@mcp-z/oauth-microsoft 1.0.0 → 1.0.2

package/dist/esm/providers/loopback-oauth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/providers/loopback-oauth.ts"],"sourcesContent":["/**\n * Loopback OAuth Implementation for Microsoft (RFC 8252)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.\n * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n * Eliminates port conflicts by using port 0, allowing unlimited concurrent servers.\n *\n * Flow:\n * 1. Check token cache (memory + storage)\n * 2. If cache miss: Start ephemeral server on port 0\n * 3. Generate auth URL with dynamic redirect (localhost:{assigned-port})\n * 4. Open browser or print URL (headless flag controls behavior)\n * 5. Handle callback, exchange code for token\n * 6. Cache token to storage\n * 7. Close ephemeral server\n */\n\nimport { addAccount, generatePKCE, getActiveAccount, getErrorTemplate, getSuccessTemplate, getToken, listAccountIds, type OAuth2TokenStorageProvider, setAccountInfo, setActiveAccount, setToken } from '@mcp-z/oauth';\nimport * as http from 'http';\nimport open from 'open';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport { type AuthContext, type AuthFlowDescriptor, AuthRequiredError, type CachedToken, type EnrichedExtra, type LoopbackOAuthConfig } from '../types.ts';\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * Loopback OAuth Client (RFC 8252 Section 7.3)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications\n * using loopback interface redirection. Manages ephemeral OAuth flows and token persistence\n * with Keyv for key-based token storage using compound keys.\n *\n * Token key format: {accountId}:{service}:token (e.g., \"user@example.com:outlook:token\")\n */\nexport class LoopbackOAuthProvider implements OAuth2TokenStorageProvider {\n  private config: LoopbackOAuthConfig;\n\n  constructor(config: LoopbackOAuthConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Get access token from Keyv using compound key\n   *\n   * @param accountId - Account identifier (email address). Required for loopback OAuth.\n   * @returns Access token for API requests\n   */\n  async getAccessToken(accountId?: string): Promise<string> {\n    const { logger, service, tokenStore } = this.config;\n\n    // Use active account if no accountId specified\n    const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n\n    // If we have an accountId, try to use existing token\n    if (effectiveAccountId) {\n      logger.debug('Getting access token', { service, accountId: effectiveAccountId });\n\n      // Check Keyv for token using new key format\n      const storedToken = await getToken<CachedToken>(tokenStore, { accountId: effectiveAccountId, service });\n\n      if (storedToken && this.isTokenValid(storedToken)) {\n        logger.debug('Using stored access token', { accountId: effectiveAccountId });\n        return storedToken.accessToken;\n      }\n\n      // If stored token expired but has refresh token, try refresh\n      if (storedToken?.refreshToken) {\n        try {\n          logger.info('Refreshing expired access token', { accountId: effectiveAccountId });\n          const refreshedToken = await this.refreshAccessToken(storedToken.refreshToken);\n          await setToken(tokenStore, { accountId: effectiveAccountId, service }, refreshedToken);\n          return refreshedToken.accessToken;\n        } catch (error) {\n          logger.info('Token refresh failed, starting new OAuth flow', {\n            accountId: effectiveAccountId,\n            error: error instanceof Error ? error.message : String(error),\n          });\n          // Fall through to new OAuth flow\n        }\n      }\n    }\n\n    // No valid token or no account - check if we can start OAuth flow\n    const { headless } = this.config;\n    if (headless) {\n      // In headless mode (production), cannot start OAuth flow\n      // Throw AuthRequiredError with auth_url descriptor for MCP tool response\n      const { clientId, tenantId, scope } = this.config;\n\n      // Incremental OAuth detection: Check if other accounts exist\n      const existingAccounts = await this.getExistingAccounts();\n      const hasOtherAccounts = effectiveAccountId ? existingAccounts.length > 0 && !existingAccounts.includes(effectiveAccountId) : existingAccounts.length > 0;\n\n      // Build informational OAuth URL for headless mode\n      // Note: No redirect_uri included - user must use account-add tool which starts proper ephemeral server\n      const authUrl = new URL(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('scope', scope);\n      authUrl.searchParams.set('response_mode', 'query');\n      authUrl.searchParams.set('prompt', 'select_account');\n\n      // Provide context-aware hint based on existing accounts\n      let hint: string;\n      if (hasOtherAccounts) {\n        hint = `Existing ${service} accounts found. Use account-list to view, account-switch to change account, or account-add to add new account`;\n      } else if (effectiveAccountId) {\n        hint = `Use account-add to authenticate ${effectiveAccountId}`;\n      } else {\n        hint = 'Use account-add to authenticate interactively';\n      }\n\n      const baseDescriptor = {\n        kind: 'auth_url' as const,\n        provider: 'microsoft',\n        url: authUrl.toString(),\n        hint,\n      };\n\n      const descriptor: AuthFlowDescriptor & { accountId?: string } = effectiveAccountId ? { ...baseDescriptor, accountId: effectiveAccountId } : baseDescriptor;\n\n      throw new AuthRequiredError(descriptor);\n    }\n\n    // Interactive mode - start ephemeral OAuth flow\n    logger.info('Starting ephemeral OAuth flow', { service, headless });\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token with email as accountId\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account in account management system\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account so subsequent getAccessToken() calls find it\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata (email, added timestamp)\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('OAuth flow completed', { service, accountId: email });\n\n    return token.accessToken;\n  }\n\n  /**\n   * Convert to Microsoft Graph-compatible auth provider\n   *\n   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')\n   * @returns Auth provider configured for the specified account\n   */\n  toAuthProvider(accountId?: string): { getAccessToken: () => Promise<string> } {\n    // Capture accountId in closure to pass to getAccessToken\n    const getToken = () => this.getAccessToken(accountId);\n\n    return {\n      getAccessToken: getToken,\n    };\n  }\n\n  /**\n   * Authenticate new account with OAuth flow\n   * Triggers account selection, stores token, registers account\n   *\n   * @returns Email address of newly authenticated account\n   * @throws Error in headless mode (cannot open browser for OAuth)\n   */\n  async authenticateNewAccount(): Promise<string> {\n    const { logger, headless, service, tokenStore } = this.config;\n\n    if (headless) {\n      throw new Error('Cannot authenticate new account in headless mode - interactive OAuth required');\n    }\n\n    logger.info('Starting new account authentication', { service });\n\n    // Trigger OAuth with account selection\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('New account authenticated', { service, email });\n    return email;\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (pure query)\n   * Used to query email for existing authenticated account\n   *\n   * @param accountId - Account identifier to get email for\n   * @returns User's email address\n   */\n  async getUserEmail(accountId?: string): Promise<string> {\n    // Get token for existing account\n    const token = await this.getAccessToken(accountId);\n\n    // Fetch email from Microsoft Graph\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    return userInfo.mail ?? userInfo.userPrincipalName;\n  }\n\n  /**\n   * Check for existing accounts in token storage (incremental OAuth detection)\n   *\n   * Uses key-utils helper for forward compatibility with key format changes.\n   *\n   * @returns Array of account IDs that have tokens for this service\n   */\n  private async getExistingAccounts(): Promise<string[]> {\n    const { service, tokenStore } = this.config;\n    return listAccountIds(tokenStore, service);\n  }\n\n  private isTokenValid(token: CachedToken): boolean {\n    if (!token.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < token.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Fetch user email from Microsoft Graph using access token\n   * Called during OAuth flow to get email for accountId\n   *\n   * @param accessToken - Fresh access token from OAuth exchange\n   * @returns User's email address (mail field or userPrincipalName fallback)\n   */\n  private async fetchUserEmailFromToken(accessToken: string): Promise<string> {\n    const { logger } = this.config;\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Failed to fetch user email: HTTP ${response.status} - ${errorText}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    logger.debug('Fetched user email from Graph API', { email });\n    return email;\n  }\n\n  private async performEphemeralOAuthFlow(): Promise<{ token: CachedToken; email: string }> {\n    const { clientId, tenantId, scope, headless, logger, redirectUri: configRedirectUri } = this.config;\n\n    // Parse redirectUri if provided to extract host, protocol, port, and path\n    let targetHost = 'localhost'; // Default: localhost (Microsoft requires exact match with registered redirect URI)\n    let targetPort = 0; // Default: OS-assigned ephemeral port\n    let targetProtocol = 'http:'; // Default: http\n    let callbackPath = '/callback'; // Default callback path\n    let useConfiguredUri = false;\n\n    if (configRedirectUri) {\n      try {\n        const parsed = new URL(configRedirectUri);\n\n        // Use configured redirect URI as-is for production deployments\n        targetHost = parsed.hostname;\n        targetProtocol = parsed.protocol;\n\n        // Extract port from URL (use default ports if not specified)\n        if (parsed.port) {\n          targetPort = Number.parseInt(parsed.port, 10);\n        } else {\n          targetPort = parsed.protocol === 'https:' ? 443 : 80;\n        }\n\n        // Extract path (default to /callback if URL has no path or just '/')\n        if (parsed.pathname && parsed.pathname !== '/') {\n          callbackPath = parsed.pathname;\n        }\n\n        useConfiguredUri = true;\n\n        logger.debug('Using configured redirect URI', {\n          host: targetHost,\n          protocol: targetProtocol,\n          port: targetPort,\n          path: callbackPath,\n          redirectUri: configRedirectUri,\n        });\n      } catch (error) {\n        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {\n          redirectUri: configRedirectUri,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        // Continue with defaults (127.0.0.1, port 0, http, /callback)\n      }\n    }\n\n    return new Promise((resolve, reject) => {\n      // Generate PKCE challenge\n      const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n\n      let server: http.Server | null = null;\n      let serverPort: number;\n      let finalRedirectUri: string; // Will be set in server.listen callback\n\n      // Create ephemeral server with OS-assigned port (RFC 8252)\n      server = http.createServer(async (req, res) => {\n        if (!req.url) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Invalid request'));\n          server?.close();\n          reject(new Error('Invalid request: missing URL'));\n          return;\n        }\n        const url = new URL(req.url, `http://localhost:${serverPort}`);\n\n        if (url.pathname === callbackPath) {\n          const code = url.searchParams.get('code');\n          const error = url.searchParams.get('error');\n\n          if (error) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate(error));\n            server?.close();\n            reject(new Error(`OAuth error: ${error}`));\n            return;\n          }\n\n          if (!code) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('No authorization code received'));\n            server?.close();\n            reject(new Error('No authorization code received'));\n            return;\n          }\n\n          try {\n            // Exchange code for token (must use same redirect_uri as in authorization request)\n            const tokenResponse = await this.exchangeCodeForToken(code, codeVerifier, finalRedirectUri);\n\n            // Build cached token\n            const cachedToken: CachedToken = {\n              accessToken: tokenResponse.access_token,\n              ...(tokenResponse.refresh_token !== undefined && { refreshToken: tokenResponse.refresh_token }),\n              ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n              ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n            };\n\n            // Fetch user email immediately using the new access token\n            const email = await this.fetchUserEmailFromToken(tokenResponse.access_token);\n\n            res.writeHead(200, { 'Content-Type': 'text/html' });\n            res.end(getSuccessTemplate());\n            server?.close();\n            resolve({ token: cachedToken, email });\n          } catch (exchangeError) {\n            logger.error('Token exchange failed', { error: exchangeError instanceof Error ? exchangeError.message : String(exchangeError) });\n            res.writeHead(500, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('Token exchange failed'));\n            server?.close();\n            reject(exchangeError);\n          }\n        } else {\n          res.writeHead(404, { 'Content-Type': 'text/plain' });\n          res.end('Not Found');\n        }\n      });\n\n      // Listen on targetPort (0 for OS assignment, or custom port from redirectUri)\n      server.listen(targetPort, targetHost, () => {\n        const address = server?.address();\n        if (!address || typeof address === 'string') {\n          server?.close();\n          reject(new Error('Failed to start ephemeral server'));\n          return;\n        }\n\n        serverPort = address.port;\n\n        // Construct final redirect URI\n        if (useConfiguredUri && configRedirectUri) {\n          // Use configured redirect URI as-is for production\n          finalRedirectUri = configRedirectUri;\n        } else {\n          // Construct ephemeral redirect URI with actual server port\n          finalRedirectUri = `${targetProtocol}//${targetHost}:${serverPort}${callbackPath}`;\n        }\n\n        // Build Microsoft auth URL\n        const authUrl = new URL(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`);\n        authUrl.searchParams.set('client_id', clientId);\n        authUrl.searchParams.set('redirect_uri', finalRedirectUri);\n        authUrl.searchParams.set('response_type', 'code');\n        authUrl.searchParams.set('scope', scope);\n        authUrl.searchParams.set('response_mode', 'query');\n        authUrl.searchParams.set('code_challenge', codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', 'S256');\n        authUrl.searchParams.set('prompt', 'select_account');\n\n        logger.info('Ephemeral OAuth server started', { port: serverPort, headless });\n\n        if (headless) {\n          // Headless mode: Print auth URL to stderr (stdout is MCP protocol)\n          console.error('\\n🔐 OAuth Authorization Required');\n          console.error('📋 Please visit this URL in your browser:\\n');\n          console.error(`   ${authUrl.toString()}\\n`);\n          console.error('⏳ Waiting for authorization...\\n');\n        } else {\n          // Interactive mode: Open browser automatically\n          logger.info('Opening browser for OAuth authorization');\n          open(authUrl.toString()).catch((error) => {\n            logger.info('Failed to open browser automatically', { error: error.message });\n            console.error('\\n🔐 OAuth Authorization Required');\n            console.error(`   ${authUrl.toString()}\\n`);\n          });\n        }\n      });\n\n      // Timeout after 5 minutes\n      setTimeout(\n        () => {\n          if (server) {\n            server.close();\n            reject(new Error('OAuth flow timed out after 5 minutes'));\n          }\n        },\n        5 * 60 * 1000\n      );\n    });\n  }\n\n  private async exchangeCodeForToken(code: string, codeVerifier: string, redirectUri: string): Promise<TokenResponse> {\n    const { clientId, clientSecret, tenantId } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      code,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n      code_verifier: codeVerifier,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed: ${response.status} ${errorText}`);\n    }\n\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async refreshAccessToken(refreshToken: string): Promise<CachedToken> {\n    const { clientId, clientSecret, tenantId, scope } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n      scope,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Create auth middleware for single-user context (single active account per service)\n   *\n   * Single-user mode:\n   * - Maintains per-service active accounts in storage\n   * - Supports backchannel account override via extra._meta.accountId\n   * - Automatically enhances output schemas with auth_required branch\n   *\n   * Example:\n   * ```typescript\n   * const loopback = new LoopbackOAuthProvider({ service: 'outlook', ... });\n   * const middleware = loopback.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   */\n  authMiddleware() {\n    const { service, tokenStore, logger } = this.config;\n\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const operation = module.name;\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position (defensive: handle arg-less tool pattern)\n        let extra: EnrichedExtra;\n        if (allArgs.length <= extraPosition) {\n          // Arg-less tool pattern: keep args as-is, create separate extra object\n          extra = (allArgs[0] && typeof allArgs[0] === 'object' ? {} : {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        } else {\n          extra = (allArgs[extraPosition] || {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        }\n\n        try {\n          // Check for backchannel override via _meta.accountId\n          let accountId: string | undefined;\n          try {\n            accountId = extra._meta?.accountId ?? (await getActiveAccount(tokenStore, { service }));\n          } catch (error) {\n            if (error instanceof Error && ((error as { code?: string }).code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError')) {\n              accountId = undefined;\n            } else {\n              throw error;\n            }\n          }\n\n          // Eagerly validate token exists or trigger OAuth flow\n          await this.getAccessToken(accountId);\n\n          // After OAuth flow completes, get the actual accountId (email) that was set\n          const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n          if (!effectiveAccountId) {\n            throw new Error(`No account found after OAuth flow for service ${service}`);\n          }\n\n          const auth = this.toAuthProvider(effectiveAccountId);\n\n          // Inject authContext and logger into extra\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth,\n            accountId: effectiveAccountId,\n          };\n          (extra as { logger?: unknown }).logger = logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          // Token retrieval/refresh failed - return auth required\n          if (error instanceof AuthRequiredError) {\n            logger.info('Authentication required', {\n              service,\n              tool: operation,\n              descriptor: error.descriptor,\n            });\n\n            // Return auth_required response wrapped in { result } to match tool outputSchema pattern\n            // Tools define outputSchema: z.object({ result: discriminatedUnion(...) }) where auth_required is a branch\n            const authRequiredResponse = {\n              type: 'auth_required' as const,\n              provider: service,\n              message: `Authentication required for ${operation}. Please authenticate with ${service}.`,\n              url: error.descriptor.kind === 'auth_url' ? error.descriptor.url : undefined,\n            };\n\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ result: authRequiredResponse }),\n                },\n              ],\n              structuredContent: { result: authRequiredResponse },\n            };\n          }\n\n          // Other errors - propagate\n          throw error;\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n\n/**\n * Create a loopback OAuth client for Microsoft services\n * Works for both stdio and HTTP transports\n */\nexport function createMicrosoftFileAuth(config: LoopbackOAuthConfig): OAuth2TokenStorageProvider {\n  return new LoopbackOAuthProvider(config);\n}\n"],"names":["addAccount","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","listAccountIds","setAccountInfo","setActiveAccount","setToken","http","open","fetchWithTimeout","AuthRequiredError","LoopbackOAuthProvider","getAccessToken","accountId","logger","service","tokenStore","config","effectiveAccountId","debug","storedToken","isTokenValid","accessToken","refreshToken","info","refreshedToken","refreshAccessToken","error","Error","message","String","headless","clientId","tenantId","scope","existingAccounts","getExistingAccounts","hasOtherAccounts","length","includes","authUrl","URL","searchParams","set","hint","baseDescriptor","kind","provider","url","toString","descriptor","token","email","performEphemeralOAuthFlow","addedAt","Date","toISOString","toAuthProvider","authenticateNewAccount","getUserEmail","userInfo","response","headers","Authorization","ok","status","text","json","mail","userPrincipalName","expiresAt","now","fetchUserEmailFromToken","errorText","redirectUri","configRedirectUri","targetHost","targetPort","targetProtocol","callbackPath","useConfiguredUri","parsed","hostname","protocol","port","Number","parseInt","pathname","host","path","warn","Promise","resolve","reject","verifier","codeVerifier","challenge","codeChallenge","server","serverPort","finalRedirectUri","createServer","req","res","writeHead","end","close","code","get","tokenResponse","exchangeCodeForToken","cachedToken","access_token","refresh_token","undefined","expires_in","exchangeError","listen","address","console","catch","setTimeout","clientSecret","tokenUrl","params","client_id","redirect_uri","grant_type","code_verifier","client_secret","body","URLSearchParams","method","authMiddleware","wrapAtPosition","module","extraPosition","operation","name","originalHandler","handler","wrappedHandler","allArgs","extra","_meta","auth","authContext","tool","authRequiredResponse","type","content","JSON","stringify","result","structuredContent","withToolAuth","withResourceAuth","withPromptAuth","createMicrosoftFileAuth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,gBAAgB,EAAEC,kBAAkB,EAAEC,QAAQ,EAAEC,cAAc,EAAmCC,cAAc,EAAEC,gBAAgB,EAAEC,QAAQ,QAAQ,eAAe;AACvN,YAAYC,UAAU,OAAO;AAC7B,OAAOC,UAAU,OAAO;AACxB,SAASC,gBAAgB,QAAQ,+BAA+B;AAChE,SAAoDC,iBAAiB,QAAwE,cAAc;AAU3J;;;;;;;;CAQC,GACD,OAAO,MAAMC;IAOX;;;;;GAKC,GACD,MAAMC,eAAeC,SAAkB,EAAmB;QACxD,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAEnD,+CAA+C;QAC/C,MAAMC,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;YAAED;QAAQ;QAEtF,qDAAqD;QACrD,IAAIG,oBAAoB;YACtBJ,OAAOK,KAAK,CAAC,wBAAwB;gBAAEJ;gBAASF,WAAWK;YAAmB;YAE9E,4CAA4C;YAC5C,MAAME,cAAc,MAAMlB,SAAsBc,YAAY;gBAAEH,WAAWK;gBAAoBH;YAAQ;YAErG,IAAIK,eAAe,IAAI,CAACC,YAAY,CAACD,cAAc;gBACjDN,OAAOK,KAAK,CAAC,6BAA6B;oBAAEN,WAAWK;gBAAmB;gBAC1E,OAAOE,YAAYE,WAAW;YAChC;YAEA,6DAA6D;YAC7D,IAAIF,wBAAAA,kCAAAA,YAAaG,YAAY,EAAE;gBAC7B,IAAI;oBACFT,OAAOU,IAAI,CAAC,mCAAmC;wBAAEX,WAAWK;oBAAmB;oBAC/E,MAAMO,iBAAiB,MAAM,IAAI,CAACC,kBAAkB,CAACN,YAAYG,YAAY;oBAC7E,MAAMjB,SAASU,YAAY;wBAAEH,WAAWK;wBAAoBH;oBAAQ,GAAGU;oBACvE,OAAOA,eAAeH,WAAW;gBACnC,EAAE,OAAOK,OAAO;oBACdb,OAAOU,IAAI,CAAC,iDAAiD;wBAC3DX,WAAWK;wBACXS,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;oBACzD;gBACA,iCAAiC;gBACnC;YACF;QACF;QAEA,kEAAkE;QAClE,MAAM,EAAEI,QAAQ,EAAE,GAAG,IAAI,CAACd,MAAM;QAChC,IAAIc,UAAU;YACZ,yDAAyD;YACzD,yEAAyE;YACzE,MAAM,EAAEC,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAACjB,MAAM;YAEjD,6DAA6D;YAC7D,MAAMkB,mBAAmB,MAAM,IAAI,CAACC,mBAAmB;YACvD,MAAMC,mBAAmBnB,qBAAqBiB,iBAAiBG,MAAM,GAAG,KAAK,CAACH,iBAAiBI,QAAQ,CAACrB,sBAAsBiB,iBAAiBG,MAAM,GAAG;YAExJ,kDAAkD;YAClD,uGAAuG;YACvG,MAAME,UAAU,IAAIC,IAAI,CAAC,kCAAkC,EAAER,SAAS,sBAAsB,CAAC;YAC7FO,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaX;YACtCQ,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;YAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;YAEnC,wDAAwD;YACxD,IAAIC;YACJ,IAAIP,kBAAkB;gBACpBO,OAAO,CAAC,SAAS,EAAE7B,QAAQ,8GAA8G,CAAC;YAC5I,OAAO,IAAIG,oBAAoB;gBAC7B0B,OAAO,CAAC,gCAAgC,EAAE1B,oBAAoB;YAChE,OAAO;gBACL0B,OAAO;YACT;YAEA,MAAMC,iBAAiB;gBACrBC,MAAM;gBACNC,UAAU;gBACVC,KAAKR,QAAQS,QAAQ;gBACrBL;YACF;YAEA,MAAMM,aAA0DhC,qBAAqB;gBAAE,GAAG2B,cAAc;gBAAEhC,WAAWK;YAAmB,IAAI2B;YAE5I,MAAM,IAAInC,kBAAkBwC;QAC9B;QAEA,gDAAgD;QAChDpC,OAAOU,IAAI,CAAC,iCAAiC;YAAET;YAASgB;QAAS;QACjE,MAAM,EAAEoB,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,sCAAsC;QACtC,MAAM/C,SAASU,YAAY;YAAEH,WAAWuC;YAAOrC;QAAQ,GAAGoC;QAE1D,gDAAgD;QAChD,MAAMtD,WAAWmB,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAEzD,qEAAqE;QACrE,MAAM/C,iBAAiBW,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAE/D,kDAAkD;QAClD,MAAMhD,eACJY,YACA;YAAED;YAASF,WAAWuC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGF1C,OAAOU,IAAI,CAAC,wBAAwB;YAAET;YAASF,WAAWuC;QAAM;QAEhE,OAAOD,MAAM7B,WAAW;IAC1B;IAEA;;;;;GAKC,GACDmC,eAAe5C,SAAkB,EAA6C;QAC5E,yDAAyD;QACzD,MAAMX,WAAW,IAAM,IAAI,CAACU,cAAc,CAACC;QAE3C,OAAO;YACLD,gBAAgBV;QAClB;IACF;IAEA;;;;;;GAMC,GACD,MAAMwD,yBAA0C;QAC9C,MAAM,EAAE5C,MAAM,EAAEiB,QAAQ,EAAEhB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAE7D,IAAIc,UAAU;YACZ,MAAM,IAAIH,MAAM;QAClB;QAEAd,OAAOU,IAAI,CAAC,uCAAuC;YAAET;QAAQ;QAE7D,uCAAuC;QACvC,MAAM,EAAEoC,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,cAAc;QACd,MAAM/C,SAASU,YAAY;YAAEH,WAAWuC;YAAOrC;QAAQ,GAAGoC;QAE1D,mBAAmB;QACnB,MAAMtD,WAAWmB,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAEzD,wBAAwB;QACxB,MAAM/C,iBAAiBW,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAE/D,yBAAyB;QACzB,MAAMhD,eACJY,YACA;YAAED;YAASF,WAAWuC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGF1C,OAAOU,IAAI,CAAC,6BAA6B;YAAET;YAASqC;QAAM;QAC1D,OAAOA;IACT;IAEA;;;;;;GAMC,GACD,MAAMO,aAAa9C,SAAkB,EAAmB;YAgB/C+C;QAfP,iCAAiC;QACjC,MAAMT,QAAQ,MAAM,IAAI,CAACvC,cAAc,CAACC;QAExC,mCAAmC;QACnC,MAAMgD,WAAW,MAAMpD,iBAAiB,uCAAuC;YAC7EqD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAEZ,OAAO;YAClC;QACF;QAEA,IAAI,CAACU,SAASG,EAAE,EAAE;YAChB,MAAM,IAAIpC,MAAM,CAAC,yBAAyB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAE,MAAMJ,SAASK,IAAI,IAAI;QACxF;QAEA,MAAMN,WAAY,MAAMC,SAASM,IAAI;QACrC,QAAOP,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;IACpD;IAEA;;;;;;GAMC,GACD,MAAcjC,sBAAyC;QACrD,MAAM,EAAErB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAC3C,OAAOd,eAAea,YAAYD;IACpC;IAEQM,aAAa8B,KAAkB,EAAW;QAChD,IAAI,CAACA,MAAMmB,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC9D,OAAOf,KAAKgB,GAAG,KAAKpB,MAAMmB,SAAS,GAAG,OAAO,kBAAkB;IACjE;IAEA;;;;;;GAMC,GACD,MAAcE,wBAAwBlD,WAAmB,EAAmB;YAe5DsC;QAdd,MAAM,EAAE9C,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,MAAM4C,WAAW,MAAMpD,iBAAiB,uCAAuC;YAC7EqD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAEzC,aAAa;YACxC;QACF;QAEA,IAAI,CAACuC,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,iCAAiC,EAAEiC,SAASI,MAAM,CAAC,GAAG,EAAEQ,WAAW;QACtF;QAEA,MAAMb,WAAY,MAAMC,SAASM,IAAI;QACrC,MAAMf,SAAQQ,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;QAEzDvD,OAAOK,KAAK,CAAC,qCAAqC;YAAEiC;QAAM;QAC1D,OAAOA;IACT;IAEA,MAAcC,4BAA4E;QACxF,MAAM,EAAErB,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAEH,QAAQ,EAAEjB,MAAM,EAAE4D,aAAaC,iBAAiB,EAAE,GAAG,IAAI,CAAC1D,MAAM;QAEnG,0EAA0E;QAC1E,IAAI2D,aAAa,aAAa,mFAAmF;QACjH,IAAIC,aAAa,GAAG,sCAAsC;QAC1D,IAAIC,iBAAiB,SAAS,gBAAgB;QAC9C,IAAIC,eAAe,aAAa,wBAAwB;QACxD,IAAIC,mBAAmB;QAEvB,IAAIL,mBAAmB;YACrB,IAAI;gBACF,MAAMM,SAAS,IAAIxC,IAAIkC;gBAEvB,+DAA+D;gBAC/DC,aAAaK,OAAOC,QAAQ;gBAC5BJ,iBAAiBG,OAAOE,QAAQ;gBAEhC,6DAA6D;gBAC7D,IAAIF,OAAOG,IAAI,EAAE;oBACfP,aAAaQ,OAAOC,QAAQ,CAACL,OAAOG,IAAI,EAAE;gBAC5C,OAAO;oBACLP,aAAaI,OAAOE,QAAQ,KAAK,WAAW,MAAM;gBACpD;gBAEA,qEAAqE;gBACrE,IAAIF,OAAOM,QAAQ,IAAIN,OAAOM,QAAQ,KAAK,KAAK;oBAC9CR,eAAeE,OAAOM,QAAQ;gBAChC;gBAEAP,mBAAmB;gBAEnBlE,OAAOK,KAAK,CAAC,iCAAiC;oBAC5CqE,MAAMZ;oBACNO,UAAUL;oBACVM,MAAMP;oBACNY,MAAMV;oBACNL,aAAaC;gBACf;YACF,EAAE,OAAOhD,OAAO;gBACdb,OAAO4E,IAAI,CAAC,yDAAyD;oBACnEhB,aAAaC;oBACbhD,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBACzD;YACA,8DAA8D;YAChE;QACF;QAEA,OAAO,IAAIgE,QAAQ,CAACC,SAASC;YAC3B,0BAA0B;YAC1B,MAAM,EAAEC,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAGnG;YAE7D,IAAIoG,SAA6B;YACjC,IAAIC;YACJ,IAAIC,kBAA0B,wCAAwC;YAEtE,2DAA2D;YAC3DF,SAAS3F,KAAK8F,YAAY,CAAC,OAAOC,KAAKC;gBACrC,IAAI,CAACD,IAAItD,GAAG,EAAE;oBACZuD,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;oBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIjE,MAAM;oBACjB;gBACF;gBACA,MAAMoB,MAAM,IAAIP,IAAI6D,IAAItD,GAAG,EAAE,CAAC,iBAAiB,EAAEmD,YAAY;gBAE7D,IAAInD,IAAIuC,QAAQ,KAAKR,cAAc;oBACjC,MAAM4B,OAAO3D,IAAIN,YAAY,CAACkE,GAAG,CAAC;oBAClC,MAAMjF,QAAQqB,IAAIN,YAAY,CAACkE,GAAG,CAAC;oBAEnC,IAAIjF,OAAO;wBACT4E,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB2B;wBACzBuE,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIjE,MAAM,CAAC,aAAa,EAAED,OAAO;wBACxC;oBACF;oBAEA,IAAI,CAACgF,MAAM;wBACTJ,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;wBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIjE,MAAM;wBACjB;oBACF;oBAEA,IAAI;wBACF,mFAAmF;wBACnF,MAAMiF,gBAAgB,MAAM,IAAI,CAACC,oBAAoB,CAACH,MAAMZ,cAAcK;wBAE1E,qBAAqB;wBACrB,MAAMW,cAA2B;4BAC/BzF,aAAauF,cAAcG,YAAY;4BACvC,GAAIH,cAAcI,aAAa,KAAKC,aAAa;gCAAE3F,cAAcsF,cAAcI,aAAa;4BAAC,CAAC;4BAC9F,GAAIJ,cAAcM,UAAU,KAAKD,aAAa;gCAAE5C,WAAWf,KAAKgB,GAAG,KAAKsC,cAAcM,UAAU,GAAG;4BAAK,CAAC;4BACzG,GAAIN,cAAc3E,KAAK,KAAKgF,aAAa;gCAAEhF,OAAO2E,cAAc3E,KAAK;4BAAC,CAAC;wBACzE;wBAEA,0DAA0D;wBAC1D,MAAMkB,QAAQ,MAAM,IAAI,CAACoB,uBAAuB,CAACqC,cAAcG,YAAY;wBAE3ET,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACxG;wBACRiG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbd,QAAQ;4BAAEzC,OAAO4D;4BAAa3D;wBAAM;oBACtC,EAAE,OAAOgE,eAAe;wBACtBtG,OAAOa,KAAK,CAAC,yBAAyB;4BAAEA,OAAOyF,yBAAyBxF,QAAQwF,cAAcvF,OAAO,GAAGC,OAAOsF;wBAAe;wBAC9Hb,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;wBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAOuB;oBACT;gBACF,OAAO;oBACLb,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAa;oBAClDD,IAAIE,GAAG,CAAC;gBACV;YACF;YAEA,8EAA8E;YAC9EP,OAAOmB,MAAM,CAACxC,YAAYD,YAAY;gBACpC,MAAM0C,UAAUpB,mBAAAA,6BAAAA,OAAQoB,OAAO;gBAC/B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;oBAC3CpB,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIjE,MAAM;oBACjB;gBACF;gBAEAuE,aAAamB,QAAQlC,IAAI;gBAEzB,+BAA+B;gBAC/B,IAAIJ,oBAAoBL,mBAAmB;oBACzC,mDAAmD;oBACnDyB,mBAAmBzB;gBACrB,OAAO;oBACL,2DAA2D;oBAC3DyB,mBAAmB,GAAGtB,eAAe,EAAE,EAAEF,WAAW,CAAC,EAAEuB,aAAapB,cAAc;gBACpF;gBAEA,2BAA2B;gBAC3B,MAAMvC,UAAU,IAAIC,IAAI,CAAC,kCAAkC,EAAER,SAAS,sBAAsB,CAAC;gBAC7FO,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaX;gBACtCQ,QAAQE,YAAY,CAACC,GAAG,CAAC,gBAAgByD;gBACzC5D,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;gBAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;gBAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;gBAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,kBAAkBsD;gBAC3CzD,QAAQE,YAAY,CAACC,GAAG,CAAC,yBAAyB;gBAClDH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;gBAEnC7B,OAAOU,IAAI,CAAC,kCAAkC;oBAAE4D,MAAMe;oBAAYpE;gBAAS;gBAE3E,IAAIA,UAAU;oBACZ,mEAAmE;oBACnEwF,QAAQ5F,KAAK,CAAC;oBACd4F,QAAQ5F,KAAK,CAAC;oBACd4F,QAAQ5F,KAAK,CAAC,CAAC,GAAG,EAAEa,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC1CsE,QAAQ5F,KAAK,CAAC;gBAChB,OAAO;oBACL,+CAA+C;oBAC/Cb,OAAOU,IAAI,CAAC;oBACZhB,KAAKgC,QAAQS,QAAQ,IAAIuE,KAAK,CAAC,CAAC7F;wBAC9Bb,OAAOU,IAAI,CAAC,wCAAwC;4BAAEG,OAAOA,MAAME,OAAO;wBAAC;wBAC3E0F,QAAQ5F,KAAK,CAAC;wBACd4F,QAAQ5F,KAAK,CAAC,CAAC,GAAG,EAAEa,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC5C;gBACF;YACF;YAEA,0BAA0B;YAC1BwE,WACE;gBACE,IAAIvB,QAAQ;oBACVA,OAAOQ,KAAK;oBACZb,OAAO,IAAIjE,MAAM;gBACnB;YACF,GACA,IAAI,KAAK;QAEb;IACF;IAEA,MAAckF,qBAAqBH,IAAY,EAAEZ,YAAoB,EAAErB,WAAmB,EAA0B;QAClH,MAAM,EAAE1C,QAAQ,EAAE0F,YAAY,EAAEzF,QAAQ,EAAE,GAAG,IAAI,CAAChB,MAAM;QAExD,MAAM0G,WAAW,CAAC,kCAAkC,EAAE1F,SAAS,kBAAkB,CAAC;QAClF,MAAM2F,SAAiC;YACrCjB;YACAkB,WAAW7F;YACX8F,cAAcpD;YACdqD,YAAY;YACZC,eAAejC;QACjB;QAEA,sDAAsD;QACtD,IAAI2B,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM/D,WAAW,MAAMpD,iBAAiBkH,UAAU;YAChDS,QAAQ;YACRtE,SAAS;gBACP,gBAAgB;YAClB;YACAoE,MAAMA,KAAKjF,QAAQ;QACrB;QAEA,IAAI,CAACY,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,uBAAuB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAEQ,WAAW;QAC1E;QAEA,OAAQ,MAAMZ,SAASM,IAAI;IAC7B;IAEA,MAAczC,mBAAmBH,YAAoB,EAAwB;QAC3E,MAAM,EAAES,QAAQ,EAAE0F,YAAY,EAAEzF,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAACjB,MAAM;QAE/D,MAAM0G,WAAW,CAAC,kCAAkC,EAAE1F,SAAS,kBAAkB,CAAC;QAClF,MAAM2F,SAAiC;YACrCX,eAAe1F;YACfsG,WAAW7F;YACX+F,YAAY;YACZ7F;QACF;QAEA,sDAAsD;QACtD,IAAIwF,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM/D,WAAW,MAAMpD,iBAAiBkH,UAAU;YAChDS,QAAQ;YACRtE,SAAS;gBACP,gBAAgB;YAClB;YACAoE,MAAMA,KAAKjF,QAAQ;QACrB;QAEA,IAAI,CAACY,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,sBAAsB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAEQ,WAAW;QACzE;QAEA,MAAMoC,gBAAiB,MAAMhD,SAASM,IAAI;QAE1C,OAAO;YACL7C,aAAauF,cAAcG,YAAY;YACvCzF,cAAcA;YACd,GAAIsF,cAAcM,UAAU,KAAKD,aAAa;gBAAE5C,WAAWf,KAAKgB,GAAG,KAAKsC,cAAcM,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIN,cAAc3E,KAAK,KAAKgF,aAAa;gBAAEhF,OAAO2E,cAAc3E,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACDmG,iBAAiB;QACf,MAAM,EAAEtH,OAAO,EAAEC,UAAU,EAAEF,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAEnD,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMqH,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,YAAYF,OAAOG,IAAI;YAC7B,MAAMC,kBAAkBJ,OAAOK,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,oFAAoF;gBACpF,IAAIC;gBACJ,IAAID,QAAQxG,MAAM,IAAIkG,eAAe;oBACnC,uEAAuE;oBACvEO,QAASD,OAAO,CAAC,EAAE,IAAI,OAAOA,OAAO,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC;oBAC9DA,OAAO,CAACN,cAAc,GAAGO;gBAC3B,OAAO;oBACLA,QAASD,OAAO,CAACN,cAAc,IAAI,CAAC;oBACpCM,OAAO,CAACN,cAAc,GAAGO;gBAC3B;gBAEA,IAAI;oBACF,qDAAqD;oBACrD,IAAIlI;oBACJ,IAAI;;4BACUkI;wBAAZlI,qBAAYkI,eAAAA,MAAMC,KAAK,cAAXD,mCAAAA,aAAalI,SAAS,uCAAK,MAAMd,iBAAiBiB,YAAY;4BAAED;wBAAQ;oBACtF,EAAE,OAAOY,OAAO;wBACd,IAAIA,iBAAiBC,SAAU,CAAA,AAACD,MAA4BgF,IAAI,KAAK,6BAA6BhF,MAAM+G,IAAI,KAAK,qBAAoB,GAAI;4BACvI7H,YAAYqG;wBACd,OAAO;4BACL,MAAMvF;wBACR;oBACF;oBAEA,sDAAsD;oBACtD,MAAM,IAAI,CAACf,cAAc,CAACC;oBAE1B,4EAA4E;oBAC5E,MAAMK,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;wBAAED;oBAAQ;oBACtF,IAAI,CAACG,oBAAoB;wBACvB,MAAM,IAAIU,MAAM,CAAC,8CAA8C,EAAEb,SAAS;oBAC5E;oBAEA,MAAMkI,OAAO,IAAI,CAACxF,cAAc,CAACvC;oBAEjC,2CAA2C;oBAC1C6H,MAAwCG,WAAW,GAAG;wBACrDD;wBACApI,WAAWK;oBACb;oBACC6H,MAA+BjI,MAAM,GAAGA;oBAEzC,sCAAsC;oBACtC,OAAO,MAAM6H,mBAAmBG;gBAClC,EAAE,OAAOnH,OAAO;oBACd,wDAAwD;oBACxD,IAAIA,iBAAiBjB,mBAAmB;wBACtCI,OAAOU,IAAI,CAAC,2BAA2B;4BACrCT;4BACAoI,MAAMV;4BACNvF,YAAYvB,MAAMuB,UAAU;wBAC9B;wBAEA,yFAAyF;wBACzF,2GAA2G;wBAC3G,MAAMkG,uBAAuB;4BAC3BC,MAAM;4BACNtG,UAAUhC;4BACVc,SAAS,CAAC,4BAA4B,EAAE4G,UAAU,2BAA2B,EAAE1H,QAAQ,CAAC,CAAC;4BACzFiC,KAAKrB,MAAMuB,UAAU,CAACJ,IAAI,KAAK,aAAanB,MAAMuB,UAAU,CAACF,GAAG,GAAGkE;wBACrE;wBAEA,OAAO;4BACLoC,SAAS;gCACP;oCACED,MAAM;oCACNnF,MAAMqF,KAAKC,SAAS,CAAC;wCAAEC,QAAQL;oCAAqB;gCACtD;6BACD;4BACDM,mBAAmB;gCAAED,QAAQL;4BAAqB;wBACpD;oBACF;oBAEA,2BAA2B;oBAC3B,MAAMzH;gBACR;YACF;YAEA,OAAO;gBACL,GAAG4G,MAAM;gBACTK,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDc,cAAc,CAAgEpB,SAAcD,eAAeC,QAAQ;YACnHqB,kBAAkB,CAAqFrB,SAAcD,eAAeC,QAAQ;YAC5IsB,gBAAgB,CAAgEtB,SAAcD,eAAeC,QAAQ;QACvH;IACF;IA7mBA,YAAYtH,MAA2B,CAAE;QACvC,IAAI,CAACA,MAAM,GAAGA;IAChB;AA4mBF;AAEA;;;CAGC,GACD,OAAO,SAAS6I,wBAAwB7I,MAA2B;IACjE,OAAO,IAAIN,sBAAsBM;AACnC"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/providers/loopback-oauth.ts"],"sourcesContent":["/**\n * Loopback OAuth Implementation for Microsoft (RFC 8252)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.\n * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n * Eliminates port conflicts by using port 0, allowing unlimited concurrent servers.\n *\n * Flow:\n * 1. Check token cache (memory + storage)\n * 2. If cache miss: Start ephemeral server on port 0\n * 3. Generate auth URL with dynamic redirect (localhost:{assigned-port})\n * 4. Open browser or print URL (headless flag controls behavior)\n * 5. Handle callback, exchange code for token\n * 6. Cache token to storage\n * 7. Close ephemeral server\n *\n * CHANGE (2026-01-03):\n * - Non-headless mode now opens the auth URL AND blocks (polls) until tokens are available,\n *   for BOTH redirectUri (persistent) and ephemeral (loopback) modes.\n * - Ephemeral flow no longer calls `open()` itself. Instead it:\n *   1) starts the loopback callback server\n *   2) throws AuthRequiredError(auth_url)\n * - Middleware catches AuthRequiredError(auth_url):\n *   - if not headless: open(url) once + poll pending state until callback completes (or timeout)\n *   - then retries token acquisition and injects authContext in the SAME tool call.\n */\n\nimport { addAccount, generatePKCE, getActiveAccount, getErrorTemplate, getSuccessTemplate, getToken, type OAuth2TokenStorageProvider, setAccountInfo, setActiveAccount, setToken } from '@mcp-z/oauth';\nimport { randomUUID } from 'crypto';\nimport * as http from 'http';\nimport open from 'open';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport { type AuthContext, type AuthFlowDescriptor, AuthRequiredError, type CachedToken, type EnrichedExtra, type LoopbackOAuthConfig } from '../types.ts';\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\ntype PendingAuth = {\n  codeVerifier: string;\n  createdAt: number;\n  // populated when callback completes successfully\n  completedAt?: number;\n  email?: string;\n};\n\nconst OAUTH_TIMEOUT_MS = 5 * 60 * 1000;\nconst OAUTH_POLL_MS = 500;\n\n/**\n * Loopback OAuth Client (RFC 8252 Section 7.3)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications\n * using loopback interface redirection. Manages ephemeral OAuth flows and token persistence\n * with Keyv for key-based token storage using compound keys.\n *\n * Token key format: {accountId}:{service}:token (e.g., \"user@example.com:outlook:token\")\n */\nexport class LoopbackOAuthProvider implements OAuth2TokenStorageProvider {\n  private config: LoopbackOAuthConfig;\n\n  // Track URLs we've already opened for a given state within this process (prevents tab spam).\n  private openedStates = new Set<string>();\n\n  constructor(config: LoopbackOAuthConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Get access token from Keyv using compound key\n   *\n   * @param accountId - Account identifier (email address). Required for loopback OAuth.\n   * @returns Access token for API requests\n   */\n  async getAccessToken(accountId?: string): Promise<string> {\n    const { logger, service, tokenStore } = this.config;\n\n    // Use active account if no accountId specified\n    const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n\n    // If we have an accountId, try to use existing token\n    if (effectiveAccountId) {\n      logger.debug('Getting access token', { service, accountId: effectiveAccountId });\n\n      // Check Keyv for token using new key format\n      const storedToken = await getToken<CachedToken>(tokenStore, { accountId: effectiveAccountId, service });\n\n      if (storedToken && this.isTokenValid(storedToken)) {\n        logger.debug('Using stored access token', { accountId: effectiveAccountId });\n        return storedToken.accessToken;\n      }\n\n      // If stored token expired but has refresh token, try refresh\n      if (storedToken?.refreshToken) {\n        try {\n          logger.info('Refreshing expired access token', { accountId: effectiveAccountId });\n          const refreshedToken = await this.refreshAccessToken(storedToken.refreshToken);\n          await setToken(tokenStore, { accountId: effectiveAccountId, service }, refreshedToken);\n          return refreshedToken.accessToken;\n        } catch (error) {\n          logger.info('Token refresh failed, starting new OAuth flow', {\n            accountId: effectiveAccountId,\n            error: error instanceof Error ? error.message : String(error),\n          });\n          // Fall through to new OAuth flow\n        }\n      }\n    }\n\n    const { clientId, tenantId, scope, redirectUri } = this.config;\n\n    if (redirectUri) {\n      // Persistent callback mode (cloud deployment with configured redirect_uri)\n      const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n      const stateId = randomUUID();\n\n      // Store PKCE verifier for callback (5 minute TTL)\n      await this.createPendingAuth({ state: stateId, codeVerifier });\n\n      // Build auth URL with configured redirect_uri\n      const authUrl = this.buildAuthUrl({\n        tenantId,\n        clientId,\n        redirectUri,\n        scope,\n        codeChallenge,\n        state: stateId,\n      });\n\n      logger.info('OAuth required - persistent callback mode', { service, redirectUri });\n      throw new AuthRequiredError({\n        kind: 'auth_url',\n        provider: service,\n        url: authUrl,\n      });\n    }\n\n    // Ephemeral callback mode (local development)\n    logger.info('Starting ephemeral OAuth flow', { service, headless: this.config.headless });\n    const descriptor = await this.startEphemeralOAuthFlow();\n    throw new AuthRequiredError(descriptor);\n  }\n\n  /**\n   * Convert to Microsoft Graph-compatible auth provider\n   *\n   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')\n   * @returns Auth provider configured for the specified account\n   */\n  toAuthProvider(accountId?: string): { getAccessToken: () => Promise<string> } {\n    // Capture accountId in closure to pass to getAccessToken\n    const getToken = () => this.getAccessToken(accountId);\n\n    return {\n      getAccessToken: getToken,\n    };\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (pure query)\n   * Used to query email for existing authenticated account\n   *\n   * @param accountId - Account identifier to get email for\n   * @returns User's email address\n   */\n  async getUserEmail(accountId?: string): Promise<string> {\n    // Get token for existing account\n    const token = await this.getAccessToken(accountId);\n\n    // Fetch email from Microsoft Graph\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    return userInfo.mail ?? userInfo.userPrincipalName;\n  }\n\n  private isTokenValid(token: CachedToken): boolean {\n    if (!token.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < token.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Fetch user email from Microsoft Graph using access token\n   * Called during OAuth flow to get email for accountId\n   *\n   * @param accessToken - Fresh access token from OAuth exchange\n   * @returns User's email address (mail field or userPrincipalName fallback)\n   */\n  private async fetchUserEmailFromToken(accessToken: string): Promise<string> {\n    const { logger } = this.config;\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Failed to fetch user email: HTTP ${response.status} - ${errorText}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    logger.debug('Fetched user email from Graph API', { email });\n    return email;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Shared OAuth helpers\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Build Microsoft OAuth authorization URL with the \"most parameters\" baseline.\n   * This is shared by BOTH persistent (redirectUri) and ephemeral (loopback) modes.\n   */\n  private buildAuthUrl(args: { tenantId: string; clientId: string; redirectUri: string; scope: string; codeChallenge: string; state: string }): string {\n    const authUrl = new URL(`https://login.microsoftonline.com/${args.tenantId}/oauth2/v2.0/authorize`);\n    authUrl.searchParams.set('client_id', args.clientId);\n    authUrl.searchParams.set('redirect_uri', args.redirectUri);\n    authUrl.searchParams.set('response_type', 'code');\n    authUrl.searchParams.set('scope', args.scope);\n\n    // Keep response_mode consistent across both modes (most-params baseline)\n    authUrl.searchParams.set('response_mode', 'query');\n\n    // PKCE\n    authUrl.searchParams.set('code_challenge', args.codeChallenge);\n    authUrl.searchParams.set('code_challenge_method', 'S256');\n\n    // State (required in both modes)\n    authUrl.searchParams.set('state', args.state);\n\n    // Keep current behavior\n    authUrl.searchParams.set('prompt', 'select_account');\n\n    return authUrl.toString();\n  }\n\n  /**\n   * Create a cached token + email from an authorization code.\n   * This is the shared callback handler for BOTH persistent and ephemeral modes.\n   */\n  private async handleAuthorizationCode(args: { code: string; codeVerifier: string; redirectUri: string }): Promise<{ email: string; token: CachedToken }> {\n    // Exchange code for token (must use same redirect_uri as in authorization request)\n    const tokenResponse = await this.exchangeCodeForToken(args.code, args.codeVerifier, args.redirectUri);\n\n    // Build cached token\n    const cachedToken: CachedToken = {\n      accessToken: tokenResponse.access_token,\n      ...(tokenResponse.refresh_token !== undefined && { refreshToken: tokenResponse.refresh_token }),\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n\n    // Fetch user email immediately using the new access token\n    const email = await this.fetchUserEmailFromToken(tokenResponse.access_token);\n\n    return { email, token: cachedToken };\n  }\n\n  /**\n   * Store token + account metadata. Shared by BOTH persistent and ephemeral modes.\n   */\n  private async persistAuthResult(args: { email: string; token: CachedToken }): Promise<void> {\n    const { tokenStore, service } = this.config;\n\n    await setToken(tokenStore, { accountId: args.email, service }, args.token);\n    await addAccount(tokenStore, { service, accountId: args.email });\n    await setActiveAccount(tokenStore, { service, accountId: args.email });\n    await setAccountInfo(tokenStore, { service, accountId: args.email }, { email: args.email, addedAt: new Date().toISOString() });\n  }\n\n  /**\n   * Pending auth (PKCE verifier) key format.\n   */\n  private pendingKey(state: string): string {\n    return `${this.config.service}:pending:${state}`;\n  }\n\n  /**\n   * Store PKCE verifier for callback (5 minute TTL).\n   * Shared by BOTH persistent and ephemeral modes.\n   */\n  private async createPendingAuth(args: { state: string; codeVerifier: string }): Promise<void> {\n    const { tokenStore } = this.config;\n    const record: PendingAuth = { codeVerifier: args.codeVerifier, createdAt: Date.now() };\n    await tokenStore.set(this.pendingKey(args.state), record, OAUTH_TIMEOUT_MS);\n  }\n\n  /**\n   * Load and validate pending auth state (5 minute TTL).\n   * Shared by BOTH persistent and ephemeral modes.\n   */\n  private async readAndValidatePendingAuth(state: string): Promise<PendingAuth> {\n    const { tokenStore } = this.config;\n\n    const pendingAuth = await tokenStore.get<PendingAuth>(this.pendingKey(state));\n    if (!pendingAuth) {\n      throw new Error('Invalid or expired OAuth state. Please try again.');\n    }\n\n    // Check TTL (5 minutes)\n    if (Date.now() - pendingAuth.createdAt > OAUTH_TIMEOUT_MS) {\n      await tokenStore.delete(this.pendingKey(state));\n      throw new Error('OAuth state expired. Please try again.');\n    }\n\n    return pendingAuth;\n  }\n\n  /**\n   * Mark pending auth as completed (used by middleware polling).\n   */\n  private async markPendingComplete(args: { state: string; email: string; pending: PendingAuth }): Promise<void> {\n    const { tokenStore } = this.config;\n    const updated: PendingAuth = {\n      ...args.pending,\n      completedAt: Date.now(),\n      email: args.email,\n    };\n    await tokenStore.set(this.pendingKey(args.state), updated, OAUTH_TIMEOUT_MS);\n  }\n\n  /**\n   * Clean up pending auth state.\n   */\n  private async deletePendingAuth(state: string): Promise<void> {\n    const { tokenStore } = this.config;\n    await tokenStore.delete(this.pendingKey(state));\n  }\n\n  /**\n   * Wait until pending auth is marked completed (or timeout).\n   * Used by middleware after opening auth URL in non-headless mode.\n   */\n  private async waitForOAuthCompletion(state: string): Promise<{ email?: string }> {\n    const { tokenStore } = this.config;\n    const key = this.pendingKey(state);\n    const start = Date.now();\n\n    while (Date.now() - start < OAUTH_TIMEOUT_MS) {\n      const pending = await tokenStore.get<PendingAuth>(key);\n      if (pending?.completedAt) {\n        return { email: pending.email };\n      }\n      await new Promise((r) => setTimeout(r, OAUTH_POLL_MS));\n    }\n\n    throw new Error('OAuth flow timed out after 5 minutes');\n  }\n\n  /**\n   * Process an OAuth callback using shared state validation + token exchange + persistence.\n   * Used by BOTH:\n   * - ephemeral loopback server callback handler\n   * - persistent redirectUri callback handler\n   *\n   * IMPORTANT CHANGE:\n   * - We do NOT delete pending state here anymore.\n   * - We mark it completed so middleware can poll and then clean it up.\n   */\n  private async processOAuthCallback(args: { code: string; state: string; redirectUri: string }): Promise<{ email: string; token: CachedToken }> {\n    const { logger, service } = this.config;\n\n    const pending = await this.readAndValidatePendingAuth(args.state);\n\n    logger.info('Processing OAuth callback', { service, state: args.state });\n\n    const result = await this.handleAuthorizationCode({\n      code: args.code,\n      codeVerifier: pending.codeVerifier,\n      redirectUri: args.redirectUri,\n    });\n\n    await this.persistAuthResult(result);\n    await this.markPendingComplete({ state: args.state, email: result.email, pending });\n\n    logger.info('OAuth callback completed', { service, email: result.email });\n    return result;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Ephemeral loopback server + flow\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Loopback OAuth server helper (RFC 8252 Section 7.3)\n   *\n   * Implements ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n   * Shared callback handling uses:\n   * - the same authUrl builder as redirectUri mode\n   * - the same pending PKCE verifier storage as redirectUri mode\n   * - the same callback processor as redirectUri mode\n   */\n  private createOAuthCallbackServer(args: {\n    callbackPath: string;\n    finalRedirectUri: () => string; // resolved after listen\n    onDone: () => void;\n    onError: (err: unknown) => void;\n  }): http.Server {\n    const { logger } = this.config;\n\n    // Create ephemeral server with OS-assigned port (RFC 8252)\n    return http.createServer(async (req, res) => {\n      try {\n        if (!req.url) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Invalid request'));\n          args.onError(new Error('Invalid request: missing URL'));\n          return;\n        }\n\n        // Use loopback base for URL parsing (port is not important for parsing path/query)\n        const url = new URL(req.url, 'http://127.0.0.1');\n\n        if (url.pathname !== args.callbackPath) {\n          res.writeHead(404, { 'Content-Type': 'text/plain' });\n          res.end('Not Found');\n          return;\n        }\n\n        const code = url.searchParams.get('code');\n        const error = url.searchParams.get('error');\n        const state = url.searchParams.get('state');\n\n        if (error) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate(error));\n          args.onError(new Error(`OAuth error: ${error}`));\n          return;\n        }\n\n        if (!code) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('No authorization code received'));\n          args.onError(new Error('No authorization code received'));\n          return;\n        }\n\n        if (!state) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Missing state parameter in OAuth callback'));\n          args.onError(new Error('Missing state parameter in OAuth callback'));\n          return;\n        }\n\n        try {\n          await this.processOAuthCallback({\n            code,\n            state,\n            redirectUri: args.finalRedirectUri(),\n          });\n\n          res.writeHead(200, { 'Content-Type': 'text/html' });\n          res.end(getSuccessTemplate());\n\n          args.onDone();\n        } catch (exchangeError) {\n          logger.error('Token exchange failed', { error: exchangeError instanceof Error ? exchangeError.message : String(exchangeError) });\n          res.writeHead(500, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Token exchange failed'));\n          args.onError(exchangeError);\n        }\n      } catch (outerError) {\n        logger.error('OAuth callback server error', { error: outerError instanceof Error ? outerError.message : String(outerError) });\n        res.writeHead(500, { 'Content-Type': 'text/html' });\n        res.end(getErrorTemplate('Internal server error'));\n        args.onError(outerError);\n      }\n    });\n  }\n\n  /**\n   * Starts the ephemeral loopback server and returns an AuthRequiredError(auth_url).\n   * Middleware will open+poll and then retry in the same call.\n   */\n  private async startEphemeralOAuthFlow(): Promise<AuthFlowDescriptor> {\n    const { clientId, tenantId, scope, headless, logger, redirectUri: configRedirectUri, service, tokenStore } = this.config;\n\n    // Server listen configuration (where ephemeral server binds)\n    let listenHost = 'localhost'; // Default: localhost for ephemeral loopback\n    let listenPort = 0; // Default: OS-assigned ephemeral port\n\n    // Redirect URI configuration (what goes in auth URL and token exchange)\n    let callbackPath = '/callback'; // Default callback path\n    let useConfiguredUri = false;\n\n    if (configRedirectUri) {\n      try {\n        const parsed = new URL(configRedirectUri);\n        const isLoopback = parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n\n        if (isLoopback) {\n          // Local development: Listen on specific loopback address/port\n          listenHost = parsed.hostname;\n          listenPort = parsed.port ? Number.parseInt(parsed.port, 10) : 0;\n        } else {\n          // Cloud deployment: Listen on 0.0.0.0 with PORT from environment\n          // The redirectUri is the PUBLIC URL (e.g., https://example.com/oauth/callback)\n          // The server listens on 0.0.0.0:PORT and the load balancer routes to it\n          listenHost = '0.0.0.0';\n          const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : undefined;\n          listenPort = envPort && Number.isFinite(envPort) ? envPort : 8080;\n        }\n\n        // Extract callback path from URL\n        if (parsed.pathname && parsed.pathname !== '/') {\n          callbackPath = parsed.pathname;\n        }\n\n        useConfiguredUri = true;\n\n        logger.debug('Using configured redirect URI', {\n          listenHost,\n          listenPort,\n          callbackPath,\n          redirectUri: configRedirectUri,\n          isLoopback,\n        });\n      } catch (error) {\n        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {\n          redirectUri: configRedirectUri,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        // Continue with defaults (localhost, port 0, http, /callback)\n      }\n    }\n\n    // Generate PKCE challenge + state\n    const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n    const stateId = randomUUID();\n\n    // Store PKCE verifier for callback (5 minute TTL)\n    await this.createPendingAuth({ state: stateId, codeVerifier });\n\n    let server: http.Server | null = null;\n    let serverPort: number;\n    let finalRedirectUri: string; // set after listen\n\n    // Create ephemeral server with OS-assigned port (RFC 8252)\n    server = this.createOAuthCallbackServer({\n      callbackPath,\n      finalRedirectUri: () => finalRedirectUri,\n      onDone: () => {\n        server?.close();\n      },\n      onError: (err) => {\n        logger.error('Ephemeral OAuth server error', { error: err instanceof Error ? err.message : String(err) });\n        server?.close();\n      },\n    });\n\n    // Start listening\n    await new Promise<void>((resolve, reject) => {\n      server?.listen(listenPort, listenHost, () => {\n        const address = server?.address();\n        if (!address || typeof address === 'string') {\n          server?.close();\n          reject(new Error('Failed to start ephemeral server'));\n          return;\n        }\n\n        serverPort = address.port;\n\n        // Construct final redirect URI\n        if (useConfiguredUri && configRedirectUri) {\n          finalRedirectUri = configRedirectUri;\n        } else {\n          finalRedirectUri = `http://localhost:${serverPort}${callbackPath}`;\n        }\n\n        logger.info('Ephemeral OAuth server started', { port: serverPort, headless, service });\n\n        resolve();\n      });\n    });\n\n    // Timeout after 5 minutes (match middleware polling timeout)\n    setTimeout(() => {\n      if (server) {\n        server.close();\n        // Best-effort cleanup if user never completes flow:\n        // delete pending so a future attempt can restart cleanly.\n        void tokenStore.delete(this.pendingKey(stateId));\n      }\n    }, OAUTH_TIMEOUT_MS);\n\n    // Build auth URL - SAME helper as persistent mode\n    const authUrl = this.buildAuthUrl({\n      tenantId,\n      clientId,\n      redirectUri: finalRedirectUri,\n      scope,\n      codeChallenge,\n      state: stateId,\n    });\n\n    return {\n      kind: 'auth_url',\n      provider: service,\n      url: authUrl,\n    };\n  }\n\n  private async exchangeCodeForToken(code: string, codeVerifier: string, redirectUri: string): Promise<TokenResponse> {\n    const { clientId, clientSecret, tenantId } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      code,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n      code_verifier: codeVerifier,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed: ${response.status} ${errorText}`);\n    }\n\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async refreshAccessToken(refreshToken: string): Promise<CachedToken> {\n    const { clientId, clientSecret, tenantId } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    // NOTE: We intentionally do NOT include \"scope\" in refresh requests.\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Handle OAuth callback from persistent endpoint.\n   * Used by HTTP servers with configured redirectUri.\n   *\n   * @param params - OAuth callback parameters\n   * @returns Email and cached token\n   */\n  async handleOAuthCallback(params: { code: string; state?: string }): Promise<{ email: string; token: CachedToken }> {\n    const { code, state } = params;\n    const { redirectUri } = this.config;\n\n    if (!state) {\n      throw new Error('Missing state parameter in OAuth callback');\n    }\n\n    if (!redirectUri) {\n      throw new Error('handleOAuthCallback requires configured redirectUri');\n    }\n\n    // Shared callback processor (same code path as ephemeral)\n    return await this.processOAuthCallback({ code, state, redirectUri });\n  }\n\n  /**\n   * Create auth middleware for single-user context (single active account per service)\n   *\n   * Single-user mode:\n   * - Maintains per-service active accounts in storage\n   * - Supports backchannel account override via extra._meta.accountId\n   * - Automatically enhances output schemas with auth_required branch\n   *\n   * Example:\n   * ```typescript\n   * const loopback = new LoopbackOAuthProvider({ service: 'outlook', ... });\n   * const middleware = loopback.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   */\n  authMiddleware() {\n    const { service, tokenStore, logger } = this.config;\n\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const operation = module.name;\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position (defensive: handle arg-less tool pattern)\n        let extra: EnrichedExtra;\n        if (allArgs.length <= extraPosition) {\n          // Arg-less tool pattern: keep args as-is, create separate extra object\n          extra = (allArgs[0] && typeof allArgs[0] === 'object' ? {} : {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        } else {\n          extra = (allArgs[extraPosition] || {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        }\n\n        // Helper: retry once after open+poll completes\n        const ensureAuthenticatedOrThrow = async (): Promise<string> => {\n          try {\n            // Check for backchannel override via _meta.accountId\n            let accountId: string | undefined;\n            try {\n              accountId = extra._meta?.accountId ?? (await getActiveAccount(tokenStore, { service }));\n            } catch (error) {\n              if (error instanceof Error && (((error as { code?: string }).code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError') as boolean)) {\n                accountId = undefined;\n              } else {\n                throw error;\n              }\n            }\n\n            // Eagerly validate token exists or trigger OAuth flow\n            await this.getAccessToken(accountId);\n\n            // After OAuth flow completes, get the actual accountId (email) that was set\n            const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n            if (!effectiveAccountId) {\n              throw new Error(`No account found after OAuth flow for service ${service}`);\n            }\n\n            return effectiveAccountId;\n          } catch (error) {\n            if (error instanceof AuthRequiredError && error.descriptor.kind === 'auth_url') {\n              // Headless: don't open/poll; just propagate to outer handler to return auth_required.\n              if (this.config.headless) throw error;\n\n              // Non-headless: open once + poll until callback completes, then retry token acquisition.\n              const authUrl = new URL(error.descriptor.url);\n              const state = authUrl.searchParams.get('state');\n              if (!state) throw new Error('Auth URL missing state parameter');\n\n              if (!this.openedStates.has(state)) {\n                this.openedStates.add(state);\n                open(error.descriptor.url).catch((e: unknown) => {\n                  logger.info('Failed to open browser automatically', { error: e instanceof Error ? e.message : String(e) });\n                });\n              }\n\n              // Block until callback completes (or timeout)\n              await this.waitForOAuthCompletion(state);\n\n              // Cleanup pending state after we observe completion\n              await this.deletePendingAuth(state);\n\n              // Retry after completion\n              return await ensureAuthenticatedOrThrow();\n            }\n\n            throw error;\n          }\n        };\n\n        try {\n          const effectiveAccountId = await ensureAuthenticatedOrThrow();\n          const auth = this.toAuthProvider(effectiveAccountId);\n\n          // Inject authContext and logger into extra\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth,\n            accountId: effectiveAccountId,\n          };\n          (extra as { logger?: unknown }).logger = logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          // Token retrieval/refresh failed - return auth required\n          if (error instanceof AuthRequiredError) {\n            logger.info('Authentication required', {\n              service,\n              tool: operation,\n              descriptor: error.descriptor,\n            });\n\n            // Return auth_required response wrapped in { result } to match tool outputSchema pattern\n            // Tools define outputSchema: z.object({ result: discriminatedUnion(...) }) where auth_required is a branch\n            const authRequiredResponse = {\n              type: 'auth_required' as const,\n              provider: service,\n              message: `Authentication required for ${operation}. Please authenticate with ${service}.`,\n              url: error.descriptor.kind === 'auth_url' ? error.descriptor.url : undefined,\n            };\n\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ result: authRequiredResponse }),\n                },\n              ],\n              structuredContent: { result: authRequiredResponse },\n            };\n          }\n\n          // Other errors - propagate\n          throw error;\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n\n/**\n * Create a loopback OAuth client for Microsoft services\n * Works for both stdio and HTTP transports\n */\nexport function createMicrosoftFileAuth(config: LoopbackOAuthConfig): OAuth2TokenStorageProvider {\n  return new LoopbackOAuthProvider(config);\n}\n"],"names":["addAccount","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","setAccountInfo","setActiveAccount","setToken","randomUUID","http","open","fetchWithTimeout","AuthRequiredError","OAUTH_TIMEOUT_MS","OAUTH_POLL_MS","LoopbackOAuthProvider","getAccessToken","accountId","logger","service","tokenStore","config","effectiveAccountId","debug","storedToken","isTokenValid","accessToken","refreshToken","info","refreshedToken","refreshAccessToken","error","Error","message","String","clientId","tenantId","scope","redirectUri","verifier","codeVerifier","challenge","codeChallenge","stateId","createPendingAuth","state","authUrl","buildAuthUrl","kind","provider","url","headless","descriptor","startEphemeralOAuthFlow","toAuthProvider","getUserEmail","userInfo","token","response","headers","Authorization","ok","status","text","json","mail","userPrincipalName","expiresAt","Date","now","fetchUserEmailFromToken","errorText","email","args","URL","searchParams","set","toString","handleAuthorizationCode","tokenResponse","exchangeCodeForToken","code","cachedToken","access_token","refresh_token","undefined","expires_in","persistAuthResult","addedAt","toISOString","pendingKey","record","createdAt","readAndValidatePendingAuth","pendingAuth","get","delete","markPendingComplete","updated","pending","completedAt","deletePendingAuth","waitForOAuthCompletion","key","start","Promise","r","setTimeout","processOAuthCallback","result","createOAuthCallbackServer","createServer","req","res","writeHead","end","onError","pathname","callbackPath","finalRedirectUri","onDone","exchangeError","outerError","configRedirectUri","listenHost","listenPort","useConfiguredUri","parsed","isLoopback","hostname","port","Number","parseInt","envPort","process","env","PORT","isFinite","warn","server","serverPort","close","err","resolve","reject","listen","address","clientSecret","tokenUrl","params","client_id","redirect_uri","grant_type","code_verifier","client_secret","body","URLSearchParams","method","handleOAuthCallback","authMiddleware","wrapAtPosition","module","extraPosition","operation","name","originalHandler","handler","wrappedHandler","allArgs","extra","length","ensureAuthenticatedOrThrow","_meta","openedStates","has","add","catch","e","auth","authContext","tool","authRequiredResponse","type","content","JSON","stringify","structuredContent","withToolAuth","withResourceAuth","withPromptAuth","Set","createMicrosoftFileAuth"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GAED,SAASA,UAAU,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,gBAAgB,EAAEC,kBAAkB,EAAEC,QAAQ,EAAmCC,cAAc,EAAEC,gBAAgB,EAAEC,QAAQ,QAAQ,eAAe;AACvM,SAASC,UAAU,QAAQ,SAAS;AACpC,YAAYC,UAAU,OAAO;AAC7B,OAAOC,UAAU,OAAO;AACxB,SAASC,gBAAgB,QAAQ,+BAA+B;AAChE,SAAoDC,iBAAiB,QAAwE,cAAc;AAkB3J,MAAMC,mBAAmB,IAAI,KAAK;AAClC,MAAMC,gBAAgB;AAEtB;;;;;;;;CAQC,GACD,OAAO,MAAMC;IAUX;;;;;GAKC,GACD,MAAMC,eAAeC,SAAkB,EAAmB;QACxD,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAEnD,+CAA+C;QAC/C,MAAMC,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMhB,iBAAiBmB,YAAY;YAAED;QAAQ;QAEtF,qDAAqD;QACrD,IAAIG,oBAAoB;YACtBJ,OAAOK,KAAK,CAAC,wBAAwB;gBAAEJ;gBAASF,WAAWK;YAAmB;YAE9E,4CAA4C;YAC5C,MAAME,cAAc,MAAMpB,SAAsBgB,YAAY;gBAAEH,WAAWK;gBAAoBH;YAAQ;YAErG,IAAIK,eAAe,IAAI,CAACC,YAAY,CAACD,cAAc;gBACjDN,OAAOK,KAAK,CAAC,6BAA6B;oBAAEN,WAAWK;gBAAmB;gBAC1E,OAAOE,YAAYE,WAAW;YAChC;YAEA,6DAA6D;YAC7D,IAAIF,wBAAAA,kCAAAA,YAAaG,YAAY,EAAE;gBAC7B,IAAI;oBACFT,OAAOU,IAAI,CAAC,mCAAmC;wBAAEX,WAAWK;oBAAmB;oBAC/E,MAAMO,iBAAiB,MAAM,IAAI,CAACC,kBAAkB,CAACN,YAAYG,YAAY;oBAC7E,MAAMpB,SAASa,YAAY;wBAAEH,WAAWK;wBAAoBH;oBAAQ,GAAGU;oBACvE,OAAOA,eAAeH,WAAW;gBACnC,EAAE,OAAOK,OAAO;oBACdb,OAAOU,IAAI,CAAC,iDAAiD;wBAC3DX,WAAWK;wBACXS,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;oBACzD;gBACA,iCAAiC;gBACnC;YACF;QACF;QAEA,MAAM,EAAEI,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAEC,WAAW,EAAE,GAAG,IAAI,CAACjB,MAAM;QAE9D,IAAIiB,aAAa;YACf,2EAA2E;YAC3E,MAAM,EAAEC,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAG1C;YAC7D,MAAM2C,UAAUnC;YAEhB,kDAAkD;YAClD,MAAM,IAAI,CAACoC,iBAAiB,CAAC;gBAAEC,OAAOF;gBAASH;YAAa;YAE5D,8CAA8C;YAC9C,MAAMM,UAAU,IAAI,CAACC,YAAY,CAAC;gBAChCX;gBACAD;gBACAG;gBACAD;gBACAK;gBACAG,OAAOF;YACT;YAEAzB,OAAOU,IAAI,CAAC,6CAA6C;gBAAET;gBAASmB;YAAY;YAChF,MAAM,IAAI1B,kBAAkB;gBAC1BoC,MAAM;gBACNC,UAAU9B;gBACV+B,KAAKJ;YACP;QACF;QAEA,8CAA8C;QAC9C5B,OAAOU,IAAI,CAAC,iCAAiC;YAAET;YAASgC,UAAU,IAAI,CAAC9B,MAAM,CAAC8B,QAAQ;QAAC;QACvF,MAAMC,aAAa,MAAM,IAAI,CAACC,uBAAuB;QACrD,MAAM,IAAIzC,kBAAkBwC;IAC9B;IAEA;;;;;GAKC,GACDE,eAAerC,SAAkB,EAA6C;QAC5E,yDAAyD;QACzD,MAAMb,WAAW,IAAM,IAAI,CAACY,cAAc,CAACC;QAE3C,OAAO;YACLD,gBAAgBZ;QAClB;IACF;IAEA;;;;;;GAMC,GACD,MAAMmD,aAAatC,SAAkB,EAAmB;YAgB/CuC;QAfP,iCAAiC;QACjC,MAAMC,QAAQ,MAAM,IAAI,CAACzC,cAAc,CAACC;QAExC,mCAAmC;QACnC,MAAMyC,WAAW,MAAM/C,iBAAiB,uCAAuC;YAC7EgD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAEH,OAAO;YAClC;QACF;QAEA,IAAI,CAACC,SAASG,EAAE,EAAE;YAChB,MAAM,IAAI7B,MAAM,CAAC,yBAAyB,EAAE0B,SAASI,MAAM,CAAC,CAAC,EAAE,MAAMJ,SAASK,IAAI,IAAI;QACxF;QAEA,MAAMP,WAAY,MAAME,SAASM,IAAI;QACrC,QAAOR,iBAAAA,SAASS,IAAI,cAAbT,4BAAAA,iBAAiBA,SAASU,iBAAiB;IACpD;IAEQzC,aAAagC,KAAkB,EAAW;QAChD,IAAI,CAACA,MAAMU,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC9D,OAAOC,KAAKC,GAAG,KAAKZ,MAAMU,SAAS,GAAG,OAAO,kBAAkB;IACjE;IAEA;;;;;;GAMC,GACD,MAAcG,wBAAwB5C,WAAmB,EAAmB;YAe5D8B;QAdd,MAAM,EAAEtC,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,MAAMqC,WAAW,MAAM/C,iBAAiB,uCAAuC;YAC7EgD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAElC,aAAa;YACxC;QACF;QAEA,IAAI,CAACgC,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAI/B,MAAM,CAAC,iCAAiC,EAAE0B,SAASI,MAAM,CAAC,GAAG,EAAES,WAAW;QACtF;QAEA,MAAMf,WAAY,MAAME,SAASM,IAAI;QACrC,MAAMQ,SAAQhB,iBAAAA,SAASS,IAAI,cAAbT,4BAAAA,iBAAiBA,SAASU,iBAAiB;QAEzDhD,OAAOK,KAAK,CAAC,qCAAqC;YAAEiD;QAAM;QAC1D,OAAOA;IACT;IAEA,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E;;;GAGC,GACD,AAAQzB,aAAa0B,IAAsH,EAAU;QACnJ,MAAM3B,UAAU,IAAI4B,IAAI,CAAC,kCAAkC,EAAED,KAAKrC,QAAQ,CAAC,sBAAsB,CAAC;QAClGU,QAAQ6B,YAAY,CAACC,GAAG,CAAC,aAAaH,KAAKtC,QAAQ;QACnDW,QAAQ6B,YAAY,CAACC,GAAG,CAAC,gBAAgBH,KAAKnC,WAAW;QACzDQ,QAAQ6B,YAAY,CAACC,GAAG,CAAC,iBAAiB;QAC1C9B,QAAQ6B,YAAY,CAACC,GAAG,CAAC,SAASH,KAAKpC,KAAK;QAE5C,yEAAyE;QACzES,QAAQ6B,YAAY,CAACC,GAAG,CAAC,iBAAiB;QAE1C,OAAO;QACP9B,QAAQ6B,YAAY,CAACC,GAAG,CAAC,kBAAkBH,KAAK/B,aAAa;QAC7DI,QAAQ6B,YAAY,CAACC,GAAG,CAAC,yBAAyB;QAElD,iCAAiC;QACjC9B,QAAQ6B,YAAY,CAACC,GAAG,CAAC,SAASH,KAAK5B,KAAK;QAE5C,wBAAwB;QACxBC,QAAQ6B,YAAY,CAACC,GAAG,CAAC,UAAU;QAEnC,OAAO9B,QAAQ+B,QAAQ;IACzB;IAEA;;;GAGC,GACD,MAAcC,wBAAwBL,IAAiE,EAAkD;QACvJ,mFAAmF;QACnF,MAAMM,gBAAgB,MAAM,IAAI,CAACC,oBAAoB,CAACP,KAAKQ,IAAI,EAAER,KAAKjC,YAAY,EAAEiC,KAAKnC,WAAW;QAEpG,qBAAqB;QACrB,MAAM4C,cAA2B;YAC/BxD,aAAaqD,cAAcI,YAAY;YACvC,GAAIJ,cAAcK,aAAa,KAAKC,aAAa;gBAAE1D,cAAcoD,cAAcK,aAAa;YAAC,CAAC;YAC9F,GAAIL,cAAcO,UAAU,KAAKD,aAAa;gBAAElB,WAAWC,KAAKC,GAAG,KAAKU,cAAcO,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIP,cAAc1C,KAAK,KAAKgD,aAAa;gBAAEhD,OAAO0C,cAAc1C,KAAK;YAAC,CAAC;QACzE;QAEA,0DAA0D;QAC1D,MAAMmC,QAAQ,MAAM,IAAI,CAACF,uBAAuB,CAACS,cAAcI,YAAY;QAE3E,OAAO;YAAEX;YAAOf,OAAOyB;QAAY;IACrC;IAEA;;GAEC,GACD,MAAcK,kBAAkBd,IAA2C,EAAiB;QAC1F,MAAM,EAAErD,UAAU,EAAED,OAAO,EAAE,GAAG,IAAI,CAACE,MAAM;QAE3C,MAAMd,SAASa,YAAY;YAAEH,WAAWwD,KAAKD,KAAK;YAAErD;QAAQ,GAAGsD,KAAKhB,KAAK;QACzE,MAAM1D,WAAWqB,YAAY;YAAED;YAASF,WAAWwD,KAAKD,KAAK;QAAC;QAC9D,MAAMlE,iBAAiBc,YAAY;YAAED;YAASF,WAAWwD,KAAKD,KAAK;QAAC;QACpE,MAAMnE,eAAee,YAAY;YAAED;YAASF,WAAWwD,KAAKD,KAAK;QAAC,GAAG;YAAEA,OAAOC,KAAKD,KAAK;YAAEgB,SAAS,IAAIpB,OAAOqB,WAAW;QAAG;IAC9H;IAEA;;GAEC,GACD,AAAQC,WAAW7C,KAAa,EAAU;QACxC,OAAO,GAAG,IAAI,CAACxB,MAAM,CAACF,OAAO,CAAC,SAAS,EAAE0B,OAAO;IAClD;IAEA;;;GAGC,GACD,MAAcD,kBAAkB6B,IAA6C,EAAiB;QAC5F,MAAM,EAAErD,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMsE,SAAsB;YAAEnD,cAAciC,KAAKjC,YAAY;YAAEoD,WAAWxB,KAAKC,GAAG;QAAG;QACrF,MAAMjD,WAAWwD,GAAG,CAAC,IAAI,CAACc,UAAU,CAACjB,KAAK5B,KAAK,GAAG8C,QAAQ9E;IAC5D;IAEA;;;GAGC,GACD,MAAcgF,2BAA2BhD,KAAa,EAAwB;QAC5E,MAAM,EAAEzB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAElC,MAAMyE,cAAc,MAAM1E,WAAW2E,GAAG,CAAc,IAAI,CAACL,UAAU,CAAC7C;QACtE,IAAI,CAACiD,aAAa;YAChB,MAAM,IAAI9D,MAAM;QAClB;QAEA,wBAAwB;QACxB,IAAIoC,KAAKC,GAAG,KAAKyB,YAAYF,SAAS,GAAG/E,kBAAkB;YACzD,MAAMO,WAAW4E,MAAM,CAAC,IAAI,CAACN,UAAU,CAAC7C;YACxC,MAAM,IAAIb,MAAM;QAClB;QAEA,OAAO8D;IACT;IAEA;;GAEC,GACD,MAAcG,oBAAoBxB,IAA4D,EAAiB;QAC7G,MAAM,EAAErD,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAM6E,UAAuB;YAC3B,GAAGzB,KAAK0B,OAAO;YACfC,aAAahC,KAAKC,GAAG;YACrBG,OAAOC,KAAKD,KAAK;QACnB;QACA,MAAMpD,WAAWwD,GAAG,CAAC,IAAI,CAACc,UAAU,CAACjB,KAAK5B,KAAK,GAAGqD,SAASrF;IAC7D;IAEA;;GAEC,GACD,MAAcwF,kBAAkBxD,KAAa,EAAiB;QAC5D,MAAM,EAAEzB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMD,WAAW4E,MAAM,CAAC,IAAI,CAACN,UAAU,CAAC7C;IAC1C;IAEA;;;GAGC,GACD,MAAcyD,uBAAuBzD,KAAa,EAA+B;QAC/E,MAAM,EAAEzB,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAClC,MAAMkF,MAAM,IAAI,CAACb,UAAU,CAAC7C;QAC5B,MAAM2D,QAAQpC,KAAKC,GAAG;QAEtB,MAAOD,KAAKC,GAAG,KAAKmC,QAAQ3F,iBAAkB;YAC5C,MAAMsF,UAAU,MAAM/E,WAAW2E,GAAG,CAAcQ;YAClD,IAAIJ,oBAAAA,8BAAAA,QAASC,WAAW,EAAE;gBACxB,OAAO;oBAAE5B,OAAO2B,QAAQ3B,KAAK;gBAAC;YAChC;YACA,MAAM,IAAIiC,QAAQ,CAACC,IAAMC,WAAWD,GAAG5F;QACzC;QAEA,MAAM,IAAIkB,MAAM;IAClB;IAEA;;;;;;;;;GASC,GACD,MAAc4E,qBAAqBnC,IAA0D,EAAkD;QAC7I,MAAM,EAAEvD,MAAM,EAAEC,OAAO,EAAE,GAAG,IAAI,CAACE,MAAM;QAEvC,MAAM8E,UAAU,MAAM,IAAI,CAACN,0BAA0B,CAACpB,KAAK5B,KAAK;QAEhE3B,OAAOU,IAAI,CAAC,6BAA6B;YAAET;YAAS0B,OAAO4B,KAAK5B,KAAK;QAAC;QAEtE,MAAMgE,SAAS,MAAM,IAAI,CAAC/B,uBAAuB,CAAC;YAChDG,MAAMR,KAAKQ,IAAI;YACfzC,cAAc2D,QAAQ3D,YAAY;YAClCF,aAAamC,KAAKnC,WAAW;QAC/B;QAEA,MAAM,IAAI,CAACiD,iBAAiB,CAACsB;QAC7B,MAAM,IAAI,CAACZ,mBAAmB,CAAC;YAAEpD,OAAO4B,KAAK5B,KAAK;YAAE2B,OAAOqC,OAAOrC,KAAK;YAAE2B;QAAQ;QAEjFjF,OAAOU,IAAI,CAAC,4BAA4B;YAAET;YAASqD,OAAOqC,OAAOrC,KAAK;QAAC;QACvE,OAAOqC;IACT;IAEA,8EAA8E;IAC9E,mCAAmC;IACnC,8EAA8E;IAE9E;;;;;;;;GAQC,GACD,AAAQC,0BAA0BrC,IAKjC,EAAe;QACd,MAAM,EAAEvD,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,2DAA2D;QAC3D,OAAOZ,KAAKsG,YAAY,CAAC,OAAOC,KAAKC;YACnC,IAAI;gBACF,IAAI,CAACD,IAAI9D,GAAG,EAAE;oBACZ+D,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACjH,iBAAiB;oBACzBuE,KAAK2C,OAAO,CAAC,IAAIpF,MAAM;oBACvB;gBACF;gBAEA,mFAAmF;gBACnF,MAAMkB,MAAM,IAAIwB,IAAIsC,IAAI9D,GAAG,EAAE;gBAE7B,IAAIA,IAAImE,QAAQ,KAAK5C,KAAK6C,YAAY,EAAE;oBACtCL,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAa;oBAClDD,IAAIE,GAAG,CAAC;oBACR;gBACF;gBAEA,MAAMlC,OAAO/B,IAAIyB,YAAY,CAACoB,GAAG,CAAC;gBAClC,MAAMhE,QAAQmB,IAAIyB,YAAY,CAACoB,GAAG,CAAC;gBACnC,MAAMlD,QAAQK,IAAIyB,YAAY,CAACoB,GAAG,CAAC;gBAEnC,IAAIhE,OAAO;oBACTkF,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACjH,iBAAiB6B;oBACzB0C,KAAK2C,OAAO,CAAC,IAAIpF,MAAM,CAAC,aAAa,EAAED,OAAO;oBAC9C;gBACF;gBAEA,IAAI,CAACkD,MAAM;oBACTgC,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACjH,iBAAiB;oBACzBuE,KAAK2C,OAAO,CAAC,IAAIpF,MAAM;oBACvB;gBACF;gBAEA,IAAI,CAACa,OAAO;oBACVoE,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACjH,iBAAiB;oBACzBuE,KAAK2C,OAAO,CAAC,IAAIpF,MAAM;oBACvB;gBACF;gBAEA,IAAI;oBACF,MAAM,IAAI,CAAC4E,oBAAoB,CAAC;wBAC9B3B;wBACApC;wBACAP,aAAamC,KAAK8C,gBAAgB;oBACpC;oBAEAN,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAAChH;oBAERsE,KAAK+C,MAAM;gBACb,EAAE,OAAOC,eAAe;oBACtBvG,OAAOa,KAAK,CAAC,yBAAyB;wBAAEA,OAAO0F,yBAAyBzF,QAAQyF,cAAcxF,OAAO,GAAGC,OAAOuF;oBAAe;oBAC9HR,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACjH,iBAAiB;oBACzBuE,KAAK2C,OAAO,CAACK;gBACf;YACF,EAAE,OAAOC,YAAY;gBACnBxG,OAAOa,KAAK,CAAC,+BAA+B;oBAAEA,OAAO2F,sBAAsB1F,QAAQ0F,WAAWzF,OAAO,GAAGC,OAAOwF;gBAAY;gBAC3HT,IAAIC,SAAS,CAAC,KAAK;oBAAE,gBAAgB;gBAAY;gBACjDD,IAAIE,GAAG,CAACjH,iBAAiB;gBACzBuE,KAAK2C,OAAO,CAACM;YACf;QACF;IACF;IAEA;;;GAGC,GACD,MAAcrE,0BAAuD;QACnE,MAAM,EAAElB,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAEc,QAAQ,EAAEjC,MAAM,EAAEoB,aAAaqF,iBAAiB,EAAExG,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAExH,6DAA6D;QAC7D,IAAIuG,aAAa,aAAa,4CAA4C;QAC1E,IAAIC,aAAa,GAAG,sCAAsC;QAE1D,wEAAwE;QACxE,IAAIP,eAAe,aAAa,wBAAwB;QACxD,IAAIQ,mBAAmB;QAEvB,IAAIH,mBAAmB;YACrB,IAAI;gBACF,MAAMI,SAAS,IAAIrD,IAAIiD;gBACvB,MAAMK,aAAaD,OAAOE,QAAQ,KAAK,eAAeF,OAAOE,QAAQ,KAAK;gBAE1E,IAAID,YAAY;oBACd,8DAA8D;oBAC9DJ,aAAaG,OAAOE,QAAQ;oBAC5BJ,aAAaE,OAAOG,IAAI,GAAGC,OAAOC,QAAQ,CAACL,OAAOG,IAAI,EAAE,MAAM;gBAChE,OAAO;oBACL,iEAAiE;oBACjE,+EAA+E;oBAC/E,wEAAwE;oBACxEN,aAAa;oBACb,MAAMS,UAAUC,QAAQC,GAAG,CAACC,IAAI,GAAGL,OAAOC,QAAQ,CAACE,QAAQC,GAAG,CAACC,IAAI,EAAE,MAAMnD;oBAC3EwC,aAAaQ,WAAWF,OAAOM,QAAQ,CAACJ,WAAWA,UAAU;gBAC/D;gBAEA,iCAAiC;gBACjC,IAAIN,OAAOV,QAAQ,IAAIU,OAAOV,QAAQ,KAAK,KAAK;oBAC9CC,eAAeS,OAAOV,QAAQ;gBAChC;gBAEAS,mBAAmB;gBAEnB5G,OAAOK,KAAK,CAAC,iCAAiC;oBAC5CqG;oBACAC;oBACAP;oBACAhF,aAAaqF;oBACbK;gBACF;YACF,EAAE,OAAOjG,OAAO;gBACdb,OAAOwH,IAAI,CAAC,yDAAyD;oBACnEpG,aAAaqF;oBACb5F,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBACzD;YACA,8DAA8D;YAChE;QACF;QAEA,kCAAkC;QAClC,MAAM,EAAEQ,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAG1C;QAC7D,MAAM2C,UAAUnC;QAEhB,kDAAkD;QAClD,MAAM,IAAI,CAACoC,iBAAiB,CAAC;YAAEC,OAAOF;YAASH;QAAa;QAE5D,IAAImG,SAA6B;QACjC,IAAIC;QACJ,IAAIrB,kBAA0B,mBAAmB;QAEjD,2DAA2D;QAC3DoB,SAAS,IAAI,CAAC7B,yBAAyB,CAAC;YACtCQ;YACAC,kBAAkB,IAAMA;YACxBC,QAAQ;gBACNmB,mBAAAA,6BAAAA,OAAQE,KAAK;YACf;YACAzB,SAAS,CAAC0B;gBACR5H,OAAOa,KAAK,CAAC,gCAAgC;oBAAEA,OAAO+G,eAAe9G,QAAQ8G,IAAI7G,OAAO,GAAGC,OAAO4G;gBAAK;gBACvGH,mBAAAA,6BAAAA,OAAQE,KAAK;YACf;QACF;QAEA,kBAAkB;QAClB,MAAM,IAAIpC,QAAc,CAACsC,SAASC;YAChCL,mBAAAA,6BAAAA,OAAQM,MAAM,CAACpB,YAAYD,YAAY;gBACrC,MAAMsB,UAAUP,mBAAAA,6BAAAA,OAAQO,OAAO;gBAC/B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;oBAC3CP,mBAAAA,6BAAAA,OAAQE,KAAK;oBACbG,OAAO,IAAIhH,MAAM;oBACjB;gBACF;gBAEA4G,aAAaM,QAAQhB,IAAI;gBAEzB,+BAA+B;gBAC/B,IAAIJ,oBAAoBH,mBAAmB;oBACzCJ,mBAAmBI;gBACrB,OAAO;oBACLJ,mBAAmB,CAAC,iBAAiB,EAAEqB,aAAatB,cAAc;gBACpE;gBAEApG,OAAOU,IAAI,CAAC,kCAAkC;oBAAEsG,MAAMU;oBAAYzF;oBAAUhC;gBAAQ;gBAEpF4H;YACF;QACF;QAEA,6DAA6D;QAC7DpC,WAAW;YACT,IAAIgC,QAAQ;gBACVA,OAAOE,KAAK;gBACZ,oDAAoD;gBACpD,0DAA0D;gBAC1D,KAAKzH,WAAW4E,MAAM,CAAC,IAAI,CAACN,UAAU,CAAC/C;YACzC;QACF,GAAG9B;QAEH,kDAAkD;QAClD,MAAMiC,UAAU,IAAI,CAACC,YAAY,CAAC;YAChCX;YACAD;YACAG,aAAaiF;YACblF;YACAK;YACAG,OAAOF;QACT;QAEA,OAAO;YACLK,MAAM;YACNC,UAAU9B;YACV+B,KAAKJ;QACP;IACF;IAEA,MAAckC,qBAAqBC,IAAY,EAAEzC,YAAoB,EAAEF,WAAmB,EAA0B;QAClH,MAAM,EAAEH,QAAQ,EAAEgH,YAAY,EAAE/G,QAAQ,EAAE,GAAG,IAAI,CAACf,MAAM;QAExD,MAAM+H,WAAW,CAAC,kCAAkC,EAAEhH,SAAS,kBAAkB,CAAC;QAClF,MAAMiH,SAAiC;YACrCpE;YACAqE,WAAWnH;YACXoH,cAAcjH;YACdkH,YAAY;YACZC,eAAejH;QACjB;QAEA,sDAAsD;QACtD,IAAI2G,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM3F,WAAW,MAAM/C,iBAAiByI,UAAU;YAChDS,QAAQ;YACRlG,SAAS;gBACP,gBAAgB;YAClB;YACAgG,MAAMA,KAAK9E,QAAQ;QACrB;QAEA,IAAI,CAACnB,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAI/B,MAAM,CAAC,uBAAuB,EAAE0B,SAASI,MAAM,CAAC,CAAC,EAAES,WAAW;QAC1E;QAEA,OAAQ,MAAMb,SAASM,IAAI;IAC7B;IAEA,MAAclC,mBAAmBH,YAAoB,EAAwB;QAC3E,MAAM,EAAEQ,QAAQ,EAAEgH,YAAY,EAAE/G,QAAQ,EAAE,GAAG,IAAI,CAACf,MAAM;QAExD,MAAM+H,WAAW,CAAC,kCAAkC,EAAEhH,SAAS,kBAAkB,CAAC;QAClF,MAAMiH,SAAiC;YACrCjE,eAAezD;YACf2H,WAAWnH;YACXqH,YAAY;QACd;QAEA,sDAAsD;QACtD,IAAIL,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,qEAAqE;QAErE,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM3F,WAAW,MAAM/C,iBAAiByI,UAAU;YAChDS,QAAQ;YACRlG,SAAS;gBACP,gBAAgB;YAClB;YACAgG,MAAMA,KAAK9E,QAAQ;QACrB;QAEA,IAAI,CAACnB,SAASG,EAAE,EAAE;YAChB,MAAMU,YAAY,MAAMb,SAASK,IAAI;YACrC,MAAM,IAAI/B,MAAM,CAAC,sBAAsB,EAAE0B,SAASI,MAAM,CAAC,CAAC,EAAES,WAAW;QACzE;QAEA,MAAMQ,gBAAiB,MAAMrB,SAASM,IAAI;QAE1C,OAAO;YACLtC,aAAaqD,cAAcI,YAAY;YACvCxD,cAAcA;YACd,GAAIoD,cAAcO,UAAU,KAAKD,aAAa;gBAAElB,WAAWC,KAAKC,GAAG,KAAKU,cAAcO,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIP,cAAc1C,KAAK,KAAKgD,aAAa;gBAAEhD,OAAO0C,cAAc1C,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;;GAMC,GACD,MAAMyH,oBAAoBT,MAAwC,EAAkD;QAClH,MAAM,EAAEpE,IAAI,EAAEpC,KAAK,EAAE,GAAGwG;QACxB,MAAM,EAAE/G,WAAW,EAAE,GAAG,IAAI,CAACjB,MAAM;QAEnC,IAAI,CAACwB,OAAO;YACV,MAAM,IAAIb,MAAM;QAClB;QAEA,IAAI,CAACM,aAAa;YAChB,MAAM,IAAIN,MAAM;QAClB;QAEA,0DAA0D;QAC1D,OAAO,MAAM,IAAI,CAAC4E,oBAAoB,CAAC;YAAE3B;YAAMpC;YAAOP;QAAY;IACpE;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACDyH,iBAAiB;QACf,MAAM,EAAE5I,OAAO,EAAEC,UAAU,EAAEF,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAEnD,0EAA0E;QAC1E,sFAAsF;QACtF,MAAM2I,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,YAAYF,OAAOG,IAAI;YAC7B,MAAMC,kBAAkBJ,OAAOK,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,oFAAoF;gBACpF,IAAIC;gBACJ,IAAID,QAAQE,MAAM,IAAIR,eAAe;oBACnC,uEAAuE;oBACvEO,QAASD,OAAO,CAAC,EAAE,IAAI,OAAOA,OAAO,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC;oBAC9DA,OAAO,CAACN,cAAc,GAAGO;gBAC3B,OAAO;oBACLA,QAASD,OAAO,CAACN,cAAc,IAAI,CAAC;oBACpCM,OAAO,CAACN,cAAc,GAAGO;gBAC3B;gBAEA,+CAA+C;gBAC/C,MAAME,6BAA6B;oBACjC,IAAI;wBACF,qDAAqD;wBACrD,IAAI1J;wBACJ,IAAI;;gCACUwJ;4BAAZxJ,qBAAYwJ,eAAAA,MAAMG,KAAK,cAAXH,mCAAAA,aAAaxJ,SAAS,uCAAK,MAAMhB,iBAAiBmB,YAAY;gCAAED;4BAAQ;wBACtF,EAAE,OAAOY,OAAO;4BACd,IAAIA,iBAAiBC,SAAW,CAAA,AAACD,MAA4BkD,IAAI,KAAK,6BAA6BlD,MAAMqI,IAAI,KAAK,qBAAoB,GAAgB;gCACpJnJ,YAAYoE;4BACd,OAAO;gCACL,MAAMtD;4BACR;wBACF;wBAEA,sDAAsD;wBACtD,MAAM,IAAI,CAACf,cAAc,CAACC;wBAE1B,4EAA4E;wBAC5E,MAAMK,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMhB,iBAAiBmB,YAAY;4BAAED;wBAAQ;wBACtF,IAAI,CAACG,oBAAoB;4BACvB,MAAM,IAAIU,MAAM,CAAC,8CAA8C,EAAEb,SAAS;wBAC5E;wBAEA,OAAOG;oBACT,EAAE,OAAOS,OAAO;wBACd,IAAIA,iBAAiBnB,qBAAqBmB,MAAMqB,UAAU,CAACJ,IAAI,KAAK,YAAY;4BAC9E,sFAAsF;4BACtF,IAAI,IAAI,CAAC3B,MAAM,CAAC8B,QAAQ,EAAE,MAAMpB;4BAEhC,yFAAyF;4BACzF,MAAMe,UAAU,IAAI4B,IAAI3C,MAAMqB,UAAU,CAACF,GAAG;4BAC5C,MAAML,QAAQC,QAAQ6B,YAAY,CAACoB,GAAG,CAAC;4BACvC,IAAI,CAAClD,OAAO,MAAM,IAAIb,MAAM;4BAE5B,IAAI,CAAC,IAAI,CAAC6I,YAAY,CAACC,GAAG,CAACjI,QAAQ;gCACjC,IAAI,CAACgI,YAAY,CAACE,GAAG,CAAClI;gCACtBnC,KAAKqB,MAAMqB,UAAU,CAACF,GAAG,EAAE8H,KAAK,CAAC,CAACC;oCAChC/J,OAAOU,IAAI,CAAC,wCAAwC;wCAAEG,OAAOkJ,aAAajJ,QAAQiJ,EAAEhJ,OAAO,GAAGC,OAAO+I;oCAAG;gCAC1G;4BACF;4BAEA,8CAA8C;4BAC9C,MAAM,IAAI,CAAC3E,sBAAsB,CAACzD;4BAElC,oDAAoD;4BACpD,MAAM,IAAI,CAACwD,iBAAiB,CAACxD;4BAE7B,yBAAyB;4BACzB,OAAO,MAAM8H;wBACf;wBAEA,MAAM5I;oBACR;gBACF;gBAEA,IAAI;oBACF,MAAMT,qBAAqB,MAAMqJ;oBACjC,MAAMO,OAAO,IAAI,CAAC5H,cAAc,CAAChC;oBAEjC,2CAA2C;oBAC1CmJ,MAAwCU,WAAW,GAAG;wBACrDD;wBACAjK,WAAWK;oBACb;oBACCmJ,MAA+BvJ,MAAM,GAAGA;oBAEzC,sCAAsC;oBACtC,OAAO,MAAMmJ,mBAAmBG;gBAClC,EAAE,OAAOzI,OAAO;oBACd,wDAAwD;oBACxD,IAAIA,iBAAiBnB,mBAAmB;wBACtCM,OAAOU,IAAI,CAAC,2BAA2B;4BACrCT;4BACAiK,MAAMjB;4BACN/G,YAAYrB,MAAMqB,UAAU;wBAC9B;wBAEA,yFAAyF;wBACzF,2GAA2G;wBAC3G,MAAMiI,uBAAuB;4BAC3BC,MAAM;4BACNrI,UAAU9B;4BACVc,SAAS,CAAC,4BAA4B,EAAEkI,UAAU,2BAA2B,EAAEhJ,QAAQ,CAAC,CAAC;4BACzF+B,KAAKnB,MAAMqB,UAAU,CAACJ,IAAI,KAAK,aAAajB,MAAMqB,UAAU,CAACF,GAAG,GAAGmC;wBACrE;wBAEA,OAAO;4BACLkG,SAAS;gCACP;oCACED,MAAM;oCACNvH,MAAMyH,KAAKC,SAAS,CAAC;wCAAE5E,QAAQwE;oCAAqB;gCACtD;6BACD;4BACDK,mBAAmB;gCAAE7E,QAAQwE;4BAAqB;wBACpD;oBACF;oBAEA,2BAA2B;oBAC3B,MAAMtJ;gBACR;YACF;YAEA,OAAO;gBACL,GAAGkI,MAAM;gBACTK,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDoB,cAAc,CAAgE1B,SAAcD,eAAeC,QAAQ;YACnH2B,kBAAkB,CAAqF3B,SAAcD,eAAeC,QAAQ;YAC5I4B,gBAAgB,CAAgE5B,SAAcD,eAAeC,QAAQ;QACvH;IACF;IAtyBA,YAAY5I,MAA2B,CAAE;QAHzC,6FAA6F;aACrFwJ,eAAe,IAAIiB;QAGzB,IAAI,CAACzK,MAAM,GAAGA;IAChB;AAqyBF;AAEA;;;CAGC,GACD,OAAO,SAAS0K,wBAAwB1K,MAA2B;IACjE,OAAO,IAAIN,sBAAsBM;AACnC"}

package/dist/esm/schemas/index.js

@@ -7,7 +7,7 @@ export const AuthRequiredBranchSchema = z.object({
 });
 export const AuthRequiredSchema = z.object({
     type: z.literal('auth_required'),
-    provider: z.string().describe('OAuth provider name (e.g., "google")'),
+    provider: z.string().describe('OAuth provider name (e.g., "microsoft")'),
     message: z.string().describe('Human-readable message explaining why auth is needed'),
     url: z.string().url().describe('Authentication URL to open in browser'),
     flow: z.string().optional().describe('Authentication flow type (e.g., "auth_url", "device_code")'),

package/dist/esm/schemas/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/schemas/index.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const AuthRequiredBranchSchema = z.object({\n  type: z.literal('auth_required'),\n  provider: z.string(),\n  message: z.string(),\n  url: z.string().optional(),\n});\nexport type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;\n\nexport const AuthRequiredSchema = z\n  .object({\n    type: z.literal('auth_required'),\n    provider: z.string().describe('OAuth provider name (e.g., \"google\")'),\n    message: z.string().describe('Human-readable message explaining why auth is needed'),\n    url: z.string().url().describe('Authentication URL to open in browser'),\n    flow: z.string().optional().describe('Authentication flow type (e.g., \"auth_url\", \"device_code\")'),\n    instructions: z.string().describe('Clear instructions for the user'),\n    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),\n    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),\n    accountId: z.string().optional().describe('Account identifier (email) that requires authentication'),\n  })\n  .describe('Authentication required with clear actionable instructions for user');\n\nexport type AuthRequired = z.infer<typeof AuthRequiredSchema>;\n"],"names":["z","AuthRequiredBranchSchema","object","type","literal","provider","string","message","url","optional","AuthRequiredSchema","describe","flow","instructions","user_code","expires_in","number","accountId"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAM;AAExB,OAAO,MAAMC,2BAA2BD,EAAEE,MAAM,CAAC;IAC/CC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM;IAClBC,SAASP,EAAEM,MAAM;IACjBE,KAAKR,EAAEM,MAAM,GAAGG,QAAQ;AAC1B,GAAG;AAGH,OAAO,MAAMC,qBAAqBV,EAC/BE,MAAM,CAAC;IACNC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC9BJ,SAASP,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC7BH,KAAKR,EAAEM,MAAM,GAAGE,GAAG,GAAGG,QAAQ,CAAC;IAC/BC,MAAMZ,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IACrCE,cAAcb,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAClCG,WAAWd,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IAC1CI,YAAYf,EAAEgB,MAAM,GAAGP,QAAQ,GAAGE,QAAQ,CAAC;IAC3CM,WAAWjB,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;AAC5C,GACCA,QAAQ,CAAC,uEAAuE"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/schemas/index.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const AuthRequiredBranchSchema = z.object({\n  type: z.literal('auth_required'),\n  provider: z.string(),\n  message: z.string(),\n  url: z.string().optional(),\n});\nexport type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;\n\nexport const AuthRequiredSchema = z\n  .object({\n    type: z.literal('auth_required'),\n    provider: z.string().describe('OAuth provider name (e.g., \"microsoft\")'),\n    message: z.string().describe('Human-readable message explaining why auth is needed'),\n    url: z.string().url().describe('Authentication URL to open in browser'),\n    flow: z.string().optional().describe('Authentication flow type (e.g., \"auth_url\", \"device_code\")'),\n    instructions: z.string().describe('Clear instructions for the user'),\n    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),\n    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),\n    accountId: z.string().optional().describe('Account identifier (email) that requires authentication'),\n  })\n  .describe('Authentication required with clear actionable instructions for user');\n\nexport type AuthRequired = z.infer<typeof AuthRequiredSchema>;\n"],"names":["z","AuthRequiredBranchSchema","object","type","literal","provider","string","message","url","optional","AuthRequiredSchema","describe","flow","instructions","user_code","expires_in","number","accountId"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAM;AAExB,OAAO,MAAMC,2BAA2BD,EAAEE,MAAM,CAAC;IAC/CC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM;IAClBC,SAASP,EAAEM,MAAM;IACjBE,KAAKR,EAAEM,MAAM,GAAGG,QAAQ;AAC1B,GAAG;AAGH,OAAO,MAAMC,qBAAqBV,EAC/BE,MAAM,CAAC;IACNC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC9BJ,SAASP,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC7BH,KAAKR,EAAEM,MAAM,GAAGE,GAAG,GAAGG,QAAQ,CAAC;IAC/BC,MAAMZ,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IACrCE,cAAcb,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAClCG,WAAWd,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IAC1CI,YAAYf,EAAEgB,MAAM,GAAGP,QAAQ,GAAGE,QAAQ,CAAC;IAC3CM,WAAWjB,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;AAC5C,GACCA,QAAQ,CAAC,uEAAuE"}

package/dist/esm/setup/config.d.ts

@@ -9,8 +9,11 @@ import type { DcrConfig, OAuthConfig } from '../types.js';
 export type { DcrConfig, OAuthConfig };
 /**
  * Transport type for MCP servers
+ *
+ * - 'stdio': Standard input/output transport
+ * - 'http': HTTP transport
  */
-type TransportType = 'stdio' | 'http';
+export type TransportType = 'stdio' | 'http';
 /**
  * Parse Microsoft OAuth configuration from CLI arguments and environment variables.
  *

package/dist/esm/setup/config.js

@@ -120,14 +120,17 @@
     if (auth === 'dcr' && transport === 'stdio') {
         throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');
     }
-    // Parse headless mode
-    const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
-    const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
-    const headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : false;
     // Parse redirect-uri (CLI overrides ENV)
     const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;
     const envRedirectUri = env.REDIRECT_URI;
     const redirectUri = cliRedirectUri !== null && cliRedirectUri !== void 0 ? cliRedirectUri : envRedirectUri;
+    if (redirectUri && transport === 'stdio') {
+        throw new Error('REDIRECT_URI requires HTTP transport. The OAuth callback must be served over HTTP.');
+    }
+    // Parse headless mode
+    const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
+    const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
+    const headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : redirectUri !== undefined; // default for redirectUri is headless (assume server http deployment); otherwise assume local and non-headless
     // Parse tenant-id (CLI overrides environment)
     const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;
     const tenantId = cliTenantId !== null && cliTenantId !== void 0 ? cliTenantId : requiredEnv('MS_TENANT_ID');

package/dist/esm/setup/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/setup/config.ts"],"sourcesContent":["/**\n * Microsoft OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Microsoft OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for external use\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * Auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'device-code' | 'dcr';\n\n/**\n * Parse OAuth mode string into auth mode.\n *\n * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('device-code')      // { auth: 'device-code' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  // Validate auth mode\n  if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, device-code, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n */\ntype TransportType = 'stdio' | 'http';\n\n/**\n * Parse Microsoft OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - AUTH_MODE: OAuth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n * @returns Parsed Microsoft OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=device-code'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - device-code\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Microsoft OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse OAuth mode\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  // Parse headless mode\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? false;\n\n  // Parse redirect-uri (CLI overrides ENV)\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    clientId,\n    tenantId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse DCR mode (CLI overrides environment)\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  // Validate DCR mode\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  // Parse verify URL (CLI overrides environment)\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  // Parse store URI (CLI overrides environment)\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  // Validate mode-specific required fields\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    tenantId,\n    scope,\n  };\n}\n"],"names":["parseArgs","parseAuthMode","value","Error","auth","parseConfig","args","env","transport","cliHeadless","requiredEnv","key","values","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","envHeadless","HEADLESS","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","cliTenantId","tenantId","clientId","clientSecret","MS_CLIENT_SECRET","createConfig","process","argv","parseDcrConfig","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,SAAS,QAAQ,OAAO;AAWjC;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,qBAAqB;IACrB,IAAIA,UAAU,oBAAoBA,UAAU,iBAAiBA,UAAU,OAAO;QAC5E,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAED,MAAM,iDAAiD,CAAC;IACpG;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GACD,OAAO,SAASG,YAAYC,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QA6C3FC;IA5CjB,SAASC,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,gCAAgC,CAAC;QAC/E;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,mBAAmB;IACnB,MAAMC,UAAU,OAAON,OAAOR,IAAI,KAAK,WAAWQ,OAAOR,IAAI,GAAGe;IAChE,MAAMC,cAAcb,IAAIc,SAAS;IACjC,MAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,MAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASI,cAAc,SAAS;QAC3C,MAAM,IAAIL,MAAM;IAClB;IAEA,sBAAsB;IACtB,MAAMM,cAAc,OAAOG,OAAOG,QAAQ,KAAK,YAAYH,OAAOG,QAAQ,GAAGI;IAC7E,MAAMK,cAAcjB,IAAIkB,QAAQ,KAAK,SAAS,OAAOlB,IAAIkB,QAAQ,KAAK,UAAU,QAAQN;IACxF,MAAMJ,YAAWN,OAAAA,wBAAAA,yBAAAA,cAAee,yBAAff,kBAAAA,OAA8B;IAE/C,yCAAyC;IACzC,MAAMiB,iBAAiB,OAAOd,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGO;IAC7F,MAAMQ,iBAAiBpB,IAAIqB,YAAY;IACvC,MAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IAEtC,8CAA8C;IAC9C,MAAMG,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLF;QACAD;QACA,GAAIE,gBAAgB;YAAEA;QAAa,CAAC;QACpC7B;QACAW;QACA,GAAIc,eAAe;YAAEA;QAAY,CAAC;IACpC;AACF;AAEA;;;CAGC,GACD,OAAO,SAASM;IACd,OAAO9B,YAAY+B,QAAQC,IAAI,EAAED,QAAQ7B,GAAG;AAC9C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GACD,OAAO,SAAS+B,eAAehC,IAAc,EAAEC,GAAuC,EAAEgC,KAAa;IACnG,SAAS7B,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,kCAAkC,CAAC;QACjF;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;YAClC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,6CAA6C;IAC7C,MAAMuB,UAAU,OAAO5B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGO;IAC9E,MAAMsB,UAAUlC,IAAImC,QAAQ;IAC5B,MAAMpB,OAAOkB,WAAWC,WAAW;IAEnC,oBAAoB;IACpB,IAAInB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,CAAC,2BAA2B,EAAEmB,KAAK,sCAAsC,CAAC;IAC5F;IAEA,+CAA+C;IAC/C,MAAMqB,eAAe,OAAO/B,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGO;IAC/F,MAAMyB,eAAerC,IAAIsC,cAAc;IACvC,MAAMC,YAAYH,gBAAgBC;IAElC,8CAA8C;IAC9C,MAAMG,cAAc,OAAOnC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGO;IAC5F,MAAM6B,cAAczC,IAAI0C,aAAa;IACrC,MAAMC,WAAWH,eAAeC;IAEhC,yCAAyC;IACzC,IAAI1B,SAAS,cAAc,CAACwB,WAAW;QACrC,MAAM,IAAI3C,MAAM;IAClB;IAEA,8CAA8C;IAC9C,MAAM2B,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLZ;QACA,GAAIwB,aAAa;YAAEA;QAAU,CAAC;QAC9B,GAAII,YAAY;YAAEA;QAAS,CAAC;QAC5BlB;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpCF;QACAQ;IACF;AACF"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/setup/config.ts"],"sourcesContent":["/**\n * Microsoft OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Microsoft OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for external use\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * Auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'device-code' | 'dcr';\n\n/**\n * Parse OAuth mode string into auth mode.\n *\n * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('device-code')      // { auth: 'device-code' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  // Validate auth mode\n  if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, device-code, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n *\n * - 'stdio': Standard input/output transport\n * - 'http': HTTP transport\n */\nexport type TransportType = 'stdio' | 'http';\n\n/**\n * Parse Microsoft OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - AUTH_MODE: OAuth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n * @returns Parsed Microsoft OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=device-code'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - device-code\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Microsoft OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse OAuth mode\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  // Parse redirect-uri (CLI overrides ENV)\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n  if (redirectUri && transport === 'stdio') {\n    throw new Error('REDIRECT_URI requires HTTP transport. The OAuth callback must be served over HTTP.');\n  }\n\n  // Parse headless mode\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? redirectUri !== undefined; // default for redirectUri is headless (assume server http deployment); otherwise assume local and non-headless\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    clientId,\n    tenantId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse DCR mode (CLI overrides environment)\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  // Validate DCR mode\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  // Parse verify URL (CLI overrides environment)\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  // Parse store URI (CLI overrides environment)\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  // Validate mode-specific required fields\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    tenantId,\n    scope,\n  };\n}\n"],"names":["parseArgs","parseAuthMode","value","Error","auth","parseConfig","args","env","transport","cliHeadless","requiredEnv","key","values","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","envHeadless","HEADLESS","cliTenantId","tenantId","clientId","clientSecret","MS_CLIENT_SECRET","createConfig","process","argv","parseDcrConfig","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,SAAS,QAAQ,OAAO;AAWjC;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,qBAAqB;IACrB,IAAIA,UAAU,oBAAoBA,UAAU,iBAAiBA,UAAU,OAAO;QAC5E,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAED,MAAM,iDAAiD,CAAC;IACpG;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAUA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GACD,OAAO,SAASG,YAAYC,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QAqD3FC;IApDjB,SAASC,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,gCAAgC,CAAC;QAC/E;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,mBAAmB;IACnB,MAAMC,UAAU,OAAON,OAAOR,IAAI,KAAK,WAAWQ,OAAOR,IAAI,GAAGe;IAChE,MAAMC,cAAcb,IAAIc,SAAS;IACjC,MAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,MAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASI,cAAc,SAAS;QAC3C,MAAM,IAAIL,MAAM;IAClB;IAEA,yCAAyC;IACzC,MAAMqB,iBAAiB,OAAOZ,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGO;IAC7F,MAAMM,iBAAiBlB,IAAImB,YAAY;IACvC,MAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IACtC,IAAIE,eAAenB,cAAc,SAAS;QACxC,MAAM,IAAIL,MAAM;IAClB;IAEA,sBAAsB;IACtB,MAAMM,cAAc,OAAOG,OAAOG,QAAQ,KAAK,YAAYH,OAAOG,QAAQ,GAAGI;IAC7E,MAAMS,cAAcrB,IAAIsB,QAAQ,KAAK,SAAS,OAAOtB,IAAIsB,QAAQ,KAAK,UAAU,QAAQV;IACxF,MAAMJ,YAAWN,OAAAA,wBAAAA,yBAAAA,cAAemB,yBAAfnB,kBAAAA,OAA8BkB,gBAAgBR,WAAW,+GAA+G;IAEzL,8CAA8C;IAC9C,MAAMW,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLF;QACAD;QACA,GAAIE,gBAAgB;YAAEA;QAAa,CAAC;QACpC7B;QACAW;QACA,GAAIY,eAAe;YAAEA;QAAY,CAAC;IACpC;AACF;AAEA;;;CAGC,GACD,OAAO,SAASQ;IACd,OAAO9B,YAAY+B,QAAQC,IAAI,EAAED,QAAQ7B,GAAG;AAC9C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GACD,OAAO,SAAS+B,eAAehC,IAAc,EAAEC,GAAuC,EAAEgC,KAAa;IACnG,SAAS7B,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,kCAAkC,CAAC;QACjF;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;YAClC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,6CAA6C;IAC7C,MAAMuB,UAAU,OAAO5B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGO;IAC9E,MAAMsB,UAAUlC,IAAImC,QAAQ;IAC5B,MAAMpB,OAAOkB,WAAWC,WAAW;IAEnC,oBAAoB;IACpB,IAAInB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,CAAC,2BAA2B,EAAEmB,KAAK,sCAAsC,CAAC;IAC5F;IAEA,+CAA+C;IAC/C,MAAMqB,eAAe,OAAO/B,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGO;IAC/F,MAAMyB,eAAerC,IAAIsC,cAAc;IACvC,MAAMC,YAAYH,gBAAgBC;IAElC,8CAA8C;IAC9C,MAAMG,cAAc,OAAOnC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGO;IAC5F,MAAM6B,cAAczC,IAAI0C,aAAa;IACrC,MAAMC,WAAWH,eAAeC;IAEhC,yCAAyC;IACzC,IAAI1B,SAAS,cAAc,CAACwB,WAAW;QACrC,MAAM,IAAI3C,MAAM;IAClB;IAEA,8CAA8C;IAC9C,MAAM2B,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLZ;QACA,GAAIwB,aAAa;YAAEA;QAAU,CAAC;QAC9B,GAAII,YAAY;YAAEA;QAAS,CAAC;QAC5BlB;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpCF;QACAQ;IACF;AACF"}

package/dist/esm/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/types.ts"],"sourcesContent":["/**\n * Standalone types for Microsoft OAuth\n * No dependencies on other @mcp-z packages except @mcp-z/oauth\n */\n\n// Import shared types from base @mcp-z/oauth package\n// Public types (will be re-exported)\n// Internal-only types (not re-exported, used by providers)\nimport type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';\nimport type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { Keyv } from 'keyv';\n\n// Re-export only essential shared types for public API\nexport type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };\n\n// Re-export error class\nexport { AuthRequiredError } from '@mcp-z/oauth';\n\n// Make internal types available for internal use without exporting\nexport type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };\n\n// ============================================================================\n// Core Authentication Types\n// ============================================================================\n\n/**\n * Microsoft service types that support OAuth\n * OAuth clients support all Microsoft services provided by Microsoft Graph\n * @public\n */\nexport type MicrosoftService = string;\n\n// ============================================================================\n// Configuration Types\n// ============================================================================\n\n/**\n * OAuth client configuration for upstream provider\n * @public\n */\nexport interface OAuthClientConfig {\n  /** OAuth client ID for upstream provider */\n  clientId: string;\n  /** OAuth client secret (optional for some flows) */\n  clientSecret?: string;\n  /** Tenant/directory ID (for multi-tenant providers) */\n  tenantId?: string;\n}\n\n/**\n * Microsoft OAuth configuration interface.\n * Contains all OAuth-related configuration from CLI arguments and environment variables.\n * @public\n */\nexport interface OAuthConfig {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth adapter mode */\n  auth: 'loopback-oauth' | 'device-code' | 'dcr';\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n/**\n * DCR configuration for dynamic client registration\n * @public\n */\nexport interface DcrConfig {\n  /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */\n  mode: 'self-hosted' | 'external';\n  /** External verification endpoint URL (required for external mode) */\n  verifyUrl?: string;\n  /** DCR client storage URI (required for self-hosted mode) */\n  storeUri?: string;\n  /** OAuth client ID for Microsoft Graph */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Logger instance */\n  logger?: Logger;\n}\n\n/**\n * Configuration for loopback OAuth client\n * @public\n */\nexport interface LoopbackOAuthConfig {\n  /** Microsoft service type (e.g., 'outlook') */\n  service: MicrosoftService;\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string | undefined;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Logger instance */\n  logger: Logger;\n  /** Token storage */\n  tokenStore: Keyv<unknown>;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n// ============================================================================\n// Middleware Types\n// ============================================================================\n\n/**\n * Microsoft Graph AuthenticationProvider interface\n * Used by Microsoft Graph SDK for API authentication\n * @public\n */\nexport interface MicrosoftAuthProvider {\n  getAccessToken: () => Promise<string>;\n}\n\n/**\n * Auth context injected into extra by middleware\n * @public\n */\nexport interface AuthContext {\n  /**\n   * Microsoft Graph AuthenticationProvider ready for Graph SDK\n   * GUARANTEED to exist when handler runs\n   */\n  auth: MicrosoftAuthProvider;\n\n  /**\n   * Account being used (for logging, debugging)\n   */\n  accountId: string;\n\n  /**\n   * User ID (multi-tenant only)\n   */\n}\n\n/**\n * Enriched extra with guaranteed auth context and logger\n * Handlers receive this type - never plain RequestHandlerExtra\n * @public\n */\nexport interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {\n  /**\n   * Auth context injected by middleware\n   * GUARANTEED to exist (middleware catches auth failures)\n   */\n  authContext: AuthContext;\n\n  /**\n   * Logger injected by middleware\n   * GUARANTEED to exist\n   */\n  logger: Logger;\n\n  /**\n   * HTTP request object (for HTTP transport scenarios)\n   * Optional - present when using HTTP transport with JWT/session auth\n   */\n  req?: unknown;\n\n  // Preserve backchannel support\n  _meta?: {\n    accountId?: string;\n    [key: string]: unknown;\n  };\n}\n\n// ============================================================================\n// DCR Internal Types\n// ============================================================================\n\n/**\n * Registered client with full metadata\n * Extends DcrClientInformation with internal timestamps\n * @internal\n */\nexport interface RegisteredClient extends DcrClientInformation {\n  /** Creation timestamp (milliseconds since epoch) */\n  created_at: number;\n}\n\n/**\n * Authorization code data structure\n * @public\n */\nexport interface AuthorizationCode {\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n  scope: string;\n  code_challenge?: string;\n  code_challenge_method?: string;\n  /** Microsoft provider tokens obtained during authorization */\n  providerTokens: ProviderTokens;\n  created_at: number;\n  expires_at: number;\n}\n\n/**\n * Access token data structure\n * @public\n */\nexport interface AccessToken {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  refresh_token?: string;\n  scope: string;\n  client_id: string;\n  /** Microsoft provider tokens */\n  providerTokens: ProviderTokens;\n  created_at: number;\n}\n\n// ============================================================================\n// Schema Types\n// ============================================================================\n\n/**\n * Auth required response interface\n * Re-exported from @mcp-z/oauth for consistency\n */\nexport type { AuthRequired, AuthRequiredBranch } from './schemas/index.ts';\n"],"names":["AuthRequiredError"],"mappings":"AAAA;;;CAGC,GAED,qDAAqD;AACrD,qCAAqC;AACrC,2DAA2D;AAS3D,wBAAwB;AACxB,SAASA,iBAAiB,QAAQ,eAAe"}
+{"version":3,"sources":["/Users/kevin/Dev/Projects/mcp-z/oauth-microsoft/src/types.ts"],"sourcesContent":["/**\n * Standalone types for Microsoft OAuth\n * No dependencies on other @mcp-z packages except @mcp-z/oauth\n */\n\n// Import shared types from base @mcp-z/oauth package\n// Public types (will be re-exported)\n// Internal-only types (not re-exported, used by providers)\nimport type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';\nimport type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';\nimport type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';\nimport type { Keyv } from 'keyv';\n\n// Re-export only essential shared types for public API\nexport type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };\n\n// Re-export error class\nexport { AuthRequiredError } from '@mcp-z/oauth';\n\n// Make internal types available for internal use without exporting\nexport type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };\n\n// ============================================================================\n// Core Authentication Types\n// ============================================================================\n\n/**\n * Microsoft service types that support OAuth\n * OAuth clients support all Microsoft services provided by Microsoft Graph\n * @public\n */\nexport type MicrosoftService = string;\n\n// ============================================================================\n// Configuration Types\n// ============================================================================\n\n/**\n * OAuth client configuration for upstream provider\n * @public\n */\nexport interface OAuthClientConfig {\n  /** OAuth client ID for upstream provider */\n  clientId: string;\n  /** OAuth client secret (optional for some flows) */\n  clientSecret?: string;\n  /** Tenant/directory ID (for multi-tenant providers) */\n  tenantId?: string;\n}\n\n/**\n * Microsoft OAuth configuration interface.\n * Contains all OAuth-related configuration from CLI arguments and environment variables.\n * @public\n */\nexport interface OAuthConfig {\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth adapter mode */\n  auth: 'loopback-oauth' | 'device-code' | 'dcr';\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n/**\n * DCR configuration for dynamic client registration\n * @public\n */\nexport interface DcrConfig {\n  /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */\n  mode: 'self-hosted' | 'external';\n  /** External verification endpoint URL (required for external mode) */\n  verifyUrl?: string;\n  /** DCR client storage URI (required for self-hosted mode) */\n  storeUri?: string;\n  /** OAuth client ID for Microsoft Graph */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Logger instance */\n  logger?: Logger;\n}\n\n/**\n * Configuration for loopback OAuth client\n * @public\n */\nexport interface LoopbackOAuthConfig {\n  /** Microsoft service type (e.g., 'outlook') */\n  service: MicrosoftService;\n  /** OAuth client ID */\n  clientId: string;\n  /** OAuth client secret (optional for public clients) */\n  clientSecret?: string | undefined;\n  /** Azure AD tenant ID */\n  tenantId: string;\n  /** OAuth scopes to request */\n  scope: string;\n  /** Whether to run in headless mode (no browser interaction) */\n  headless: boolean;\n  /** Logger instance */\n  logger: Logger;\n  /** Token storage */\n  tokenStore: Keyv<unknown>;\n  /** Optional redirect URI override (defaults to ephemeral loopback) */\n  redirectUri?: string;\n}\n\n// ============================================================================\n// Middleware Types\n// ============================================================================\n\n/**\n * Microsoft Graph AuthenticationProvider interface\n * Used by Microsoft Graph SDK for API authentication\n * @public\n */\nexport interface MicrosoftAuthProvider {\n  getAccessToken: () => Promise<string>;\n}\n\n/**\n * Auth context injected into extra by middleware\n * @public\n */\nexport interface AuthContext {\n  /**\n   * Microsoft Graph AuthenticationProvider ready for Graph SDK\n   * GUARANTEED to exist when handler runs\n   */\n  auth: MicrosoftAuthProvider;\n\n  /**\n   * Account being used (for logging, debugging)\n   */\n  accountId: string;\n\n  /**\n   * User ID (multi-tenant only)\n   */\n}\n\n/**\n * Enriched extra with guaranteed auth context and logger\n * Handlers receive this type - never plain RequestHandlerExtra\n * @public\n */\nexport interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {\n  /**\n   * Auth context injected by middleware\n   * GUARANTEED to exist (middleware catches auth failures)\n   */\n  authContext: AuthContext;\n\n  /**\n   * Logger injected by middleware\n   * GUARANTEED to exist\n   */\n  logger: Logger;\n\n  /**\n   * HTTP request object (for HTTP transport scenarios)\n   * Optional - present when using HTTP transport with JWT/session auth\n   */\n  req?: unknown;\n\n  // Preserve backchannel support\n  _meta?: {\n    accountId?: string;\n    [key: string]: unknown;\n  };\n}\n\n// ============================================================================\n// DCR Internal Types\n// ============================================================================\n\n/**\n * Registered client with full metadata\n * Extends DcrClientInformation with internal timestamps\n * @internal\n */\nexport interface RegisteredClient extends DcrClientInformation {\n  /** Creation timestamp (milliseconds since epoch) */\n  created_at: number;\n}\n\n/**\n * Authorization code data structure\n * @public\n */\nexport interface AuthorizationCode {\n  code: string;\n  client_id: string;\n  redirect_uri: string;\n  scope: string;\n  code_challenge?: string;\n  code_challenge_method?: string;\n  /** Microsoft provider tokens obtained during authorization */\n  providerTokens: ProviderTokens;\n  created_at: number;\n  expires_at: number;\n}\n\n/**\n * Access token data structure\n * @public\n */\nexport interface AccessToken {\n  access_token: string;\n  token_type: 'Bearer';\n  expires_in: number;\n  refresh_token?: string;\n  scope: string;\n  client_id: string;\n  /** Microsoft provider tokens */\n  providerTokens: ProviderTokens;\n  created_at: number;\n}\n\n// ============================================================================\n// Schema Types\n// ============================================================================\n\n/**\n * Auth required response interface\n * Re-exported from @mcp-z/oauth for consistency\n */\nexport type { AuthRequired, AuthRequiredBranch } from './schemas/index.ts';\n"],"names":["AuthRequiredError"],"mappings":"AAAA;;;CAGC,GAED,qDAAqD;AACrD,qCAAqC;AACrC,2DAA2D;AAS3D,wBAAwB;AACxB,SAASA,iBAAiB,QAAQ,eAAe"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-z/oauth-microsoft",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "OAuth 2.0 client for Microsoft Graph with multi-account support, PKCE security, and swappable storage backends",
   "keywords": [
     "oauth2",