@mcp-z/oauth-microsoft 1.0.0

package/dist/cjs/setup/config.js

@@ -0,0 +1,246 @@
+/**
+ * Microsoft OAuth configuration parsing from CLI arguments and environment variables.
+ *
+ * This module provides utilities to parse Microsoft OAuth configuration from
+ * CLI arguments and environment variables, following the same pattern as @mcp-z/server's
+ * parseConfig().
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get createConfig () {
+        return createConfig;
+    },
+    get parseConfig () {
+        return parseConfig;
+    },
+    get parseDcrConfig () {
+        return parseDcrConfig;
+    }
+});
+var _util = require("util");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+/**
+ * Parse OAuth mode string into auth mode.
+ *
+ * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')
+ * @returns Parsed auth mode
+ * @throws Error if value is invalid
+ *
+ * @example Valid formats
+ * ```typescript
+ * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }
+ * parseAuthMode('device-code')      // { auth: 'device-code' }
+ * parseAuthMode('dcr')              // { auth: 'dcr' }
+ * ```
+ */ function parseAuthMode(value) {
+    // Validate auth mode
+    if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {
+        throw new Error('Invalid --auth value: "'.concat(value, '". Valid values: loopback-oauth, device-code, dcr'));
+    }
+    return {
+        auth: value
+    };
+}
+function parseConfig(args, env, transport) {
+    var _ref;
+    function requiredEnv(key) {
+        var value = env[key];
+        if (!value) {
+            throw new Error("Environment variable ".concat(key, " is required for Microsoft OAuth"));
+        }
+        return value;
+    }
+    // Parse CLI arguments
+    var values = (0, _util.parseArgs)({
+        args: args,
+        options: {
+            auth: {
+                type: 'string'
+            },
+            headless: {
+                type: 'boolean'
+            },
+            'redirect-uri': {
+                type: 'string'
+            },
+            'tenant-id': {
+                type: 'string'
+            }
+        },
+        strict: false,
+        allowPositionals: true
+    }).values;
+    // Parse OAuth mode
+    var authArg = typeof values.auth === 'string' ? values.auth : undefined;
+    var envAuthMode = env.AUTH_MODE;
+    var mode = authArg || envAuthMode;
+    var auth;
+    if (mode) {
+        var parsed = parseAuthMode(mode);
+        auth = parsed.auth;
+    } else {
+        // DEFAULT: No flags provided, use loopback-oauth
+        auth = 'loopback-oauth';
+    }
+    // Validate: DCR only works with HTTP transport
+    if (auth === 'dcr' && transport === 'stdio') {
+        throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');
+    }
+    // Parse headless mode
+    var cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
+    var envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
+    var headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : false;
+    // Parse redirect-uri (CLI overrides ENV)
+    var cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;
+    var envRedirectUri = env.REDIRECT_URI;
+    var redirectUri = cliRedirectUri !== null && cliRedirectUri !== void 0 ? cliRedirectUri : envRedirectUri;
+    // Parse tenant-id (CLI overrides environment)
+    var cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;
+    var tenantId = cliTenantId !== null && cliTenantId !== void 0 ? cliTenantId : requiredEnv('MS_TENANT_ID');
+    // Parse credentials
+    var clientId = requiredEnv('MS_CLIENT_ID');
+    var clientSecret = env.MS_CLIENT_SECRET;
+    return _object_spread(_object_spread_props(_object_spread({
+        clientId: clientId,
+        tenantId: tenantId
+    }, clientSecret && {
+        clientSecret: clientSecret
+    }), {
+        auth: auth,
+        headless: headless
+    }), redirectUri && {
+        redirectUri: redirectUri
+    });
+}
+function createConfig() {
+    return parseConfig(process.argv, process.env);
+}
+function parseDcrConfig(args, env, scope) {
+    function requiredEnv(key) {
+        var value = env[key];
+        if (!value) {
+            throw new Error("Environment variable ".concat(key, " is required for DCR configuration"));
+        }
+        return value;
+    }
+    // Parse CLI arguments
+    var values = (0, _util.parseArgs)({
+        args: args,
+        options: {
+            'dcr-mode': {
+                type: 'string'
+            },
+            'dcr-verify-url': {
+                type: 'string'
+            },
+            'dcr-store-uri': {
+                type: 'string'
+            },
+            'tenant-id': {
+                type: 'string'
+            }
+        },
+        strict: false,
+        allowPositionals: true
+    }).values;
+    // Parse DCR mode (CLI overrides environment)
+    var cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;
+    var envMode = env.DCR_MODE;
+    var mode = cliMode || envMode || 'self-hosted';
+    // Validate DCR mode
+    if (mode !== 'self-hosted' && mode !== 'external') {
+        throw new Error('Invalid --dcr-mode value: "'.concat(mode, '". Valid values: self-hosted, external'));
+    }
+    // Parse verify URL (CLI overrides environment)
+    var cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;
+    var envVerifyUrl = env.DCR_VERIFY_URL;
+    var verifyUrl = cliVerifyUrl || envVerifyUrl;
+    // Parse store URI (CLI overrides environment)
+    var cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;
+    var envStoreUri = env.DCR_STORE_URI;
+    var storeUri = cliStoreUri || envStoreUri;
+    // Validate mode-specific required fields
+    if (mode === 'external' && !verifyUrl) {
+        throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');
+    }
+    // Parse tenant-id (CLI overrides environment)
+    var cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;
+    var tenantId = cliTenantId !== null && cliTenantId !== void 0 ? cliTenantId : requiredEnv('MS_TENANT_ID');
+    // Parse credentials
+    var clientId = requiredEnv('MS_CLIENT_ID');
+    var clientSecret = env.MS_CLIENT_SECRET;
+    return _object_spread_props(_object_spread(_object_spread_props(_object_spread({
+        mode: mode
+    }, verifyUrl && {
+        verifyUrl: verifyUrl
+    }, storeUri && {
+        storeUri: storeUri
+    }), {
+        clientId: clientId
+    }), clientSecret && {
+        clientSecret: clientSecret
+    }), {
+        tenantId: tenantId,
+        scope: scope
+    });
+}
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }

package/dist/cjs/setup/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/setup/config.ts"],"sourcesContent":["/**\n * Microsoft OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Microsoft OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for external use\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * Auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'device-code' | 'dcr';\n\n/**\n * Parse OAuth mode string into auth mode.\n *\n * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('device-code')      // { auth: 'device-code' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  // Validate auth mode\n  if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, device-code, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n */\ntype TransportType = 'stdio' | 'http';\n\n/**\n * Parse Microsoft OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - AUTH_MODE: OAuth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n * @returns Parsed Microsoft OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=device-code'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - device-code\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Microsoft OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse OAuth mode\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  // Parse headless mode\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? false;\n\n  // Parse redirect-uri (CLI overrides ENV)\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    clientId,\n    tenantId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse DCR mode (CLI overrides environment)\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  // Validate DCR mode\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  // Parse verify URL (CLI overrides environment)\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  // Parse store URI (CLI overrides environment)\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  // Validate mode-specific required fields\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    tenantId,\n    scope,\n  };\n}\n"],"names":["createConfig","parseConfig","parseDcrConfig","parseAuthMode","value","Error","auth","args","env","transport","cliHeadless","requiredEnv","key","values","parseArgs","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","envHeadless","HEADLESS","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","cliTenantId","tenantId","clientId","clientSecret","MS_CLIENT_SECRET","process","argv","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC;;;;;;;;;;;QAwKeA;eAAAA;;QA1EAC;eAAAA;;QA0HAC;eAAAA;;;oBAtNU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAW1B;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,qBAAqB;IACrB,IAAIA,UAAU,oBAAoBA,UAAU,iBAAiBA,UAAU,OAAO;QAC5E,MAAM,IAAIC,MAAM,AAAC,0BAA+B,OAAND,OAAM;IAClD;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAwDO,SAASH,YAAYM,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QA6C3FC;IA5CjB,SAASC,YAAYC,GAAW;QAC9B,IAAMR,QAAQI,GAAG,CAACI,IAAI;QACtB,IAAI,CAACR,OAAO;YACV,MAAM,IAAIC,MAAM,AAAC,wBAA2B,OAAJO,KAAI;QAC9C;QACA,OAAOR;IACT;IAEA,sBAAsB;IACtB,IAAM,AAAES,SAAWC,IAAAA,eAAS,EAAC;QAC3BP,MAAAA;QACAQ,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB,GAVQN;IAYR,mBAAmB;IACnB,IAAMO,UAAU,OAAOP,OAAOP,IAAI,KAAK,WAAWO,OAAOP,IAAI,GAAGe;IAChE,IAAMC,cAAcd,IAAIe,SAAS;IACjC,IAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,IAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASG,cAAc,SAAS;QAC3C,MAAM,IAAIJ,MAAM;IAClB;IAEA,sBAAsB;IACtB,IAAMK,cAAc,OAAOG,OAAOI,QAAQ,KAAK,YAAYJ,OAAOI,QAAQ,GAAGI;IAC7E,IAAMK,cAAclB,IAAImB,QAAQ,KAAK,SAAS,OAAOnB,IAAImB,QAAQ,KAAK,UAAU,QAAQN;IACxF,IAAMJ,YAAWP,OAAAA,wBAAAA,yBAAAA,cAAegB,yBAAfhB,kBAAAA,OAA8B;IAE/C,yCAAyC;IACzC,IAAMkB,iBAAiB,OAAOf,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGQ;IAC7F,IAAMQ,iBAAiBrB,IAAIsB,YAAY;IACvC,IAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IAEtC,8CAA8C;IAC9C,IAAMG,cAAc,OAAOnB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGQ;IACpF,IAAMY,WAAWD,wBAAAA,yBAAAA,cAAerB,YAAY;IAE5C,oBAAoB;IACpB,IAAMuB,WAAWvB,YAAY;IAC7B,IAAMwB,eAAe3B,IAAI4B,gBAAgB;IAEzC,OAAO;QACLF,UAAAA;QACAD,UAAAA;OACIE,gBAAgB;QAAEA,cAAAA;IAAa;QACnC7B,MAAAA;QACAW,UAAAA;QACIc,eAAe;QAAEA,aAAAA;IAAY;AAErC;AAMO,SAAS/B;IACd,OAAOC,YAAYoC,QAAQC,IAAI,EAAED,QAAQ7B,GAAG;AAC9C;AA8CO,SAASN,eAAeK,IAAc,EAAEC,GAAuC,EAAE+B,KAAa;IACnG,SAAS5B,YAAYC,GAAW;QAC9B,IAAMR,QAAQI,GAAG,CAACI,IAAI;QACtB,IAAI,CAACR,OAAO;YACV,MAAM,IAAIC,MAAM,AAAC,wBAA2B,OAAJO,KAAI;QAC9C;QACA,OAAOR;IACT;IAEA,sBAAsB;IACtB,IAAM,AAAES,SAAWC,IAAAA,eAAS,EAAC;QAC3BP,MAAAA;QACAQ,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;YAClC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB,GAVQN;IAYR,6CAA6C;IAC7C,IAAM2B,UAAU,OAAO3B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGQ;IAC9E,IAAMoB,UAAUjC,IAAIkC,QAAQ;IAC5B,IAAMlB,OAAOgB,WAAWC,WAAW;IAEnC,oBAAoB;IACpB,IAAIjB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,AAAC,8BAAkC,OAALmB,MAAK;IACrD;IAEA,+CAA+C;IAC/C,IAAMmB,eAAe,OAAO9B,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGQ;IAC/F,IAAMuB,eAAepC,IAAIqC,cAAc;IACvC,IAAMC,YAAYH,gBAAgBC;IAElC,8CAA8C;IAC9C,IAAMG,cAAc,OAAOlC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGQ;IAC5F,IAAM2B,cAAcxC,IAAIyC,aAAa;IACrC,IAAMC,WAAWH,eAAeC;IAEhC,yCAAyC;IACzC,IAAIxB,SAAS,cAAc,CAACsB,WAAW;QACrC,MAAM,IAAIzC,MAAM;IAClB;IAEA,8CAA8C;IAC9C,IAAM2B,cAAc,OAAOnB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGQ;IACpF,IAAMY,WAAWD,wBAAAA,yBAAAA,cAAerB,YAAY;IAE5C,oBAAoB;IACpB,IAAMuB,WAAWvB,YAAY;IAC7B,IAAMwB,eAAe3B,IAAI4B,gBAAgB;IAEzC,OAAO;QACLZ,MAAAA;OACIsB,aAAa;QAAEA,WAAAA;IAAU,GACzBI,YAAY;QAAEA,UAAAA;IAAS;QAC3BhB,UAAAA;QACIC,gBAAgB;QAAEA,cAAAA;IAAa;QACnCF,UAAAA;QACAM,OAAAA;;AAEJ"}

package/dist/cjs/types.d.cts

@@ -0,0 +1,188 @@
+/**
+ * Standalone types for Microsoft OAuth
+ * No dependencies on other @mcp-z packages except @mcp-z/oauth
+ */
+import type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';
+import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';
+import type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';
+import type { Keyv } from 'keyv';
+export type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };
+export { AuthRequiredError } from '@mcp-z/oauth';
+export type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };
+/**
+ * Microsoft service types that support OAuth
+ * OAuth clients support all Microsoft services provided by Microsoft Graph
+ * @public
+ */
+export type MicrosoftService = string;
+/**
+ * OAuth client configuration for upstream provider
+ * @public
+ */
+export interface OAuthClientConfig {
+    /** OAuth client ID for upstream provider */
+    clientId: string;
+    /** OAuth client secret (optional for some flows) */
+    clientSecret?: string;
+    /** Tenant/directory ID (for multi-tenant providers) */
+    tenantId?: string;
+}
+/**
+ * Microsoft OAuth configuration interface.
+ * Contains all OAuth-related configuration from CLI arguments and environment variables.
+ * @public
+ */
+export interface OAuthConfig {
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth adapter mode */
+    auth: 'loopback-oauth' | 'device-code' | 'dcr';
+    /** Whether to run in headless mode (no browser interaction) */
+    headless: boolean;
+    /** Optional redirect URI override (defaults to ephemeral loopback) */
+    redirectUri?: string;
+}
+/**
+ * DCR configuration for dynamic client registration
+ * @public
+ */
+export interface DcrConfig {
+    /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */
+    mode: 'self-hosted' | 'external';
+    /** External verification endpoint URL (required for external mode) */
+    verifyUrl?: string;
+    /** DCR client storage URI (required for self-hosted mode) */
+    storeUri?: string;
+    /** OAuth client ID for Microsoft Graph */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth scopes to request */
+    scope: string;
+    /** Logger instance */
+    logger?: Logger;
+}
+/**
+ * Configuration for loopback OAuth client
+ * @public
+ */
+export interface LoopbackOAuthConfig {
+    /** Microsoft service type (e.g., 'outlook') */
+    service: MicrosoftService;
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string | undefined;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth scopes to request */
+    scope: string;
+    /** Whether to run in headless mode (no browser interaction) */
+    headless: boolean;
+    /** Logger instance */
+    logger: Logger;
+    /** Token storage */
+    tokenStore: Keyv<unknown>;
+    /** Optional redirect URI override (defaults to ephemeral loopback) */
+    redirectUri?: string;
+}
+/**
+ * Microsoft Graph AuthenticationProvider interface
+ * Used by Microsoft Graph SDK for API authentication
+ * @public
+ */
+export interface MicrosoftAuthProvider {
+    getAccessToken: () => Promise<string>;
+}
+/**
+ * Auth context injected into extra by middleware
+ * @public
+ */
+export interface AuthContext {
+    /**
+     * Microsoft Graph AuthenticationProvider ready for Graph SDK
+     * GUARANTEED to exist when handler runs
+     */
+    auth: MicrosoftAuthProvider;
+    /**
+     * Account being used (for logging, debugging)
+     */
+    accountId: string;
+}
+/**
+ * Enriched extra with guaranteed auth context and logger
+ * Handlers receive this type - never plain RequestHandlerExtra
+ * @public
+ */
+export interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {
+    /**
+     * Auth context injected by middleware
+     * GUARANTEED to exist (middleware catches auth failures)
+     */
+    authContext: AuthContext;
+    /**
+     * Logger injected by middleware
+     * GUARANTEED to exist
+     */
+    logger: Logger;
+    /**
+     * HTTP request object (for HTTP transport scenarios)
+     * Optional - present when using HTTP transport with JWT/session auth
+     */
+    req?: unknown;
+    _meta?: {
+        accountId?: string;
+        [key: string]: unknown;
+    };
+}
+/**
+ * Registered client with full metadata
+ * Extends DcrClientInformation with internal timestamps
+ * @internal
+ */
+export interface RegisteredClient extends DcrClientInformation {
+    /** Creation timestamp (milliseconds since epoch) */
+    created_at: number;
+}
+/**
+ * Authorization code data structure
+ * @public
+ */
+export interface AuthorizationCode {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+    /** Microsoft provider tokens obtained during authorization */
+    providerTokens: ProviderTokens;
+    created_at: number;
+    expires_at: number;
+}
+/**
+ * Access token data structure
+ * @public
+ */
+export interface AccessToken {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+    client_id: string;
+    /** Microsoft provider tokens */
+    providerTokens: ProviderTokens;
+    created_at: number;
+}
+/**
+ * Auth required response interface
+ * Re-exported from @mcp-z/oauth for consistency
+ */
+export type { AuthRequired, AuthRequiredBranch } from './schemas/index.js';

package/dist/cjs/types.d.ts

@@ -0,0 +1,188 @@
+/**
+ * Standalone types for Microsoft OAuth
+ * No dependencies on other @mcp-z packages except @mcp-z/oauth
+ */
+import type { AuthFlowDescriptor, CachedToken, DcrClientInformation, DcrClientMetadata, Logger, OAuth2TokenStorageProvider, ProviderTokens, ToolHandler, ToolModule, UserAuthProvider } from '@mcp-z/oauth';
+import type { RequestHandlerExtra } from '@modelcontextprotocol/sdk/shared/protocol.js';
+import type { ServerNotification, ServerRequest } from '@modelcontextprotocol/sdk/types.js';
+import type { Keyv } from 'keyv';
+export type { Logger, CachedToken, ToolModule, ProviderTokens, DcrClientMetadata, DcrClientInformation };
+export { AuthRequiredError } from '@mcp-z/oauth';
+export type { ToolHandler, AuthFlowDescriptor, OAuth2TokenStorageProvider, UserAuthProvider, RequestHandlerExtra, ServerRequest, ServerNotification };
+/**
+ * Microsoft service types that support OAuth
+ * OAuth clients support all Microsoft services provided by Microsoft Graph
+ * @public
+ */
+export type MicrosoftService = string;
+/**
+ * OAuth client configuration for upstream provider
+ * @public
+ */
+export interface OAuthClientConfig {
+    /** OAuth client ID for upstream provider */
+    clientId: string;
+    /** OAuth client secret (optional for some flows) */
+    clientSecret?: string;
+    /** Tenant/directory ID (for multi-tenant providers) */
+    tenantId?: string;
+}
+/**
+ * Microsoft OAuth configuration interface.
+ * Contains all OAuth-related configuration from CLI arguments and environment variables.
+ * @public
+ */
+export interface OAuthConfig {
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth adapter mode */
+    auth: 'loopback-oauth' | 'device-code' | 'dcr';
+    /** Whether to run in headless mode (no browser interaction) */
+    headless: boolean;
+    /** Optional redirect URI override (defaults to ephemeral loopback) */
+    redirectUri?: string;
+}
+/**
+ * DCR configuration for dynamic client registration
+ * @public
+ */
+export interface DcrConfig {
+    /** DCR mode: self-hosted (runs own OAuth server) or external (uses Auth0/Stitch) */
+    mode: 'self-hosted' | 'external';
+    /** External verification endpoint URL (required for external mode) */
+    verifyUrl?: string;
+    /** DCR client storage URI (required for self-hosted mode) */
+    storeUri?: string;
+    /** OAuth client ID for Microsoft Graph */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth scopes to request */
+    scope: string;
+    /** Logger instance */
+    logger?: Logger;
+}
+/**
+ * Configuration for loopback OAuth client
+ * @public
+ */
+export interface LoopbackOAuthConfig {
+    /** Microsoft service type (e.g., 'outlook') */
+    service: MicrosoftService;
+    /** OAuth client ID */
+    clientId: string;
+    /** OAuth client secret (optional for public clients) */
+    clientSecret?: string | undefined;
+    /** Azure AD tenant ID */
+    tenantId: string;
+    /** OAuth scopes to request */
+    scope: string;
+    /** Whether to run in headless mode (no browser interaction) */
+    headless: boolean;
+    /** Logger instance */
+    logger: Logger;
+    /** Token storage */
+    tokenStore: Keyv<unknown>;
+    /** Optional redirect URI override (defaults to ephemeral loopback) */
+    redirectUri?: string;
+}
+/**
+ * Microsoft Graph AuthenticationProvider interface
+ * Used by Microsoft Graph SDK for API authentication
+ * @public
+ */
+export interface MicrosoftAuthProvider {
+    getAccessToken: () => Promise<string>;
+}
+/**
+ * Auth context injected into extra by middleware
+ * @public
+ */
+export interface AuthContext {
+    /**
+     * Microsoft Graph AuthenticationProvider ready for Graph SDK
+     * GUARANTEED to exist when handler runs
+     */
+    auth: MicrosoftAuthProvider;
+    /**
+     * Account being used (for logging, debugging)
+     */
+    accountId: string;
+}
+/**
+ * Enriched extra with guaranteed auth context and logger
+ * Handlers receive this type - never plain RequestHandlerExtra
+ * @public
+ */
+export interface EnrichedExtra extends RequestHandlerExtra<ServerRequest, ServerNotification> {
+    /**
+     * Auth context injected by middleware
+     * GUARANTEED to exist (middleware catches auth failures)
+     */
+    authContext: AuthContext;
+    /**
+     * Logger injected by middleware
+     * GUARANTEED to exist
+     */
+    logger: Logger;
+    /**
+     * HTTP request object (for HTTP transport scenarios)
+     * Optional - present when using HTTP transport with JWT/session auth
+     */
+    req?: unknown;
+    _meta?: {
+        accountId?: string;
+        [key: string]: unknown;
+    };
+}
+/**
+ * Registered client with full metadata
+ * Extends DcrClientInformation with internal timestamps
+ * @internal
+ */
+export interface RegisteredClient extends DcrClientInformation {
+    /** Creation timestamp (milliseconds since epoch) */
+    created_at: number;
+}
+/**
+ * Authorization code data structure
+ * @public
+ */
+export interface AuthorizationCode {
+    code: string;
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+    /** Microsoft provider tokens obtained during authorization */
+    providerTokens: ProviderTokens;
+    created_at: number;
+    expires_at: number;
+}
+/**
+ * Access token data structure
+ * @public
+ */
+export interface AccessToken {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+    client_id: string;
+    /** Microsoft provider tokens */
+    providerTokens: ProviderTokens;
+    created_at: number;
+}
+/**
+ * Auth required response interface
+ * Re-exported from @mcp-z/oauth for consistency
+ */
+export type { AuthRequired, AuthRequiredBranch } from './schemas/index.js';

package/dist/cjs/types.js

@@ -0,0 +1,18 @@
+/**
+ * Standalone types for Microsoft OAuth
+ * No dependencies on other @mcp-z packages except @mcp-z/oauth
+ */ // Import shared types from base @mcp-z/oauth package
+// Public types (will be re-exported)
+// Internal-only types (not re-exported, used by providers)
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthRequiredError", {
+    enumerable: true,
+    get: function() {
+        return _oauth.AuthRequiredError;
+    }
+});
+var _oauth = require("@mcp-z/oauth");
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }