@lenne.tech/nest-server 11.42.16 → 11.43.1

package/dist/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.js

@@ -0,0 +1,282 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_OAUTH_CONSENT_SCRIPT = exports.MCP_OAUTH_CONSENT_GUARD_SCRIPT = exports.MCP_OAUTH_CONSENT_TOKEN_FIELD = exports.MCP_OAUTH_CONSENT_DECISION_FIELD = void 0;
+exports.mcpOAuthConsentLocale = mcpOAuthConsentLocale;
+exports.mcpOAuthConsentHeaders = mcpOAuthConsentHeaders;
+exports.renderMcpOAuthConsentPage = renderMcpOAuthConsentPage;
+exports.MCP_OAUTH_CONSENT_DECISION_FIELD = 'lt_mcp_consent';
+exports.MCP_OAUTH_CONSENT_TOKEN_FIELD = 'lt_mcp_csrf';
+const TEXTS = {
+    de: {
+        allow: 'Zulassen',
+        approveNoscript: 'Zum Bestätigen wird JavaScript benötigt.',
+        backupCode: 'Backup-Code verwenden',
+        code: 'Bestätigungscode',
+        codeFailed: 'Der Code ist ungültig.',
+        codeHint: 'Gib den Code aus deiner Authenticator-App ein.',
+        confirm: 'Bestätigen',
+        continue: 'Ich habe mich angemeldet – weiter',
+        deny: 'Ablehnen',
+        email: 'E-Mail',
+        expired: 'Die Seite war zu lange geöffnet. Bitte bestätige noch einmal.',
+        intro: '{client} möchte über MCP in deinem Namen auf {app} zugreifen – mit deinen Rechten.',
+        loopback: 'eine Anwendung auf diesem Computer',
+        noscript: 'Für die Anmeldung wird JavaScript benötigt.',
+        noSignIn: 'Auf diesem Server ist keine Anmeldung für MCP-Clients eingerichtet.',
+        otherMethod: 'Mit Passkey oder einem anderen Verfahren anmelden',
+        password: 'Passwort',
+        signedInAs: 'Angemeldet als {user}',
+        switchAccount: 'Anderes Konto',
+        signIn: 'Anmelden',
+        signInFailed: 'Anmeldung fehlgeschlagen. Bitte prüfe E-Mail und Passwort.',
+        signInIntro: 'Melde dich bei {app} an, um {client} den Zugriff zu erlauben.',
+        target: 'Die Freigabe geht an:',
+        title: 'Zugriff erlauben',
+        unnamedClient: 'Eine unbenannte Anwendung',
+        warning: 'Erlaube den Zugriff nur, wenn du die Verbindung gerade selbst gestartet hast.',
+    },
+    en: {
+        allow: 'Allow',
+        approveNoscript: 'Confirming requires JavaScript.',
+        backupCode: 'Use a backup code',
+        code: 'Verification code',
+        codeFailed: 'The code is invalid.',
+        codeHint: 'Enter the code from your authenticator app.',
+        confirm: 'Confirm',
+        continue: 'I have signed in – continue',
+        deny: 'Deny',
+        email: 'Email',
+        expired: 'This page was open for too long. Please confirm again.',
+        intro: '{client} wants to access {app} on your behalf through MCP – with your permissions.',
+        loopback: 'an application on this computer',
+        noscript: 'Signing in requires JavaScript.',
+        noSignIn: 'Sign-in for MCP clients is not set up on this server.',
+        otherMethod: 'Sign in with a passkey or another method',
+        password: 'Password',
+        signedInAs: 'Signed in as {user}',
+        switchAccount: 'Use another account',
+        signIn: 'Sign in',
+        signInFailed: 'Sign-in failed. Please check your email and password.',
+        signInIntro: 'Sign in to {app} to allow {client} access.',
+        target: 'Access is granted to:',
+        title: 'Allow access',
+        unnamedClient: 'An unnamed application',
+        warning: 'Only allow access if you just started this connection yourself.',
+    },
+};
+function mcpOAuthConsentLocale(acceptLanguage) {
+    const first = typeof acceptLanguage === 'string' ? acceptLanguage.split(',')[0].trim().toLowerCase() : '';
+    return first.startsWith('de') ? 'de' : 'en';
+}
+function mcpOAuthConsentHeaders(nonce) {
+    return {
+        'Cache-Control': 'no-store',
+        'Content-Security-Policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; ` +
+            "img-src 'self' data:; base-uri 'none'; frame-ancestors 'none'",
+        'Content-Type': 'text/html; charset=utf-8',
+        'Referrer-Policy': 'no-referrer',
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY',
+    };
+}
+function renderMcpOAuthConsentPage(view) {
+    const t = TEXTS[view.locale];
+    const clientName = view.client.name?.trim() || t.unnamedClient;
+    const fill = (text) => escapeHtml(text).replace(/\{(client|app)\}/g, (_, key) => `<strong>${escapeHtml(key === 'client' ? clientName : view.appHost)}</strong>`);
+    const body = view.user ? consentView(view, t, fill) : signInView(view, t, fill);
+    return `<!doctype html>
+<html lang="${view.locale}">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<link rel="icon" href="data:,">
+<title>${escapeHtml(t.title)} – ${escapeHtml(view.appHost)}</title>
+<style nonce="${escapeHtml(view.nonce)}">${STYLES}</style>
+</head>
+<body>
+<main class="card">
+${body}
+</main>
+${pageScript(view)}
+</body>
+</html>
+`;
+}
+function consentView(view, t, fill) {
+    const target = view.redirect.loopback
+        ? `${escapeHtml(t.loopback)} (${escapeHtml(view.redirect.host)})`
+        : escapeHtml(view.redirect.host);
+    const who = view.user?.email || view.user?.name;
+    const hidden = Object.entries(view.oauthParams)
+        .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
+        .join('\n');
+    const account = who
+        ? `<p class="account">${escapeHtml(t.signedInAs).replace('{user}', () => `<strong>${escapeHtml(who)}</strong>`)}${view.authBasePath
+            ? `<a href="" id="lt-mcp-switch" class="switch" data-sign-out="${escapeHtml(`${view.authBasePath}/sign-out`)}">${escapeHtml(t.switchAccount)}</a>`
+            : ''}</p>`
+        : '';
+    return `<h1>${escapeHtml(t.title)}</h1>
+${account}
+${view.notice === 'expired' ? `<p class="notice" role="alert">${escapeHtml(t.expired)}</p>` : ''}
+<p>${fill(t.intro)}</p>
+<p class="target">${escapeHtml(t.target)} <strong>${target}</strong></p>
+<p class="warning">${escapeHtml(t.warning)}</p>
+<noscript><p class="notice">${escapeHtml(t.approveNoscript)}</p></noscript>
+<form method="post" action="authorize" class="actions">
+${hidden}
+<input type="hidden" name="${exports.MCP_OAUTH_CONSENT_TOKEN_FIELD}" value="${escapeHtml(view.csrfToken ?? '')}">
+<button type="submit" name="${exports.MCP_OAUTH_CONSENT_DECISION_FIELD}" value="deny" class="secondary">${escapeHtml(t.deny)}</button>
+<button type="submit" name="${exports.MCP_OAUTH_CONSENT_DECISION_FIELD}" value="approve" class="primary" id="lt-mcp-allow" disabled>${escapeHtml(t.allow)}</button>
+</form>`;
+}
+function pageScript(view) {
+    const script = view.user ? exports.MCP_OAUTH_CONSENT_GUARD_SCRIPT : view.authBasePath ? exports.MCP_OAUTH_CONSENT_SCRIPT : '';
+    return script ? `<script nonce="${escapeHtml(view.nonce)}">${script}</script>` : '';
+}
+function signInView(view, t, fill) {
+    const other = view.loginUrl
+        ? `<div class="other">
+<a href="${escapeHtml(view.loginUrl.href)}"${view.loginUrl.returnsHere ? '' : ' target="_blank" rel="noopener noreferrer"'}>${escapeHtml(t.otherMethod)}</a>
+${view.loginUrl.returnsHere ? '' : `<a href="" class="continue">${escapeHtml(t.continue)}</a>`}
+</div>`
+        : '';
+    if (!view.authBasePath) {
+        return `<h1>${escapeHtml(t.signIn)}</h1>
+<p>${escapeHtml(t.noSignIn)}</p>
+${other}`;
+    }
+    return `<h1>${escapeHtml(t.signIn)}</h1>
+<p>${fill(t.signInIntro)}</p>
+<noscript><p class="notice">${escapeHtml(t.noscript)}</p></noscript>
+<div id="lt-mcp-signin" data-auth-base="${escapeHtml(view.authBasePath)}" data-sign-in-failed="${escapeHtml(t.signInFailed)}" data-code-failed="${escapeHtml(t.codeFailed)}">
+<form id="lt-mcp-password" method="post" hidden>
+<label>${escapeHtml(t.email)}<input name="email" type="email" autocomplete="username" required></label>
+<label>${escapeHtml(t.password)}<input name="password" type="password" autocomplete="current-password" required></label>
+<button type="submit" class="primary">${escapeHtml(t.signIn)}</button>
+</form>
+<form id="lt-mcp-second-factor" method="post" hidden>
+<p class="muted">${escapeHtml(t.codeHint)}</p>
+<label>${escapeHtml(t.code)}<input name="code" autocomplete="one-time-code" inputmode="numeric" required></label>
+<label class="inline"><input name="backup" type="checkbox"> ${escapeHtml(t.backupCode)}</label>
+<button type="submit" class="primary">${escapeHtml(t.confirm)}</button>
+</form>
+<p id="lt-mcp-error" class="notice" role="alert" hidden></p>
+</div>
+${other}`;
+}
+exports.MCP_OAUTH_CONSENT_GUARD_SCRIPT = `(function () {
+  var allow = document.getElementById('lt-mcp-allow');
+  if (allow) {
+    var since = 0;
+    var armed = false;
+    var reset = function () { since = 0; armed = false; };
+    var watch = function () {
+      if (document.visibilityState === 'visible' && document.hasFocus()) { if (!since) { since = Date.now(); } } else { reset(); }
+    };
+    var intent = function (event) {
+      watch();
+      var stationaryClick = event.type === 'pointerdown' && event.pointerType === 'mouse';
+      if (since && !stationaryClick && Date.now() - since >= 600) { armed = true; }
+    };
+    window.addEventListener('blur', reset);
+    window.addEventListener('focus', watch);
+    document.addEventListener('visibilitychange', function () { if (document.visibilityState === 'visible') { watch(); } else { reset(); } });
+    document.addEventListener('pointermove', intent);
+    document.addEventListener('pointerdown', intent);
+    document.addEventListener('keydown', intent);
+    allow.addEventListener('click', function (event) { if (!armed) { event.preventDefault(); } });
+    allow.disabled = false;
+    watch();
+  }
+  var other = document.getElementById('lt-mcp-switch');
+  if (other) {
+    other.addEventListener('click', function (event) {
+      event.preventDefault();
+      var done = function () { location.reload(); };
+      fetch(other.getAttribute('data-sign-out'), { body: '{}', credentials: 'same-origin', headers: { 'content-type': 'application/json' }, method: 'POST' }).then(done, done);
+    });
+  }
+})();`;
+exports.MCP_OAUTH_CONSENT_SCRIPT = `(function () {
+  var root = document.getElementById('lt-mcp-signin');
+  if (!root) { return; }
+  var base = root.getAttribute('data-auth-base');
+  var passwordForm = document.getElementById('lt-mcp-password');
+  var factorForm = document.getElementById('lt-mcp-second-factor');
+  var error = document.getElementById('lt-mcp-error');
+  // Both forms are rendered hidden and with method="post": without this script nothing can be
+  // submitted, and nothing would ever put the password into a URL.
+  passwordForm.hidden = false;
+  function fail(message) { error.textContent = message; error.hidden = false; }
+  function post(path, body) {
+    return fetch(base + path, {
+      body: JSON.stringify(body),
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json' },
+      method: 'POST'
+    }).then(function (response) {
+      return response.json().then(function (json) { return json; }, function () { return {}; }).then(function (json) {
+        return { body: json || {}, ok: response.ok };
+      });
+    });
+  }
+  passwordForm.addEventListener('submit', function (event) {
+    event.preventDefault();
+    error.hidden = true;
+    post('/sign-in/email', { email: passwordForm.elements.email.value, password: passwordForm.elements.password.value })
+      .then(function (result) {
+        if (result.body.requiresTwoFactor || result.body.twoFactorRedirect) {
+          passwordForm.hidden = true;
+          factorForm.hidden = false;
+          return;
+        }
+        if (!result.ok) { fail(root.getAttribute('data-sign-in-failed')); return; }
+        location.reload();
+      }, function () { fail(root.getAttribute('data-sign-in-failed')); });
+  });
+  factorForm.addEventListener('submit', function (event) {
+    event.preventDefault();
+    error.hidden = true;
+    var path = factorForm.elements.backup.checked ? '/two-factor/verify-backup-code' : '/two-factor/verify-totp';
+    post(path, { code: factorForm.elements.code.value })
+      .then(function (result) {
+        if (!result.ok) { fail(root.getAttribute('data-code-failed')); return; }
+        location.reload();
+      }, function () { fail(root.getAttribute('data-code-failed')); });
+  });
+})();`;
+function escapeHtml(value) {
+    return String(value ?? '')
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+const STYLES = `
+:root{color-scheme:light dark;--bg:#f4f5f7;--card:#fff;--text:#1d2129;--muted:#5b6270;--border:#d9dde3;--primary:#1f6feb;--primary-text:#fff;--notice:#b42318}
+@media (prefers-color-scheme:dark){:root{--bg:#0f1115;--card:#181b21;--text:#e6e8eb;--muted:#9aa1ad;--border:#2c313a;--primary:#4c8dff;--notice:#ff8a80}}
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:16px;background:var(--bg);color:var(--text);font:15px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+.card{width:100%;max-width:440px;background:var(--card);border:1px solid var(--border);border-radius:12px;padding:28px}
+h1{font-size:20px;margin:0 0 16px}
+p{margin:0 0 12px}
+.muted{color:var(--muted)}
+.account{padding:8px 10px;border:1px solid var(--border);border-radius:8px;font-size:14px}
+.account .switch{display:block;margin-top:4px}
+button:disabled{opacity:.6;cursor:default}
+.target strong{overflow-wrap:anywhere}
+.warning{color:var(--muted);font-size:13px;border-left:3px solid var(--border);padding-left:10px}
+.notice{color:var(--notice)}
+label{display:block;margin:0 0 12px;font-size:13px;color:var(--muted)}
+label.inline{display:flex;gap:8px;align-items:center}
+input:not([type=checkbox]){display:block;width:100%;margin-top:4px;padding:9px 10px;border:1px solid var(--border);border-radius:8px;background:transparent;color:var(--text);font:inherit}
+.actions{display:flex;gap:10px;justify-content:flex-end;margin-top:20px}
+button{padding:9px 16px;border-radius:8px;border:1px solid var(--border);background:transparent;color:var(--text);font:inherit;cursor:pointer}
+button.primary{background:var(--primary);border-color:var(--primary);color:var(--primary-text)}
+form#lt-mcp-password button,form#lt-mcp-second-factor button{width:100%}
+.other{margin-top:20px;padding-top:16px;border-top:1px solid var(--border);display:flex;flex-direction:column;gap:8px;font-size:13px}
+a{color:var(--primary)}
+`;
+//# sourceMappingURL=ai-mcp-oauth-consent.helper.js.map

package/dist/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-mcp-oauth-consent.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth-consent.helper.ts"],"names":[],"mappings":";;;AAwGA,sDAGC;AAOD,wDAWC;AAGD,8DA8BC;AAtHY,QAAA,gCAAgC,GAAG,gBAAgB,CAAC;AAEpD,QAAA,6BAA6B,GAAG,aAAa,CAAC;AAE3D,MAAM,KAAK,GAAG;IACZ,EAAE,EAAE;QACF,KAAK,EAAE,UAAU;QACjB,eAAe,EAAE,0CAA0C;QAC3D,UAAU,EAAE,uBAAuB;QACnC,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,wBAAwB;QACpC,QAAQ,EAAE,gDAAgD;QAC1D,OAAO,EAAE,YAAY;QACrB,QAAQ,EAAE,mCAAmC;QAC7C,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,+DAA+D;QACxE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,oCAAoC;QAC9C,QAAQ,EAAE,6CAA6C;QACvD,QAAQ,EAAE,qEAAqE;QAC/E,WAAW,EAAE,mDAAmD;QAChE,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,uBAAuB;QACnC,aAAa,EAAE,eAAe;QAC9B,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,4DAA4D;QAC1E,WAAW,EAAE,+DAA+D;QAC5E,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,kBAAkB;QACzB,aAAa,EAAE,2BAA2B;QAC1C,OAAO,EAAE,+EAA+E;KACzF;IACD,EAAE,EAAE;QACF,KAAK,EAAE,OAAO;QACd,eAAe,EAAE,iCAAiC;QAClD,UAAU,EAAE,mBAAmB;QAC/B,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,sBAAsB;QAClC,QAAQ,EAAE,6CAA6C;QACvD,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,6BAA6B;QACvC,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,wDAAwD;QACjE,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,iCAAiC;QAC3C,QAAQ,EAAE,uDAAuD;QACjE,WAAW,EAAE,0CAA0C;QACvD,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,qBAAqB;QACpC,MAAM,EAAE,SAAS;QACjB,YAAY,EAAE,uDAAuD;QACrE,WAAW,EAAE,4CAA4C;QACzD,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,cAAc;QACrB,aAAa,EAAE,wBAAwB;QACvC,OAAO,EAAE,iEAAiE;KAC3E;CAC8D,CAAC;AAGlE,SAAgB,qBAAqB,CAAC,cAAuB;IAC3D,MAAM,KAAK,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAOD,SAAgB,sBAAsB,CAAC,KAAa;IAClD,OAAO;QACL,eAAe,EAAE,UAAU;QAC3B,yBAAyB,EACvB,yCAAyC,KAAK,uBAAuB,KAAK,yBAAyB;YACnG,+DAA+D;QACjE,cAAc,EAAE,0BAA0B;QAC1C,iBAAiB,EAAE,aAAa;QAChC,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;AACJ,CAAC;AAGD,SAAgB,yBAAyB,CAAC,IAA0B;IAClE,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;IAG/D,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAC5B,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CACtB,mBAAmB,EACnB,CAAC,CAAC,EAAE,GAAW,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CACnG,CAAC;IAEJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO;cACK,IAAI,CAAC,MAAM;;;;;;SAMhB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM;;;;EAI/C,IAAI;;EAEJ,UAAU,CAAC,IAAI,CAAC;;;CAGjB,CAAC;AACF,CAAC;AAID,SAAS,WAAW,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ;QACnC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG;QACjE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,8BAA8B,UAAU,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;SACvG,IAAI,CAAC,IAAI,CAAC,CAAC;IAGd,MAAM,OAAO,GAAG,GAAG;QACjB,CAAC,CAAC,sBAAsB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAC3G,IAAI,CAAC,YAAY;YACf,CAAC,CAAC,+DAA+D,UAAU,CAAC,GAAG,IAAI,CAAC,YAAY,WAAW,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM;YAClJ,CAAC,CAAC,EACN,MAAM;QACR,CAAC,CAAC,EAAE,CAAC;IAGP,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;EACjC,OAAO;EACP,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KAC3F,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;oBACE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,MAAM;qBACrC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;8BACZ,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;;EAEzD,MAAM;6BACqB,qCAA6B,YAAY,UAAU,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;8BACxE,wCAAgC,oCAAoC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8BACtF,wCAAgC,gEAAgE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QACzI,CAAC;AACT,CAAC;AAGD,SAAS,UAAU,CAAC,IAA0B;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,sCAA8B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAwB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,UAAU,CAAC,IAA0B,EAAE,CAAQ,EAAE,IAA8B;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;QACzB,CAAC,CAAC;WACK,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4CAA4C,IAAI,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;EACrJ,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;OACvF;QACH,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KACjC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;EACzB,KAAK,EAAE,CAAC;IACR,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;KAC/B,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;8BACM,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;0CACV,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,0BAA0B,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;;SAEjK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;SACnB,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;wCACS,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;mBAGzC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;SAChC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;8DACmC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;wCAC9C,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;;;;EAI3D,KAAK,EAAE,CAAC;AACV,CAAC;AAaY,QAAA,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAgCxC,CAAC;AAQM,QAAA,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+ClC,CAAC;AAGP,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBd,CAAC"}

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.d.ts

@@ -1,7 +1,20 @@
-export declare function mountAiMcpOAuth(app: {
+import { CoreAiMcpOAuthService } from '../services/core-ai-mcp-oauth.service';
+import { IMountedMcpOAuth } from './ai-mcp-oauth.registry';
+export interface IAiMcpOAuthMountTarget {
     get: (token: any) => any;
+    getHttpAdapter?: () => {
+        getInstance?: () => unknown;
+    } | undefined;
     use: (...args: any[]) => any;
-}, options?: {
+}
+export interface IAiMcpOAuthRouterOptions {
+    authBasePath?: string;
+    baseUrl?: unknown;
+    baseUrlSource?: string;
+    mcpPath: string;
+}
+export declare function mountAiMcpOAuth(app: IAiMcpOAuthMountTarget, options?: {
     baseUrl?: string;
     mcpPath?: string;
 }): Promise<void>;
+export declare function mountAiMcpOAuthRouter(target: object, use: (router: unknown) => void, oauthService: CoreAiMcpOAuthService, options: IAiMcpOAuthRouterOptions): Promise<IMountedMcpOAuth>;

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js

@@ -1,25 +1,51 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mountAiMcpOAuth = mountAiMcpOAuth;
+exports.mountAiMcpOAuthRouter = mountAiMcpOAuthRouter;
 const common_1 = require("@nestjs/common");
 const cookies_helper_1 = require("../../../common/helpers/cookies.helper");
 const config_service_1 = require("../../../common/services/config.service");
 const core_ai_mcp_oauth_service_1 = require("../services/core-ai-mcp-oauth.service");
 const ai_mcp_oauth_registry_1 = require("./ai-mcp-oauth.registry");
+const logger = new common_1.Logger('mountAiMcpOAuth');
+const mountedTargets = new WeakMap();
 async function mountAiMcpOAuth(app, options = {}) {
-    const { baseUrl, source } = resolveMcpOAuthBaseUrl(options.baseUrl);
+    const target = mountTargetOf(app);
+    const existing = mountedTargets.get(target);
+    if (existing) {
+        reportRedundantMount(await existing, options);
+        return;
+    }
+    await mountAiMcpOAuthRouter(target, (router) => app.use(router), app.get(core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService), {
+        baseUrl: options.baseUrl,
+        baseUrlSource: 'options.baseUrl',
+        mcpPath: options.mcpPath ?? '/ai/mcp',
+    });
+}
+async function mountAiMcpOAuthRouter(target, use, oauthService, options) {
+    const existing = mountedTargets.get(target);
+    if (existing) {
+        return existing;
+    }
+    const pending = mountRouter(use, oauthService, options);
+    mountedTargets.set(target, pending);
+    try {
+        return await pending;
+    }
+    catch (error) {
+        mountedTargets.delete(target);
+        throw error;
+    }
+}
+async function mountRouter(use, oauthService, options) {
+    const { baseUrl, source } = resolveMcpOAuthBaseUrl(options.baseUrl, options.baseUrlSource ?? 'options.baseUrl');
     const issuerUrl = parseAbsoluteUrl(baseUrl, source);
-    const { mcpAuthRouter } = await Promise.resolve().then(() => require('@modelcontextprotocol/sdk/server/auth/router.js'));
-    const oauthService = app.get(core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService);
-    const mcpPath = options.mcpPath ?? '/ai/mcp';
-    let router;
+    const resourceServerUrl = new URL(`${baseUrl.replace(/\/$/, '')}${options.mcpPath}`);
+    const { getOAuthProtectedResourceMetadataUrl, mcpAuthRouter } = await Promise.resolve().then(() => require('@modelcontextprotocol/sdk/server/auth/router.js'));
     const provider = oauthService.buildOAuthProvider();
+    let router;
     try {
-        router = mcpAuthRouter({
-            issuerUrl,
-            provider,
-            resourceServerUrl: new URL(`${baseUrl.replace(/\/$/, '')}${mcpPath}`),
-        });
+        router = mcpAuthRouter({ issuerUrl, provider, resourceServerUrl });
     }
     catch (error) {
         const reason = error.message;
@@ -27,18 +53,46 @@ async function mountAiMcpOAuth(app, options = {}) {
             cause: error,
         });
     }
-    app.use(router);
-    (0, ai_mcp_oauth_registry_1.setMountedMcpOAuth)({
-        mcpPath,
+    use(router);
+    const mounted = {
+        authBasePath: options.authBasePath,
+        baseUrl: baseUrl.replace(/\/$/, ''),
+        issuerUrl: issuerUrl.href,
+        mcpPath: options.mcpPath,
         registration: !!provider?.clientsStore?.registerClient,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resourceServerUrl),
+        resourceUrl: resourceServerUrl.href,
         revocation: !!provider?.revokeToken,
-    });
-    new common_1.Logger('mountAiMcpOAuth').log(`MCP OAuth issuer: ${issuerUrl.href} (from ${source})`);
+    };
+    (0, ai_mcp_oauth_registry_1.setMountedMcpOAuth)(mounted);
+    logger.log(`MCP OAuth issuer: ${issuerUrl.href} (from ${source}), resource: ${resourceServerUrl.href}`);
+    return mounted;
+}
+function mountTargetOf(app) {
+    const instance = app.getHttpAdapter?.()?.getInstance?.();
+    return (typeof instance === 'object' && instance !== null) || typeof instance === 'function'
+        ? instance
+        : app;
+}
+function reportRedundantMount(mounted, options) {
+    const ignored = [];
+    const baseUrl = options.baseUrl?.trim().replace(/\/$/, '');
+    if (baseUrl && baseUrl !== mounted.baseUrl) {
+        ignored.push(`baseUrl "${options.baseUrl}" (mounted: "${mounted.baseUrl}"; set ai.mcp.oauthBaseUrl instead)`);
+    }
+    if (options.mcpPath && options.mcpPath !== mounted.mcpPath) {
+        ignored.push(`mcpPath "${options.mcpPath}" (mounted: "${mounted.mcpPath}", derived from the MCP controller's route)`);
+    }
+    if (ignored.length) {
+        logger.warn(`The MCP OAuth router is already mounted; this call changed nothing and ignored ${ignored.join(', ')}`);
+        return;
+    }
+    logger.log('The MCP OAuth router is already mounted (CoreModule mounts it when ai.mcp.oauth is enabled); this call can be removed');
 }
-function resolveMcpOAuthBaseUrl(explicit) {
-    const given = explicit?.trim();
+function resolveMcpOAuthBaseUrl(explicit, explicitSource) {
+    const given = typeof explicit === 'string' ? explicit.trim() : undefined;
     if (given) {
-        return { baseUrl: given, source: 'options.baseUrl' };
+        return { baseUrl: given, source: explicitSource };
     }
     const config = config_service_1.ConfigService.configFastButReadOnly;
     const resolved = (0, cookies_helper_1.resolveServerUrls)({ baseUrl: config?.baseUrl, env: config?.env });
@@ -49,7 +103,7 @@ function resolveMcpOAuthBaseUrl(explicit) {
         };
     }
     throw new Error(`mountAiMcpOAuth: no public server URL for the OAuth issuer (env: ${config?.env ?? 'unset'}). ` +
-        'Set `baseUrl` in the server config (NSC__BASE_URL) or pass `options.baseUrl`. ' +
+        'Set `baseUrl` in the server config (NSC__BASE_URL) or `ai.mcp.oauthBaseUrl`. ' +
         'A guessed localhost URL would send MCP clients to their own machine.');
 }
 function parseAbsoluteUrl(value, source) {

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":";;AAwCA,0CAoCC;AA5ED,2CAAwC;AAExC,2EAA2E;AAC3E,4EAAwE;AACxE,qFAA8E;AAC9E,mEAA6D;AAmCtD,KAAK,UAAU,eAAe,CACnC,GAA+D,EAC/D,UAAkD,EAAE;IAEpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,EAAE,aAAa,EAAE,GAAG,2CAAa,iDAAiD,EAAC,CAAC;IAC1F,MAAM,YAAY,GAA0B,GAAG,CAAC,GAAG,CAAC,iDAAqB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAE7C,IAAI,MAAe,CAAC;IACpB,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAS,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC;YACrB,SAAS;YACT,QAAQ;YACR,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,MAAM,GAAI,KAAe,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,WAAW,MAAM,eAAe,MAAM,EAAE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,IAAA,0CAAkB,EAAC;QACjB,OAAO;QACP,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc;QACtD,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW;KACpC,CAAC,CAAC;IACH,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC;AAC5F,CAAC;AAMD,SAAS,sBAAsB,CAAC,QAA4B;IAC1D,MAAM,KAAK,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EACJ,QAAQ,CAAC,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,EAAE,GAAG,IAAI,OAAO,KAAK;QAC7F,gFAAgF;QAChF,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,MAAM,0BAA0B,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":";;AAoEA,0CAeC;AAQD,sDAmBC;AA9GD,2CAAwC;AAExC,2EAA2E;AAC3E,4EAAwE;AACxE,qFAA8E;AAC9E,mEAA+E;AAE/E,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAS7C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAqC,CAAC;AAoDjE,KAAK,UAAU,eAAe,CACnC,GAA2B,EAC3B,UAAkD,EAAE;IAEpD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,CAAC,MAAM,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,qBAAqB,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,iDAAqB,CAAC,EAAE;QAC/F,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,iBAAiB;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;KACtC,CAAC,CAAC;AACL,CAAC;AAQM,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEf,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAGD,KAAK,UAAU,WAAW,CACxB,GAA8B,EAC9B,YAAmC,EACnC,OAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,EAAE,oCAAoC,EAAE,aAAa,EAAE,GAC3D,2CAAa,iDAAiD,EAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,YAAY,CAAC,kBAAkB,EAAS,CAAC;IAE1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,MAAM,GAAI,KAAe,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,WAAW,MAAM,eAAe,MAAM,EAAE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,CAAC;IACZ,MAAM,OAAO,GAAqB;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,SAAS,EAAE,SAAS,CAAC,IAAI;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QAExB,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,cAAc;QACtD,mBAAmB,EAAE,oCAAoC,CAAC,iBAAiB,CAAC;QAC5E,WAAW,EAAE,iBAAiB,CAAC,IAAI;QACnC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW;KACpC,CAAC;IACF,IAAA,0CAAkB,EAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,IAAI,UAAU,MAAM,gBAAgB,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,aAAa,CAAC,GAA2B;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC;IACzD,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,OAAO,QAAQ,KAAK,UAAU;QAC1F,CAAC,CAAE,QAAmB;QACtB,CAAC,CAAC,GAAG,CAAC;AACV,CAAC;AAGD,SAAS,oBAAoB,CAAC,OAAyB,EAAE,OAA+C;IACtG,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,qCAAqC,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CACV,YAAY,OAAO,CAAC,OAAO,gBAAgB,OAAO,CAAC,OAAO,6CAA6C,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,kFAAkF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CACR,uHAAuH,CACxH,CAAC;AACJ,CAAC;AAMD,SAAS,sBAAsB,CAAC,QAAiB,EAAE,cAAsB;IACvE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EACJ,QAAQ,CAAC,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,EAAE,GAAG,IAAI,OAAO,KAAK;QAC7F,+EAA+E;QAC/E,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,MAAM,0BAA0B,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/core/modules/ai/helpers/ai-mcp-oauth.registry.d.ts

@@ -1,6 +1,11 @@
 export interface IMountedMcpOAuth {
+    authBasePath?: string;
+    baseUrl: string;
+    issuerUrl: string;
     mcpPath: string;
     registration: boolean;
+    resourceMetadataUrl: string;
+    resourceUrl: string;
     revocation: boolean;
 }
 export declare function setMountedMcpOAuth(value: IMountedMcpOAuth | undefined): void;

package/dist/core/modules/ai/helpers/ai-mcp-oauth.registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-mcp-oauth.registry.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.registry.ts"],"names":[],"mappings":";;AAqBA,gDAEC;AAGD,gDAEC;AAVD,IAAI,OAAqC,CAAC;AAG1C,SAAgB,kBAAkB,CAAC,KAAmC;IACpE,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAGD,SAAgB,kBAAkB;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"ai-mcp-oauth.registry.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.registry.ts"],"names":[],"mappings":";;AAkCA,gDAEC;AAGD,gDAEC;AAVD,IAAI,OAAqC,CAAC;AAG1C,SAAgB,kBAAkB,CAAC,KAAmC;IACpE,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAGD,SAAgB,kBAAkB;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/modules/ai/index.d.ts

@@ -1,3 +1,4 @@
+export * from './core-ai-mcp-oauth.initializer';
 export * from './core-ai-mcp.controller';
 export * from './helpers/ai-mcp-oauth.helper';
 export * from './core-ai.controller';

package/dist/core/modules/ai/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./core-ai-mcp-oauth.initializer"), exports);
 __exportStar(require("./core-ai-mcp.controller"), exports);
 __exportStar(require("./helpers/ai-mcp-oauth.helper"), exports);
 __exportStar(require("./core-ai.controller"), exports);

package/dist/core/modules/ai/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,2DAAyC;AACzC,gEAA8C;AAC9C,uDAAqC;AACrC,mDAAiC;AACjC,qDAAmC;AACnC,6EAA2D;AAC3D,sEAAoD;AACpD,2EAAyD;AACzD,+EAA6D;AAC7D,oEAAkD;AAClD,6EAA2D;AAC3D,sEAAoD;AACpD,4EAA0D;AAC1D,qEAAmD;AACnD,uEAAqD;AACrD,uEAAqD;AACrD,qEAAmD;AACnD,qEAAmD;AACnD,gEAA8C;AAC9C,uDAAqC;AACrC,2DAAyC;AACzC,+EAA6D;AAC7D,iEAA+C;AAC/C,wEAAsD;AACtD,iEAA+C;AAC/C,sEAAoD;AACpD,gFAA8D;AAC9D,gEAA8C;AAC9C,8EAA4D;AAC5D,sEAAoD;AACpD,+EAA6D;AAC7D,oEAAkD;AAClD,sEAAoD;AACpD,qEAAmD;AACnD,iEAA+C;AAC/C,qEAAmD;AACnD,gEAA8C;AAC9C,8DAA4C;AAC5C,oEAAkD;AAClD,8DAA4C;AAC5C,qEAAmD;AACnD,kEAAgD;AAChD,oEAAkD;AAClD,+DAA6C;AAC7C,kEAAgD;AAChD,mEAAiD;AACjD,yEAAuD;AACvD,+DAA6C;AAC7C,oEAAkD;AAClD,mFAAiE;AACjE,iFAA+D;AAC/D,wEAAsD;AACtD,0EAAwD;AACxD,yEAAuD;AACvD,uEAAqD;AACrD,iEAA+C;AAC/C,0EAAwD;AACxD,4EAA0D;AAC1D,yEAAuD;AACvD,oEAAkD;AAClD,kEAAgD;AAChD,wEAAsD;AACtD,wEAAsD;AACtD,kEAAgD;AAChD,yEAAuD;AACvD,6DAA2C;AAC3C,uDAAqC;AACrC,2DAAyC;AACzC,iEAA+C;AAC/C,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/modules/ai/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,kEAAgD;AAChD,2DAAyC;AACzC,gEAA8C;AAC9C,uDAAqC;AACrC,mDAAiC;AACjC,qDAAmC;AACnC,6EAA2D;AAC3D,sEAAoD;AACpD,2EAAyD;AACzD,+EAA6D;AAC7D,oEAAkD;AAClD,6EAA2D;AAC3D,sEAAoD;AACpD,4EAA0D;AAC1D,qEAAmD;AACnD,uEAAqD;AACrD,uEAAqD;AACrD,qEAAmD;AACnD,qEAAmD;AACnD,gEAA8C;AAC9C,uDAAqC;AACrC,2DAAyC;AACzC,+EAA6D;AAC7D,iEAA+C;AAC/C,wEAAsD;AACtD,iEAA+C;AAC/C,sEAAoD;AACpD,gFAA8D;AAC9D,gEAA8C;AAC9C,8EAA4D;AAC5D,sEAAoD;AACpD,+EAA6D;AAC7D,oEAAkD;AAClD,sEAAoD;AACpD,qEAAmD;AACnD,iEAA+C;AAC/C,qEAAmD;AACnD,gEAA8C;AAC9C,8DAA4C;AAC5C,oEAAkD;AAClD,8DAA4C;AAC5C,qEAAmD;AACnD,kEAAgD;AAChD,oEAAkD;AAClD,+DAA6C;AAC7C,kEAAgD;AAChD,mEAAiD;AACjD,yEAAuD;AACvD,+DAA6C;AAC7C,oEAAkD;AAClD,mFAAiE;AACjE,iFAA+D;AAC/D,wEAAsD;AACtD,0EAAwD;AACxD,yEAAuD;AACvD,uEAAqD;AACrD,iEAA+C;AAC/C,0EAAwD;AACxD,4EAA0D;AAC1D,yEAAuD;AACvD,oEAAkD;AAClD,kEAAgD;AAChD,wEAAsD;AACtD,wEAAsD;AACtD,kEAAgD;AAChD,yEAAuD;AACvD,6DAA2C;AAC3C,uDAAqC;AACrC,2DAAyC;AACzC,iEAA+C;AAC/C,4DAA0C"}

package/dist/core/modules/ai/services/core-ai-mcp-oauth.service.d.ts

@@ -1,5 +1,7 @@
+import type * as OAuthErrors from '@modelcontextprotocol/sdk/server/auth/errors.js';
 import { Logger, OnModuleInit } from '@nestjs/common';
 import { Connection } from 'mongoose';
+import { IMcpOAuthConsentView } from '../helpers/ai-mcp-oauth-consent.helper';
 export interface AiMcpOAuthClient {
     client_id: string;
     client_name?: string;
@@ -14,6 +16,12 @@ export interface AiMcpAccessTokenPayload {
     sub: string;
     type: 'mcp_access';
 }
+export interface IAiMcpOAuthConsentBinding {
+    clientId: string;
+    codeChallenge: string;
+    redirectUri: string;
+    userId: string;
+}
 export declare class CoreAiMcpOAuthService implements OnModuleInit {
     protected readonly connection: Connection;
     protected readonly logger: Logger;
@@ -25,6 +33,9 @@ export declare class CoreAiMcpOAuthService implements OnModuleInit {
     constructor(connection: Connection);
     onModuleInit(): void;
     assertProductionSafe(): void;
+    protected allowsDevelopmentSecret(): boolean;
+    isOAuthEnabled(): boolean;
+    usesBuiltInConsent(): boolean;
     protected oauthEnabled(): boolean;
     protected resolveSecret(): string | undefined;
     signAccessToken(userId: string, clientId: string, ttlSeconds?: number): string;
@@ -43,7 +54,7 @@ export declare class CoreAiMcpOAuthService implements OnModuleInit {
         codeChallenge: string;
         userId: string;
     } | null>;
-    consumeAuthorizationCode(code: string): Promise<{
+    consumeAuthorizationCode(code: string, clientId?: string): Promise<{
         clientId: string;
         codeChallenge: string;
         userId: string;
@@ -59,7 +70,24 @@ export declare class CoreAiMcpOAuthService implements OnModuleInit {
         roles: string[];
     } | null>;
     buildOAuthProvider(accessTtlSeconds?: number): Record<string, any>;
-    protected authorizeConsent(_client: any, _params: any, _res: any): Promise<void>;
+    protected readonly consentTokenTtlSeconds = 600;
+    protected authorizeConsent(client: any, params: any, res: any): Promise<void>;
+    protected renderConsentPage(view: IMcpOAuthConsentView): string;
+    protected consentUser(req: any): Promise<{
+        email?: string;
+        id: string;
+        name?: string;
+    } | undefined>;
+    protected buildConsentView(req: any, client: any, params: any, user: {
+        email?: string;
+        id: string;
+        name?: string;
+    } | undefined, notice?: IMcpOAuthConsentView['notice']): IMcpOAuthConsentView;
+    protected consentAppHost(): string;
+    protected consentLoginUrl(req: any): IMcpOAuthConsentView['loginUrl'];
+    protected signConsentToken(binding: IAiMcpOAuthConsentBinding): string;
+    protected verifyConsentToken(token: unknown, binding: IAiMcpOAuthConsentBinding): 'expired' | 'invalid' | 'valid';
+    protected loadOAuthErrors(): Promise<typeof OAuthErrors>;
     protected hmac(payloadStr: string): string;
     protected safeEqual(a: string, b: string): boolean;
     protected getSecret(): string;