@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/providers/loopback-oauth.js

@@ -0,0 +1,1325 @@
+/**
+ * Loopback OAuth Implementation for Microsoft (RFC 8252)
+ *
+ * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.
+ * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).
+ * Eliminates port conflicts by using port 0, allowing unlimited concurrent servers.
+ *
+ * Flow:
+ * 1. Check token cache (memory + storage)
+ * 2. If cache miss: Start ephemeral server on port 0
+ * 3. Generate auth URL with dynamic redirect (localhost:{assigned-port})
+ * 4. Open browser or print URL (headless flag controls behavior)
+ * 5. Handle callback, exchange code for token
+ * 6. Cache token to storage
+ * 7. Close ephemeral server
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get LoopbackOAuthProvider () {
+        return LoopbackOAuthProvider;
+    },
+    get createMicrosoftFileAuth () {
+        return createMicrosoftFileAuth;
+    }
+});
+var _oauth = require("@mcp-z/oauth");
+var _http = /*#__PURE__*/ _interop_require_wildcard(require("http"));
+var _open = /*#__PURE__*/ _interop_require_default(require("open"));
+var _fetchwithtimeoutts = require("../lib/fetch-with-timeout.js");
+var _typests = require("../types.js");
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var LoopbackOAuthProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function LoopbackOAuthProvider(config) {
+        _class_call_check(this, LoopbackOAuthProvider);
+        this.config = config;
+    }
+    var _proto = LoopbackOAuthProvider.prototype;
+    /**
+   * Get access token from Keyv using compound key
+   *
+   * @param accountId - Account identifier (email address). Required for loopback OAuth.
+   * @returns Access token for API requests
+   */ _proto.getAccessToken = function getAccessToken(accountId) {
+        return _async_to_generator(function() {
+            var _this_config, logger, service, tokenStore, effectiveAccountId, _tmp, storedToken, refreshedToken, error, headless, _this_config1, clientId, tenantId, scope, existingAccounts, hasOtherAccounts, authUrl, hint, baseDescriptor, descriptor, _ref, token, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, logger = _this_config.logger, service = _this_config.service, tokenStore = _this_config.tokenStore;
+                        if (!(accountId !== null && accountId !== void 0)) return [
+                            3,
+                            1
+                        ];
+                        _tmp = accountId;
+                        return [
+                            3,
+                            3
+                        ];
+                    case 1:
+                        return [
+                            4,
+                            (0, _oauth.getActiveAccount)(tokenStore, {
+                                service: service
+                            })
+                        ];
+                    case 2:
+                        _tmp = _state.sent();
+                        _state.label = 3;
+                    case 3:
+                        effectiveAccountId = _tmp;
+                        if (!effectiveAccountId) return [
+                            3,
+                            9
+                        ];
+                        logger.debug('Getting access token', {
+                            service: service,
+                            accountId: effectiveAccountId
+                        });
+                        return [
+                            4,
+                            (0, _oauth.getToken)(tokenStore, {
+                                accountId: effectiveAccountId,
+                                service: service
+                            })
+                        ];
+                    case 4:
+                        storedToken = _state.sent();
+                        if (storedToken && this.isTokenValid(storedToken)) {
+                            logger.debug('Using stored access token', {
+                                accountId: effectiveAccountId
+                            });
+                            return [
+                                2,
+                                storedToken.accessToken
+                            ];
+                        }
+                        if (!(storedToken === null || storedToken === void 0 ? void 0 : storedToken.refreshToken)) return [
+                            3,
+                            9
+                        ];
+                        _state.label = 5;
+                    case 5:
+                        _state.trys.push([
+                            5,
+                            8,
+                            ,
+                            9
+                        ]);
+                        logger.info('Refreshing expired access token', {
+                            accountId: effectiveAccountId
+                        });
+                        return [
+                            4,
+                            this.refreshAccessToken(storedToken.refreshToken)
+                        ];
+                    case 6:
+                        refreshedToken = _state.sent();
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: effectiveAccountId,
+                                service: service
+                            }, refreshedToken)
+                        ];
+                    case 7:
+                        _state.sent();
+                        return [
+                            2,
+                            refreshedToken.accessToken
+                        ];
+                    case 8:
+                        error = _state.sent();
