB,EAAE;gBAChE,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,6CAAiB,EAAE;gBAC9D,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,4CAAgB,EAAE;gBAC7D,EAAE,OAAO,EAAE,wCAAe,EAAE,QAAQ,EAAE,mCAAY,EAAE;gBACpD,EAAE,OAAO,EAAE,oCAAa,EAAE,QAAQ,EAAE,+BAAU,EAAE;gBAChD,EAAE,OAAO,EAAE,gDAAmB,EAAE,QAAQ,EAAE,0CAAe,EAAE;gBAC3D,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,4CAAgB,EAAE;gBAC7D,EAAE,OAAO,EAAE,oCAAa,EAAE,QAAQ,EAAE,+BAAU,EAAE;gBAChD,EAAE,OAAO,EAAE,4CAAmB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBAC9D,EAAE,OAAO,EAAE,wDAAyB,EAAE,QAAQ,EAAE,wBAAwB,EAAE;gBAC1E,EAAE,OAAO,EAAE,sDAAwB,EAAE,QAAQ,EAAE,uBAAuB,EAAE;gBACxE,sCAAgB;gBAChB,iDAAqB;gBAGrB,EAAE,OAAO,EAAE,yEAAiC,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBAChF,EAAE,OAAO,EAAE,qEAA+B,EAAE,QAAQ,EAAE,uBAAuB,EAAE;gBAC/E,EAAE,OAAO,EAAE,oDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,wDAAyB,EAAE,QAAQ,EAAE,wBAAwB,EAAE;gBAC1E,EAAE,OAAO,EAAE,2DAA0B,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBACrE,EAAE,OAAO,EAAE,qDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,4CAAmB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBAC9D,EAAE,OAAO,EAAE,wCAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,EAAE,OAAO,EAAE,+BAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;gBAClD,EAAE,OAAO,EAAE,mDAAsB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;gBACpE,EAAE,OAAO,EAAE,qDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,wCAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,EAAE,OAAO,EAAE,mDAAsB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;gBACpE,aAAa;aACd;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhHY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,YAAY,CAgHxB"}
+{"version":3,"file":"core-ai.module.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/core-ai.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAqE;AACrE,+CAAkD;AAElD,mFAA4E;AAC5E,qEAA+D;AAC/D,6DAAwD;AACxD,yDAAoD;AACpD,oFAA6E;AAC7E,wEAAkE;AAClE,oFAA6F;AAC7F,sGAAwH;AACxH,gFAAyF;AACzF,oFAA+F;AAC/F,kFAA4F;AAC5F,kFAA0F;AAC1F,wEAA6E;AAC7E,oEAAuE;AACvE,oEAAuE;AACvE,gFAAuF;AACvF,kFAA0F;AAC1F,2EAAsE;AACtE,oEAA+D;AAC/D,8EAAsH;AACtH,4GAI0D;AAC1D,wGAAiG;AACjG,sFAI+C;AAC/C,0FAIiD;AACjD,wFAIgD;AAChD,0FAAoF;AACpF,8FAAuF;AACvF,wFAIgD;AAChD,8EAA0G;AAC1G,0EAAkG;AAClG,sFAI+C;AAC/C,wFAIgD;AAChD,0EAAkG;AAClG,sFAA+E;AAC/E,gEAA2D;AAC3D,+DAA0D;AAC1D,2EAAuE;AACvE,iEAA8D;AAC9D,+DAA0D;AA8FnD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACvB,MAAM,CAAC,OAAO,CAAC,UAA+B,EAAE;QAC9C,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,4CAAmB,CAAC;QACxE,MAAM,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,qEAA+B,CAAC;QAC9F,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,oDAAuB,CAAC;QACpF,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,IAAI,qCAAgB,CAAC;QAC/D,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,IAAI,wDAAyB,CAAC;QAC1F,MAAM,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,IAAI,sDAAwB,CAAC;QACvF,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,yEAAiC,CAAC;QAC9F,MAAM,wBAAwB,GAAG,OAAO,CAAC,mBAAmB,IAAI,wDAAyB,CAAC;QAC1F,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,2DAA0B,CAAC;QAC/E,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qDAAuB,CAAC;QACpF,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,IAAI,4CAAmB,CAAC;QACxE,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,IAAI,wCAAiB,CAAC;QAClE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,IAAI,iCAAc,CAAC;QACzD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,+BAAa,CAAC;QACtD,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mDAAsB,CAAC;QACjF,MAAM,sBAAsB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qDAAuB,CAAC;QACpF,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,IAAI,wCAAiB,CAAC;QAClE,MAAM,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mDAAsB,CAAC;QACjF,MAAM,oBAAoB,GAAG,OAAO,CAAC,eAAe,IAAI,iDAAqB,CAAC;QAI9E,MAAM,WAAW,GAAgB,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,YAAY,GAAgB,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,WAAW,CAAC,IAAI,CAAC,4CAAmB,CAAC,CAAC;YACtC,YAAY,CAAC,IAAI,CAAC,yDAAyB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO;YACL,WAAW;YACX,OAAO,EAAE;gBACP,mCAAe;gBACf,iCAAc;gBACd,iCAAc;gBACd,4CAAmB;gBACnB,yEAAiC;gBACjC,qEAA+B;gBAC/B,oDAAuB;gBACvB,wDAAyB;gBACzB,sDAAwB;gBACxB,iDAAqB;gBACrB,sCAAgB;gBAChB,wDAAyB;gBACzB,2DAA0B;gBAC1B,qDAAuB;gBACvB,4CAAmB;gBACnB,wCAAiB;gBACjB,+BAAa;gBACb,mDAAsB;gBACtB,qDAAuB;gBACvB,wCAAiB;gBACjB,mDAAsB;gBACtB,yCAAkB;gBAClB,yBAAc;aACf;YACD,OAAO,EAAE;gBACP,yBAAc,CAAC,UAAU,CAAC;oBACxB,EAAE,IAAI,EAAE,8CAAqB,EAAE,MAAM,EAAE,gDAAmB,EAAE;oBAC5D,EAAE,IAAI,EAAE,gDAAmB,EAAE,MAAM,EAAE,6CAAkB,EAAE;oBACzD,EAAE,IAAI,EAAE,sEAA8B,EAAE,MAAM,EAAE,kEAA4B,EAAE;oBAC9E,EAAE,IAAI,EAAE,oDAAqB,EAAE,MAAM,EAAE,iDAAoB,EAAE;oBAC7D,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,+CAAmB,EAAE;oBAC3D,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,8CAAkB,EAAE;oBAC1D,EAAE,IAAI,EAAE,wCAAe,EAAE,MAAM,EAAE,qCAAc,EAAE;oBACjD,EAAE,IAAI,EAAE,oCAAa,EAAE,MAAM,EAAE,iCAAY,EAAE;oBAC7C,EAAE,IAAI,EAAE,gDAAmB,EAAE,MAAM,EAAE,4CAAiB,EAAE;oBACxD,EAAE,IAAI,EAAE,kDAAoB,EAAE,MAAM,EAAE,8CAAkB,EAAE;oBAC1D,EAAE,IAAI,EAAE,oCAAa,EAAE,MAAM,EAAE,iCAAY,EAAE;iBAC9C,CAAC;aACH;YACD,MAAM,EAAE,cAAY;YACpB,SAAS,EAAE;gBACT,mCAAe;gBACf,iCAAc;gBACd,iCAAc;gBACd,8CAAqB;gBACrB,qCAAiB;gBACjB,yCAAkB;gBAClB,EAAE,OAAO,EAAE,8CAAqB,EAAE,QAAQ,EAAE,8CAAiB,EAAE;gBAC/D,EAAE,OAAO,EAAE,gDAAmB,EAAE,QAAQ,EAAE,2CAAgB,EAAE;gBAC5D,EAAE,OAAO,EAAE,sEAA8B,EAAE,QAAQ,EAAE,gEAA0B,EAAE;gBACjF,EAAE,OAAO,EAAE,oDAAqB,EAAE,QAAQ,EAAE,+CAAkB,EAAE;gBAChE,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,6CAAiB,EAAE;gBAC9D,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,4CAAgB,EAAE;gBAC7D,EAAE,OAAO,EAAE,wCAAe,EAAE,QAAQ,EAAE,mCAAY,EAAE;gBACpD,EAAE,OAAO,EAAE,oCAAa,EAAE,QAAQ,EAAE,+BAAU,EAAE;gBAChD,EAAE,OAAO,EAAE,gDAAmB,EAAE,QAAQ,EAAE,0CAAe,EAAE;gBAC3D,EAAE,OAAO,EAAE,kDAAoB,EAAE,QAAQ,EAAE,4CAAgB,EAAE;gBAC7D,EAAE,OAAO,EAAE,oCAAa,EAAE,QAAQ,EAAE,+BAAU,EAAE;gBAChD,EAAE,OAAO,EAAE,4CAAmB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBAC9D,EAAE,OAAO,EAAE,wDAAyB,EAAE,QAAQ,EAAE,wBAAwB,EAAE;gBAC1E,EAAE,OAAO,EAAE,sDAAwB,EAAE,QAAQ,EAAE,uBAAuB,EAAE;gBACxE,sCAAgB;gBAChB,GAAG,YAAY;gBAGf,EAAE,OAAO,EAAE,yEAAiC,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBAChF,EAAE,OAAO,EAAE,qEAA+B,EAAE,QAAQ,EAAE,uBAAuB,EAAE;gBAC/E,EAAE,OAAO,EAAE,oDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,wDAAyB,EAAE,QAAQ,EAAE,wBAAwB,EAAE;gBAC1E,EAAE,OAAO,EAAE,2DAA0B,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBACrE,EAAE,OAAO,EAAE,qDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,4CAAmB,EAAE,QAAQ,EAAE,kBAAkB,EAAE;gBAC9D,EAAE,OAAO,EAAE,wCAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,EAAE,OAAO,EAAE,+BAAa,EAAE,QAAQ,EAAE,YAAY,EAAE;gBAClD,EAAE,OAAO,EAAE,mDAAsB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;gBACpE,EAAE,OAAO,EAAE,qDAAuB,EAAE,QAAQ,EAAE,sBAAsB,EAAE;gBACtE,EAAE,OAAO,EAAE,wCAAiB,EAAE,QAAQ,EAAE,gBAAgB,EAAE;gBAC1D,EAAE,OAAO,EAAE,mDAAsB,EAAE,QAAQ,EAAE,qBAAqB,EAAE;gBACpE,EAAE,OAAO,EAAE,iDAAqB,EAAE,QAAQ,EAAE,oBAAoB,EAAE;gBAClE,aAAa;aACd;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AArHY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,YAAY,CAqHxB"}

package/dist/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.d.ts

@@ -0,0 +1,33 @@
+export interface IMcpOAuthConsentView {
+    appHost: string;
+    authBasePath?: string;
+    client: {
+        id: string;
+        name?: string;
+    };
+    csrfToken?: string;
+    notice?: 'expired';
+    locale: McpOAuthConsentLocale;
+    loginUrl?: {
+        href: string;
+        returnsHere: boolean;
+    };
+    nonce: string;
+    oauthParams: Record<string, string>;
+    redirect: {
+        host: string;
+        loopback: boolean;
+    };
+    user?: {
+        email?: string;
+        name?: string;
+    };
+}
+export type McpOAuthConsentLocale = 'de' | 'en';
+export declare const MCP_OAUTH_CONSENT_DECISION_FIELD = "lt_mcp_consent";
+export declare const MCP_OAUTH_CONSENT_TOKEN_FIELD = "lt_mcp_csrf";
+export declare function mcpOAuthConsentLocale(acceptLanguage: unknown): McpOAuthConsentLocale;
+export declare function mcpOAuthConsentHeaders(nonce: string): Record<string, string>;
+export declare function renderMcpOAuthConsentPage(view: IMcpOAuthConsentView): string;
+export declare const MCP_OAUTH_CONSENT_GUARD_SCRIPT = "(function () {\n  var allow = document.getElementById('lt-mcp-allow');\n  if (allow) {\n    var since = 0;\n    var armed = false;\n    var reset = function () { since = 0; armed = false; };\n    var watch = function () {\n      if (document.visibilityState === 'visible' && document.hasFocus()) { if (!since) { since = Date.now(); } } else { reset(); }\n    };\n    var intent = function (event) {\n      watch();\n      var stationaryClick = event.type === 'pointerdown' && event.pointerType === 'mouse';\n      if (since && !stationaryClick && Date.now() - since >= 600) { armed = true; }\n    };\n    window.addEventListener('blur', reset);\n    window.addEventListener('focus', watch);\n    document.addEventListener('visibilitychange', function () { if (document.visibilityState === 'visible') { watch(); } else { reset(); } });\n    document.addEventListener('pointermove', intent);\n    document.addEventListener('pointerdown', intent);\n    document.addEventListener('keydown', intent);\n    allow.addEventListener('click', function (event) { if (!armed) { event.preventDefault(); } });\n    allow.disabled = false;\n    watch();\n  }\n  var other = document.getElementById('lt-mcp-switch');\n  if (other) {\n    other.addEventListener('click', function (event) {\n      event.preventDefault();\n      var done = function () { location.reload(); };\n      fetch(other.getAttribute('data-sign-out'), { body: '{}', credentials: 'same-origin', headers: { 'content-type': 'application/json' }, method: 'POST' }).then(done, done);\n    });\n  }\n})();";
+export declare const MCP_OAUTH_CONSENT_SCRIPT = "(function () {\n  var root = document.getElementById('lt-mcp-signin');\n  if (!root) { return; }\n  var base = root.getAttribute('data-auth-base');\n  var passwordForm = document.getElementById('lt-mcp-password');\n  var factorForm = document.getElementById('lt-mcp-second-factor');\n  var error = document.getElementById('lt-mcp-error');\n  // Both forms are rendered hidden and with method=\"post\": without this script nothing can be\n  // submitted, and nothing would ever put the password into a URL.\n  passwordForm.hidden = false;\n  function fail(message) { error.textContent = message; error.hidden = false; }\n  function post(path, body) {\n    return fetch(base + path, {\n      body: JSON.stringify(body),\n      credentials: 'same-origin',\n      headers: { 'content-type': 'application/json' },\n      method: 'POST'\n    }).then(function (response) {\n      return response.json().then(function (json) { return json; }, function () { return {}; }).then(function (json) {\n        return { body: json || {}, ok: response.ok };\n      });\n    });\n  }\n  passwordForm.addEventListener('submit', function (event) {\n    event.preventDefault();\n    error.hidden = true;\n    post('/sign-in/email', { email: passwordForm.elements.email.value, password: passwordForm.elements.password.value })\n      .then(function (result) {\n        if (result.body.requiresTwoFactor || result.body.twoFactorRedirect) {\n          passwordForm.hidden = true;\n          factorForm.hidden = false;\n          return;\n        }\n        if (!result.ok) { fail(root.getAttribute('data-sign-in-failed')); return; }\n        location.reload();\n      }, function () { fail(root.getAttribute('data-sign-in-failed')); });\n  });\n  factorForm.addEventListener('submit', function (event) {\n    event.preventDefault();\n    error.hidden = true;\n    var path = factorForm.elements.backup.checked ? '/two-factor/verify-backup-code' : '/two-factor/verify-totp';\n    post(path, { code: factorForm.elements.code.value })\n      .then(function (result) {\n        if (!result.ok) { fail(root.getAttribute('data-code-failed')); return; }\n        location.reload();\n      }, function () { fail(root.getAttribute('data-code-failed')); });\n  });\n})();";