+                        logger.info('Token refresh failed, starting new OAuth flow', {
+                            accountId: effectiveAccountId,
+                            error: _instanceof(error, Error) ? error.message : String(error)
+                        });
+                        return [
+                            3,
+                            9
+                        ];
+                    case 9:
+                        // No valid token or no account - check if we can start OAuth flow
+                        headless = this.config.headless;
+                        if (!headless) return [
+                            3,
+                            11
+                        ];
+                        // In headless mode (production), cannot start OAuth flow
+                        // Throw AuthRequiredError with auth_url descriptor for MCP tool response
+                        _this_config1 = this.config, clientId = _this_config1.clientId, tenantId = _this_config1.tenantId, scope = _this_config1.scope;
+                        return [
+                            4,
+                            this.getExistingAccounts()
+                        ];
+                    case 10:
+                        existingAccounts = _state.sent();
+                        hasOtherAccounts = effectiveAccountId ? existingAccounts.length > 0 && !existingAccounts.includes(effectiveAccountId) : existingAccounts.length > 0;
+                        // Build informational OAuth URL for headless mode
+                        // Note: No redirect_uri included - user must use account-add tool which starts proper ephemeral server
+                        authUrl = new URL("https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/authorize"));
+                        authUrl.searchParams.set('client_id', clientId);
+                        authUrl.searchParams.set('response_type', 'code');
+                        authUrl.searchParams.set('scope', scope);
+                        authUrl.searchParams.set('response_mode', 'query');
+                        authUrl.searchParams.set('prompt', 'select_account');
+                        if (hasOtherAccounts) {
+                            hint = "Existing ".concat(service, " accounts found. Use account-list to view, account-switch to change account, or account-add to add new account");
+                        } else if (effectiveAccountId) {
+                            hint = "Use account-add to authenticate ".concat(effectiveAccountId);
+                        } else {
+                            hint = 'Use account-add to authenticate interactively';
+                        }
+                        baseDescriptor = {
+                            kind: 'auth_url',
+                            provider: 'microsoft',
+                            url: authUrl.toString(),
+                            hint: hint
+                        };
+                        descriptor = effectiveAccountId ? _object_spread_props(_object_spread({}, baseDescriptor), {
+                            accountId: effectiveAccountId
+                        }) : baseDescriptor;
+                        throw new _typests.AuthRequiredError(descriptor);
+                    case 11:
+                        // Interactive mode - start ephemeral OAuth flow
+                        logger.info('Starting ephemeral OAuth flow', {
+                            service: service,
+                            headless: headless
+                        });
+                        return [
+                            4,
+                            this.performEphemeralOAuthFlow()
+                        ];
+                    case 12:
+                        _ref = _state.sent(), token = _ref.token, email = _ref.email;
+                        // Store token with email as accountId
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: email,
+                                service: service
+                            }, token)
+                        ];
+                    case 13:
+                        _state.sent();
+                        // Register account in account management system
+                        return [
+                            4,
+                            (0, _oauth.addAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 14:
+                        _state.sent();
+                        // Set as active account so subsequent getAccessToken() calls find it
+                        return [
+                            4,
+                            (0, _oauth.setActiveAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 15:
+                        _state.sent();
+                        // Store account metadata (email, added timestamp)
+                        return [
+                            4,
+                            (0, _oauth.setAccountInfo)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            }, {
+                                email: email,
+                                addedAt: new Date().toISOString()
+                            })
+                        ];
+                    case 16:
+                        _state.sent();
+                        logger.info('OAuth flow completed', {
+                            service: service,
+                            accountId: email
+                        });
+                        return [
+                            2,
+                            token.accessToken
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Convert to Microsoft Graph-compatible auth provider
+   *
+   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')
+   * @returns Auth provider configured for the specified account
+   */ _proto.toAuthProvider = function toAuthProvider(accountId) {
+        var _this = this;
+        // Capture accountId in closure to pass to getAccessToken
+        var getToken = function() {
+            return _this.getAccessToken(accountId);
+        };
+        return {
+            getAccessToken: getToken
+        };
+    };
+    /**
+   * Authenticate new account with OAuth flow
+   * Triggers account selection, stores token, registers account
+   *
+   * @returns Email address of newly authenticated account
+   * @throws Error in headless mode (cannot open browser for OAuth)
+   */ _proto.authenticateNewAccount = function authenticateNewAccount() {
+        return _async_to_generator(function() {
+            var _this_config, logger, headless, service, tokenStore, _ref, token, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, logger = _this_config.logger, headless = _this_config.headless, service = _this_config.service, tokenStore = _this_config.tokenStore;
+                        if (headless) {
+                            throw new Error('Cannot authenticate new account in headless mode - interactive OAuth required');
+                        }
+                        logger.info('Starting new account authentication', {
+                            service: service
+                        });
+                        return [
+                            4,
+                            this.performEphemeralOAuthFlow()
+                        ];
+                    case 1:
+                        _ref = _state.sent(), token = _ref.token, email = _ref.email;
+                        // Store token
+                        return [
+                            4,
+                            (0, _oauth.setToken)(tokenStore, {
+                                accountId: email,
+                                service: service
+                            }, token)
+                        ];
+                    case 2:
+                        _state.sent();
+                        // Register account
+                        return [
+                            4,
+                            (0, _oauth.addAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 3:
+                        _state.sent();
+                        // Set as active account
+                        return [
+                            4,
+                            (0, _oauth.setActiveAccount)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            })
+                        ];
+                    case 4:
+                        _state.sent();
+                        // Store account metadata
+                        return [
+                            4,
+                            (0, _oauth.setAccountInfo)(tokenStore, {
+                                service: service,
+                                accountId: email
+                            }, {
+                                email: email,
+                                addedAt: new Date().toISOString()
+                            })
+                        ];
+                    case 5:
+                        _state.sent();
+                        logger.info('New account authenticated', {
+                            service: service,
+                            email: email
+                        });
+                        return [
+                            2,
+                            email
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Get user email from Microsoft Graph API (pure query)
+   * Used to query email for existing authenticated account
+   *
+   * @param accountId - Account identifier to get email for
+   * @returns User's email address
+   */ _proto.getUserEmail = function getUserEmail(accountId) {
+        return _async_to_generator(function() {
+            var _userInfo_mail, token, response, _, _1, _2, userInfo;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            this.getAccessToken(accountId)
+                        ];
+                    case 1:
+                        token = _state.sent();
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)('https://graph.microsoft.com/v1.0/me', {
+                                headers: {
+                                    Authorization: "Bearer ".concat(token)
+                                }
+                            })
+                        ];
+                    case 2:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            4
+                        ];
+                        _ = Error.bind;
+                        _2 = (_1 = "Failed to get user info: ".concat(response.status, " ")).concat;
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 3:
+                        throw new (_.apply(Error, [
+                            void 0,
+                            _2.apply(_1, [
+                                _state.sent()
+                            ])
+                        ]));
+                    case 4:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 5:
+                        userInfo = _state.sent();
+                        return [
+                            2,
+                            (_userInfo_mail = userInfo.mail) !== null && _userInfo_mail !== void 0 ? _userInfo_mail : userInfo.userPrincipalName
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Check for existing accounts in token storage (incremental OAuth detection)
+   *
+   * Uses key-utils helper for forward compatibility with key format changes.
+   *
+   * @returns Array of account IDs that have tokens for this service
+   */ _proto.getExistingAccounts = function getExistingAccounts() {
+        return _async_to_generator(function() {
+            var _this_config, service, tokenStore;
+            return _ts_generator(this, function(_state) {
+                _this_config = this.config, service = _this_config.service, tokenStore = _this_config.tokenStore;
+                return [
+                    2,
+                    (0, _oauth.listAccountIds)(tokenStore, service)
+                ];
+            });
+        }).call(this);
+    };
+    _proto.isTokenValid = function isTokenValid(token) {
+        if (!token.expiresAt) return true; // No expiry = assume valid
+        return Date.now() < token.expiresAt - 60000; // 1 minute buffer
+    };
+    /**
+   * Fetch user email from Microsoft Graph using access token
+   * Called during OAuth flow to get email for accountId
+   *
+   * @param accessToken - Fresh access token from OAuth exchange
+   * @returns User's email address (mail field or userPrincipalName fallback)
+   */ _proto.fetchUserEmailFromToken = function fetchUserEmailFromToken(accessToken) {
+        return _async_to_generator(function() {
+            var _userInfo_mail, logger, response, errorText, userInfo, email;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        logger = this.config.logger;
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)('https://graph.microsoft.com/v1.0/me', {
+                                headers: {
+                                    Authorization: "Bearer ".concat(accessToken)
+                                }
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Failed to fetch user email: HTTP ".concat(response.status, " - ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        userInfo = _state.sent();
+                        email = (_userInfo_mail = userInfo.mail) !== null && _userInfo_mail !== void 0 ? _userInfo_mail : userInfo.userPrincipalName;
+                        logger.debug('Fetched user email from Graph API', {
+                            email: email
+                        });
+                        return [
+                            2,
+                            email
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    _proto.performEphemeralOAuthFlow = function performEphemeralOAuthFlow() {
+        return _async_to_generator(function() {
+            var _this, _this_config, clientId, tenantId, scope, headless, logger, configRedirectUri, targetHost, targetPort, targetProtocol, callbackPath, useConfiguredUri, parsed;
+            return _ts_generator(this, function(_state) {
+                _this = this;
+                _this_config = this.config, clientId = _this_config.clientId, tenantId = _this_config.tenantId, scope = _this_config.scope, headless = _this_config.headless, logger = _this_config.logger, configRedirectUri = _this_config.redirectUri;
+                // Parse redirectUri if provided to extract host, protocol, port, and path
+                targetHost = 'localhost'; // Default: localhost (Microsoft requires exact match with registered redirect URI)
+                targetPort = 0; // Default: OS-assigned ephemeral port
+                targetProtocol = 'http:'; // Default: http
+                callbackPath = '/callback'; // Default callback path
+                useConfiguredUri = false;
+                if (configRedirectUri) {
+                    try {
+                        parsed = new URL(configRedirectUri);
+                        // Use configured redirect URI as-is for production deployments
+                        targetHost = parsed.hostname;
+                        targetProtocol = parsed.protocol;
+                        // Extract port from URL (use default ports if not specified)
+                        if (parsed.port) {
+                            targetPort = Number.parseInt(parsed.port, 10);
+                        } else {
+                            targetPort = parsed.protocol === 'https:' ? 443 : 80;
+                        }
+                        // Extract path (default to /callback if URL has no path or just '/')
+                        if (parsed.pathname && parsed.pathname !== '/') {
+                            callbackPath = parsed.pathname;
+                        }
+                        useConfiguredUri = true;
+                        logger.debug('Using configured redirect URI', {
+                            host: targetHost,
+                            protocol: targetProtocol,
+                            port: targetPort,
+                            path: callbackPath,
+                            redirectUri: configRedirectUri
+                        });
+                    } catch (error) {
+                        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {
+                            redirectUri: configRedirectUri,
+                            error: _instanceof(error, Error) ? error.message : String(error)
+                        });
+                    // Continue with defaults (127.0.0.1, port 0, http, /callback)
+                    }
+                }
+                return [
+                    2,
+                    new Promise(function(resolve, reject) {
+                        // Generate PKCE challenge
+                        var _generatePKCE = (0, _oauth.generatePKCE)(), codeVerifier = _generatePKCE.verifier, codeChallenge = _generatePKCE.challenge;
+                        var server = null;
+                        var serverPort;
+                        var finalRedirectUri; // Will be set in server.listen callback
+                        // Create ephemeral server with OS-assigned port (RFC 8252)
+                        server = _http.createServer(function(req, res) {
+                            return _async_to_generator(function() {
+                                var url, code, _$error, tokenResponse, cachedToken, email, exchangeError;
+                                return _ts_generator(this, function(_state) {
+                                    switch(_state.label){
+                                        case 0:
+                                            if (!req.url) {
+                                                res.writeHead(400, {
+                                                    'Content-Type': 'text/html'
+                                                });
+                                                res.end((0, _oauth.getErrorTemplate)('Invalid request'));
+                                                server === null || server === void 0 ? void 0 : server.close();
+                                                reject(new Error('Invalid request: missing URL'));
+                                                return [
+                                                    2
+                                                ];
+                                            }
+                                            url = new URL(req.url, "http://localhost:".concat(serverPort));
+                                            if (!(url.pathname === callbackPath)) return [
+                                                3,
+                                                6
+                                            ];
+                                            code = url.searchParams.get('code');
+                                            _$error = url.searchParams.get('error');
+                                            if (_$error) {
+                                                res.writeHead(400, {
+                                                    'Content-Type': 'text/html'
+                                                });
+                                                res.end((0, _oauth.getErrorTemplate)(_$error));
+                                                server === null || server === void 0 ? void 0 : server.close();
+                                                reject(new Error("OAuth error: ".concat(_$error)));
+                                                return [
+                                                    2
+                                                ];
+                                            }
+                                            if (!code) {
+                                                res.writeHead(400, {
+                                                    'Content-Type': 'text/html'
+                                                });
+                                                res.end((0, _oauth.getErrorTemplate)('No authorization code received'));
+                                                server === null || server === void 0 ? void 0 : server.close();
+                                                reject(new Error('No authorization code received'));
+                                                return [
+                                                    2
+                                                ];
+                                            }
+                                            _state.label = 1;
+                                        case 1:
+                                            _state.trys.push([
+                                                1,
+                                                4,
+                                                ,
+                                                5
+                                            ]);
+                                            return [
+                                                4,
+                                                this.exchangeCodeForToken(code, codeVerifier, finalRedirectUri)
+                                            ];
+                                        case 2:
+                                            tokenResponse = _state.sent();
+                                            // Build cached token
+                                            cachedToken = _object_spread({
+                                                accessToken: tokenResponse.access_token
+                                            }, tokenResponse.refresh_token !== undefined && {
+                                                refreshToken: tokenResponse.refresh_token
+                                            }, tokenResponse.expires_in !== undefined && {
+                                                expiresAt: Date.now() + tokenResponse.expires_in * 1000
+                                            }, tokenResponse.scope !== undefined && {
+                                                scope: tokenResponse.scope
+                                            });
+                                            return [
+                                                4,
+                                                this.fetchUserEmailFromToken(tokenResponse.access_token)
+                                            ];
+                                        case 3:
+                                            email = _state.sent();
+                                            res.writeHead(200, {
+                                                'Content-Type': 'text/html'
+                                            });
+                                            res.end((0, _oauth.getSuccessTemplate)());
+                                            server === null || server === void 0 ? void 0 : server.close();
+                                            resolve({
+                                                token: cachedToken,
+                                                email: email
+                                            });
+                                            return [
+                                                3,
+                                                5
+                                            ];
+                                        case 4:
+                                            exchangeError = _state.sent();
+                                            logger.error('Token exchange failed', {
+                                                error: _instanceof(exchangeError, Error) ? exchangeError.message : String(exchangeError)
+                                            });
+                                            res.writeHead(500, {
+                                                'Content-Type': 'text/html'
+                                            });
+                                            res.end((0, _oauth.getErrorTemplate)('Token exchange failed'));
+                                            server === null || server === void 0 ? void 0 : server.close();
+                                            reject(exchangeError);
+                                            return [
+                                                3,
+                                                5
+                                            ];
+                                        case 5:
+                                            return [
+                                                3,
+                                                7
+                                            ];
+                                        case 6:
+                                            res.writeHead(404, {
+                                                'Content-Type': 'text/plain'
+                                            });
+                                            res.end('Not Found');
+                                            _state.label = 7;
+                                        case 7:
+                                            return [
+                                                2
+                                            ];
+                                    }
+                                });
+                            }).call(_this);
+                        });
+                        // Listen on targetPort (0 for OS assignment, or custom port from redirectUri)
+                        server.listen(targetPort, targetHost, function() {
+                            var address = server === null || server === void 0 ? void 0 : server.address();
+                            if (!address || typeof address === 'string') {
+                                server === null || server === void 0 ? void 0 : server.close();
+                                reject(new Error('Failed to start ephemeral server'));
+                                return;
+                            }
+                            serverPort = address.port;
+                            // Construct final redirect URI
+                            if (useConfiguredUri && configRedirectUri) {
+                                // Use configured redirect URI as-is for production
+                                finalRedirectUri = configRedirectUri;
+                            } else {
+                                // Construct ephemeral redirect URI with actual server port
+                                finalRedirectUri = "".concat(targetProtocol, "//").concat(targetHost, ":").concat(serverPort).concat(callbackPath);
+                            }
+                            // Build Microsoft auth URL
+                            var authUrl = new URL("https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/authorize"));
+                            authUrl.searchParams.set('client_id', clientId);
+                            authUrl.searchParams.set('redirect_uri', finalRedirectUri);
+                            authUrl.searchParams.set('response_type', 'code');
+                            authUrl.searchParams.set('scope', scope);
+                            authUrl.searchParams.set('response_mode', 'query');
+                            authUrl.searchParams.set('code_challenge', codeChallenge);
+                            authUrl.searchParams.set('code_challenge_method', 'S256');
+                            authUrl.searchParams.set('prompt', 'select_account');
+                            logger.info('Ephemeral OAuth server started', {
+                                port: serverPort,
+                                headless: headless
+                            });
+                            if (headless) {
+                                // Headless mode: Print auth URL to stderr (stdout is MCP protocol)
+                                console.error('\n🔐 OAuth Authorization Required');
+                                console.error('📋 Please visit this URL in your browser:\n');
+                                console.error("   ".concat(authUrl.toString(), "\n"));
+                                console.error('⏳ Waiting for authorization...\n');
+                            } else {
+                                // Interactive mode: Open browser automatically
+                                logger.info('Opening browser for OAuth authorization');
+                                (0, _open.default)(authUrl.toString()).catch(function(error) {
+                                    logger.info('Failed to open browser automatically', {
+                                        error: error.message
+                                    });
+                                    console.error('\n🔐 OAuth Authorization Required');
+                                    console.error("   ".concat(authUrl.toString(), "\n"));
+                                });
+                            }
+                        });
+                        // Timeout after 5 minutes
+                        setTimeout(function() {
+                            if (server) {
+                                server.close();
+                                reject(new Error('OAuth flow timed out after 5 minutes'));
+                            }
+                        }, 5 * 60 * 1000);
+                    })
+                ];
+            });
+        }).call(this);
+    };
+    _proto.exchangeCodeForToken = function exchangeCodeForToken(code, codeVerifier, redirectUri) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, clientSecret, tenantId, tokenUrl, params, body, response, errorText;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, clientSecret = _this_config.clientSecret, tenantId = _this_config.tenantId;
+                        tokenUrl = "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/token");
+                        params = {
+                            code: code,
+                            client_id: clientId,
+                            redirect_uri: redirectUri,
+                            grant_type: 'authorization_code',
+                            code_verifier: codeVerifier
+                        };
+                        // Only include client_secret for confidential clients
+                        if (clientSecret) {
+                            params.client_secret = clientSecret;
+                        }
+                        body = new URLSearchParams(params);
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(tokenUrl, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: body.toString()
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token exchange failed: ".concat(response.status, " ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        return [
+                            2,
+                            _state.sent()
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    _proto.refreshAccessToken = function refreshAccessToken(refreshToken) {
+        return _async_to_generator(function() {
+            var _this_config, clientId, clientSecret, tenantId, scope, tokenUrl, params, body, response, errorText, tokenResponse;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        _this_config = this.config, clientId = _this_config.clientId, clientSecret = _this_config.clientSecret, tenantId = _this_config.tenantId, scope = _this_config.scope;
+                        tokenUrl = "https://login.microsoftonline.com/".concat(tenantId, "/oauth2/v2.0/token");
+                        params = {
+                            refresh_token: refreshToken,
+                            client_id: clientId,
+                            grant_type: 'refresh_token',
+                            scope: scope
+                        };
+                        // Only include client_secret for confidential clients
+                        if (clientSecret) {
+                            params.client_secret = clientSecret;
+                        }
+                        body = new URLSearchParams(params);
+                        return [
+                            4,
+                            (0, _fetchwithtimeoutts.fetchWithTimeout)(tokenUrl, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: body.toString()
+                            })
+                        ];
+                    case 1:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            3
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 2:
+                        errorText = _state.sent();
+                        throw new Error("Token refresh failed: ".concat(response.status, " ").concat(errorText));
+                    case 3:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 4:
+                        tokenResponse = _state.sent();
+                        return [
+                            2,
+                            _object_spread({
+                                accessToken: tokenResponse.access_token,
+                                refreshToken: refreshToken
+                            }, tokenResponse.expires_in !== undefined && {
+                                expiresAt: Date.now() + tokenResponse.expires_in * 1000
+                            }, tokenResponse.scope !== undefined && {
+                                scope: tokenResponse.scope
+                            })
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Create auth middleware for single-user context (single active account per service)
+   *
+   * Single-user mode:
+   * - Maintains per-service active accounts in storage
+   * - Supports backchannel account override via extra._meta.accountId
+   * - Automatically enhances output schemas with auth_required branch
+   *
+   * Example:
+   * ```typescript
+   * const loopback = new LoopbackOAuthProvider({ service: 'outlook', ... });
+   * const middleware = loopback.authMiddleware();
+   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);
+   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);
+   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);
+   * ```
+   *
+   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods
+   */ _proto.authMiddleware = function authMiddleware() {
+        var _this = this;
+        var _this_config = this.config, service = _this_config.service, tokenStore = _this_config.tokenStore, logger = _this_config.logger;
+        // Shared wrapper logic - extracts extra parameter from specified position
+        // Generic T captures the actual module type; handler is cast from unknown to callable
+        var wrapAtPosition = function(module, extraPosition) {
+            var _this1 = _this;
+            var operation = module.name;
+            var originalHandler = module.handler;
+            var wrappedHandler = function() {
+                for(var _len = arguments.length, allArgs = new Array(_len), _key = 0; _key < _len; _key++){
+                    allArgs[_key] = arguments[_key];
+                }
+                return _async_to_generator(function() {
+                    var extra, accountId, _ref, _extra__meta, _tmp, error, effectiveAccountId, _tmp1, auth, error1, authRequiredResponse;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                if (allArgs.length <= extraPosition) {
+                                    // Arg-less tool pattern: keep args as-is, create separate extra object
+                                    extra = allArgs[0] && _type_of(allArgs[0]) === 'object' ? {} : {};
+                                    allArgs[extraPosition] = extra;
+                                } else {
+                                    extra = allArgs[extraPosition] || {};
+                                    allArgs[extraPosition] = extra;
+                                }
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    13,
+                                    ,
+                                    14
+                                ]);
+                                _state.label = 2;
+                            case 2:
+                                _state.trys.push([
+                                    2,
+                                    6,
+                                    ,
+                                    7
+                                ]);
+                                if (!((_ref = (_extra__meta = extra._meta) === null || _extra__meta === void 0 ? void 0 : _extra__meta.accountId) !== null && _ref !== void 0)) return [
+                                    3,
+                                    3
+                                ];
+                                _tmp = _ref;
+                                return [
+                                    3,
+                                    5
+                                ];
+                            case 3:
+                                return [
+                                    4,
+                                    (0, _oauth.getActiveAccount)(tokenStore, {
+                                        service: service
+                                    })
+                                ];
+                            case 4:
+                                _tmp = _state.sent();
+                                _state.label = 5;
+                            case 5:
+                                accountId = _tmp;
+                                return [
+                                    3,
+                                    7
+                                ];
+                            case 6:
+                                error = _state.sent();
+                                if (_instanceof(error, Error) && (error.code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError')) {
+                                    accountId = undefined;
+                                } else {
+                                    throw error;
+                                }
+                                return [
+                                    3,
+                                    7
+                                ];
+                            case 7:
+                                // Eagerly validate token exists or trigger OAuth flow
+                                return [
+                                    4,
+                                    this.getAccessToken(accountId)
+                                ];
+                            case 8:
+                                _state.sent();
+                                if (!(accountId !== null && accountId !== void 0)) return [
+                                    3,
+                                    9
+                                ];
+                                _tmp1 = accountId;
+                                return [
+                                    3,
+                                    11
+                                ];
+                            case 9:
+                                return [
+                                    4,
+                                    (0, _oauth.getActiveAccount)(tokenStore, {
+                                        service: service
+                                    })
+                                ];
+                            case 10:
+                                _tmp1 = _state.sent();
+                                _state.label = 11;
+                            case 11:
+                                effectiveAccountId = _tmp1;
+                                if (!effectiveAccountId) {
+                                    throw new Error("No account found after OAuth flow for service ".concat(service));
+                                }
+                                auth = this.toAuthProvider(effectiveAccountId);
+                                // Inject authContext and logger into extra
+                                extra.authContext = {
+                                    auth: auth,
+                                    accountId: effectiveAccountId
+                                };
+                                extra.logger = logger;
+                                return [
+                                    4,
+                                    originalHandler.apply(void 0, _to_consumable_array(allArgs))
+                                ];
+                            case 12:
+                                // Call original handler with all args
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 13:
+                                error1 = _state.sent();
+                                // Token retrieval/refresh failed - return auth required
+                                if (_instanceof(error1, _typests.AuthRequiredError)) {
+                                    logger.info('Authentication required', {
+                                        service: service,
+                                        tool: operation,
+                                        descriptor: error1.descriptor
+                                    });
+                                    // Return auth_required response wrapped in { result } to match tool outputSchema pattern
+                                    // Tools define outputSchema: z.object({ result: discriminatedUnion(...) }) where auth_required is a branch
+                                    authRequiredResponse = {
+                                        type: 'auth_required',
+                                        provider: service,
+                                        message: "Authentication required for ".concat(operation, ". Please authenticate with ").concat(service, "."),
+                                        url: error1.descriptor.kind === 'auth_url' ? error1.descriptor.url : undefined
+                                    };
+                                    return [
+                                        2,
+                                        {
+                                            content: [
+                                                {
+                                                    type: 'text',
+                                                    text: JSON.stringify({
+                                                        result: authRequiredResponse
+                                                    })
+                                                }
+                                            ],
+                                            structuredContent: {
+                                                result: authRequiredResponse
+                                            }
+                                        }
+                                    ];
+                                }
+                                // Other errors - propagate
+                                throw error1;
+                            case 14:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(_this1);
+            };
+            return _object_spread_props(_object_spread({}, module), {
+                handler: wrappedHandler
+            });
+        };
+        return {
+            // Use structural constraints to avoid contravariance check on handler type.
+            // wrapAtPosition is now generic and returns T directly.
+            withToolAuth: function(module) {
+                return wrapAtPosition(module, 1);
+            },
+            withResourceAuth: function(module) {
+                return wrapAtPosition(module, 2);
+            },
+            withPromptAuth: function(module) {
+                return wrapAtPosition(module, 0);
+            }
+        };
+    };
+    return LoopbackOAuthProvider;
+}();
+function createMicrosoftFileAuth(config) {
+    return new LoopbackOAuthProvider(config);
+}
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }