@mcp-z/oauth-microsoft 1.0.0

package/dist/esm/providers/loopback-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/providers/loopback-oauth.ts"],"sourcesContent":["/**\n * Loopback OAuth Implementation for Microsoft (RFC 8252)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE using loopback interface redirection.\n * Uses ephemeral local server with OS-assigned port (RFC 8252 Section 8.3).\n * Eliminates port conflicts by using port 0, allowing unlimited concurrent servers.\n *\n * Flow:\n * 1. Check token cache (memory + storage)\n * 2. If cache miss: Start ephemeral server on port 0\n * 3. Generate auth URL with dynamic redirect (localhost:{assigned-port})\n * 4. Open browser or print URL (headless flag controls behavior)\n * 5. Handle callback, exchange code for token\n * 6. Cache token to storage\n * 7. Close ephemeral server\n */\n\nimport { addAccount, generatePKCE, getActiveAccount, getErrorTemplate, getSuccessTemplate, getToken, listAccountIds, type OAuth2TokenStorageProvider, setAccountInfo, setActiveAccount, setToken } from '@mcp-z/oauth';\nimport * as http from 'http';\nimport open from 'open';\nimport { fetchWithTimeout } from '../lib/fetch-with-timeout.ts';\nimport { type AuthContext, type AuthFlowDescriptor, AuthRequiredError, type CachedToken, type EnrichedExtra, type LoopbackOAuthConfig } from '../types.ts';\n\ninterface TokenResponse {\n  access_token: string;\n  refresh_token?: string;\n  expires_in?: number;\n  scope?: string;\n  token_type?: string;\n}\n\n/**\n * Loopback OAuth Client (RFC 8252 Section 7.3)\n *\n * Implements OAuth 2.0 Authorization Code Flow with PKCE for native applications\n * using loopback interface redirection. Manages ephemeral OAuth flows and token persistence\n * with Keyv for key-based token storage using compound keys.\n *\n * Token key format: {accountId}:{service}:token (e.g., \"user@example.com:outlook:token\")\n */\nexport class LoopbackOAuthProvider implements OAuth2TokenStorageProvider {\n  private config: LoopbackOAuthConfig;\n\n  constructor(config: LoopbackOAuthConfig) {\n    this.config = config;\n  }\n\n  /**\n   * Get access token from Keyv using compound key\n   *\n   * @param accountId - Account identifier (email address). Required for loopback OAuth.\n   * @returns Access token for API requests\n   */\n  async getAccessToken(accountId?: string): Promise<string> {\n    const { logger, service, tokenStore } = this.config;\n\n    // Use active account if no accountId specified\n    const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n\n    // If we have an accountId, try to use existing token\n    if (effectiveAccountId) {\n      logger.debug('Getting access token', { service, accountId: effectiveAccountId });\n\n      // Check Keyv for token using new key format\n      const storedToken = await getToken<CachedToken>(tokenStore, { accountId: effectiveAccountId, service });\n\n      if (storedToken && this.isTokenValid(storedToken)) {\n        logger.debug('Using stored access token', { accountId: effectiveAccountId });\n        return storedToken.accessToken;\n      }\n\n      // If stored token expired but has refresh token, try refresh\n      if (storedToken?.refreshToken) {\n        try {\n          logger.info('Refreshing expired access token', { accountId: effectiveAccountId });\n          const refreshedToken = await this.refreshAccessToken(storedToken.refreshToken);\n          await setToken(tokenStore, { accountId: effectiveAccountId, service }, refreshedToken);\n          return refreshedToken.accessToken;\n        } catch (error) {\n          logger.info('Token refresh failed, starting new OAuth flow', {\n            accountId: effectiveAccountId,\n            error: error instanceof Error ? error.message : String(error),\n          });\n          // Fall through to new OAuth flow\n        }\n      }\n    }\n\n    // No valid token or no account - check if we can start OAuth flow\n    const { headless } = this.config;\n    if (headless) {\n      // In headless mode (production), cannot start OAuth flow\n      // Throw AuthRequiredError with auth_url descriptor for MCP tool response\n      const { clientId, tenantId, scope } = this.config;\n\n      // Incremental OAuth detection: Check if other accounts exist\n      const existingAccounts = await this.getExistingAccounts();\n      const hasOtherAccounts = effectiveAccountId ? existingAccounts.length > 0 && !existingAccounts.includes(effectiveAccountId) : existingAccounts.length > 0;\n\n      // Build informational OAuth URL for headless mode\n      // Note: No redirect_uri included - user must use account-add tool which starts proper ephemeral server\n      const authUrl = new URL(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`);\n      authUrl.searchParams.set('client_id', clientId);\n      authUrl.searchParams.set('response_type', 'code');\n      authUrl.searchParams.set('scope', scope);\n      authUrl.searchParams.set('response_mode', 'query');\n      authUrl.searchParams.set('prompt', 'select_account');\n\n      // Provide context-aware hint based on existing accounts\n      let hint: string;\n      if (hasOtherAccounts) {\n        hint = `Existing ${service} accounts found. Use account-list to view, account-switch to change account, or account-add to add new account`;\n      } else if (effectiveAccountId) {\n        hint = `Use account-add to authenticate ${effectiveAccountId}`;\n      } else {\n        hint = 'Use account-add to authenticate interactively';\n      }\n\n      const baseDescriptor = {\n        kind: 'auth_url' as const,\n        provider: 'microsoft',\n        url: authUrl.toString(),\n        hint,\n      };\n\n      const descriptor: AuthFlowDescriptor & { accountId?: string } = effectiveAccountId ? { ...baseDescriptor, accountId: effectiveAccountId } : baseDescriptor;\n\n      throw new AuthRequiredError(descriptor);\n    }\n\n    // Interactive mode - start ephemeral OAuth flow\n    logger.info('Starting ephemeral OAuth flow', { service, headless });\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token with email as accountId\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account in account management system\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account so subsequent getAccessToken() calls find it\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata (email, added timestamp)\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('OAuth flow completed', { service, accountId: email });\n\n    return token.accessToken;\n  }\n\n  /**\n   * Convert to Microsoft Graph-compatible auth provider\n   *\n   * @param accountId - Account identifier for multi-account support (e.g., 'user@example.com')\n   * @returns Auth provider configured for the specified account\n   */\n  toAuthProvider(accountId?: string): { getAccessToken: () => Promise<string> } {\n    // Capture accountId in closure to pass to getAccessToken\n    const getToken = () => this.getAccessToken(accountId);\n\n    return {\n      getAccessToken: getToken,\n    };\n  }\n\n  /**\n   * Authenticate new account with OAuth flow\n   * Triggers account selection, stores token, registers account\n   *\n   * @returns Email address of newly authenticated account\n   * @throws Error in headless mode (cannot open browser for OAuth)\n   */\n  async authenticateNewAccount(): Promise<string> {\n    const { logger, headless, service, tokenStore } = this.config;\n\n    if (headless) {\n      throw new Error('Cannot authenticate new account in headless mode - interactive OAuth required');\n    }\n\n    logger.info('Starting new account authentication', { service });\n\n    // Trigger OAuth with account selection\n    const { token, email } = await this.performEphemeralOAuthFlow();\n\n    // Store token\n    await setToken(tokenStore, { accountId: email, service }, token);\n\n    // Register account\n    await addAccount(tokenStore, { service, accountId: email });\n\n    // Set as active account\n    await setActiveAccount(tokenStore, { service, accountId: email });\n\n    // Store account metadata\n    await setAccountInfo(\n      tokenStore,\n      { service, accountId: email },\n      {\n        email,\n        addedAt: new Date().toISOString(),\n      }\n    );\n\n    logger.info('New account authenticated', { service, email });\n    return email;\n  }\n\n  /**\n   * Get user email from Microsoft Graph API (pure query)\n   * Used to query email for existing authenticated account\n   *\n   * @param accountId - Account identifier to get email for\n   * @returns User's email address\n   */\n  async getUserEmail(accountId?: string): Promise<string> {\n    // Get token for existing account\n    const token = await this.getAccessToken(accountId);\n\n    // Fetch email from Microsoft Graph\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${token}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`Failed to get user info: ${response.status} ${await response.text()}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    return userInfo.mail ?? userInfo.userPrincipalName;\n  }\n\n  /**\n   * Check for existing accounts in token storage (incremental OAuth detection)\n   *\n   * Uses key-utils helper for forward compatibility with key format changes.\n   *\n   * @returns Array of account IDs that have tokens for this service\n   */\n  private async getExistingAccounts(): Promise<string[]> {\n    const { service, tokenStore } = this.config;\n    return listAccountIds(tokenStore, service);\n  }\n\n  private isTokenValid(token: CachedToken): boolean {\n    if (!token.expiresAt) return true; // No expiry = assume valid\n    return Date.now() < token.expiresAt - 60000; // 1 minute buffer\n  }\n\n  /**\n   * Fetch user email from Microsoft Graph using access token\n   * Called during OAuth flow to get email for accountId\n   *\n   * @param accessToken - Fresh access token from OAuth exchange\n   * @returns User's email address (mail field or userPrincipalName fallback)\n   */\n  private async fetchUserEmailFromToken(accessToken: string): Promise<string> {\n    const { logger } = this.config;\n\n    const response = await fetchWithTimeout('https://graph.microsoft.com/v1.0/me', {\n      headers: {\n        Authorization: `Bearer ${accessToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Failed to fetch user email: HTTP ${response.status} - ${errorText}`);\n    }\n\n    const userInfo = (await response.json()) as { mail?: string; userPrincipalName: string };\n    const email = userInfo.mail ?? userInfo.userPrincipalName;\n\n    logger.debug('Fetched user email from Graph API', { email });\n    return email;\n  }\n\n  private async performEphemeralOAuthFlow(): Promise<{ token: CachedToken; email: string }> {\n    const { clientId, tenantId, scope, headless, logger, redirectUri: configRedirectUri } = this.config;\n\n    // Parse redirectUri if provided to extract host, protocol, port, and path\n    let targetHost = 'localhost'; // Default: localhost (Microsoft requires exact match with registered redirect URI)\n    let targetPort = 0; // Default: OS-assigned ephemeral port\n    let targetProtocol = 'http:'; // Default: http\n    let callbackPath = '/callback'; // Default callback path\n    let useConfiguredUri = false;\n\n    if (configRedirectUri) {\n      try {\n        const parsed = new URL(configRedirectUri);\n\n        // Use configured redirect URI as-is for production deployments\n        targetHost = parsed.hostname;\n        targetProtocol = parsed.protocol;\n\n        // Extract port from URL (use default ports if not specified)\n        if (parsed.port) {\n          targetPort = Number.parseInt(parsed.port, 10);\n        } else {\n          targetPort = parsed.protocol === 'https:' ? 443 : 80;\n        }\n\n        // Extract path (default to /callback if URL has no path or just '/')\n        if (parsed.pathname && parsed.pathname !== '/') {\n          callbackPath = parsed.pathname;\n        }\n\n        useConfiguredUri = true;\n\n        logger.debug('Using configured redirect URI', {\n          host: targetHost,\n          protocol: targetProtocol,\n          port: targetPort,\n          path: callbackPath,\n          redirectUri: configRedirectUri,\n        });\n      } catch (error) {\n        logger.warn('Failed to parse redirectUri, using ephemeral defaults', {\n          redirectUri: configRedirectUri,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        // Continue with defaults (127.0.0.1, port 0, http, /callback)\n      }\n    }\n\n    return new Promise((resolve, reject) => {\n      // Generate PKCE challenge\n      const { verifier: codeVerifier, challenge: codeChallenge } = generatePKCE();\n\n      let server: http.Server | null = null;\n      let serverPort: number;\n      let finalRedirectUri: string; // Will be set in server.listen callback\n\n      // Create ephemeral server with OS-assigned port (RFC 8252)\n      server = http.createServer(async (req, res) => {\n        if (!req.url) {\n          res.writeHead(400, { 'Content-Type': 'text/html' });\n          res.end(getErrorTemplate('Invalid request'));\n          server?.close();\n          reject(new Error('Invalid request: missing URL'));\n          return;\n        }\n        const url = new URL(req.url, `http://localhost:${serverPort}`);\n\n        if (url.pathname === callbackPath) {\n          const code = url.searchParams.get('code');\n          const error = url.searchParams.get('error');\n\n          if (error) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate(error));\n            server?.close();\n            reject(new Error(`OAuth error: ${error}`));\n            return;\n          }\n\n          if (!code) {\n            res.writeHead(400, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('No authorization code received'));\n            server?.close();\n            reject(new Error('No authorization code received'));\n            return;\n          }\n\n          try {\n            // Exchange code for token (must use same redirect_uri as in authorization request)\n            const tokenResponse = await this.exchangeCodeForToken(code, codeVerifier, finalRedirectUri);\n\n            // Build cached token\n            const cachedToken: CachedToken = {\n              accessToken: tokenResponse.access_token,\n              ...(tokenResponse.refresh_token !== undefined && { refreshToken: tokenResponse.refresh_token }),\n              ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n              ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n            };\n\n            // Fetch user email immediately using the new access token\n            const email = await this.fetchUserEmailFromToken(tokenResponse.access_token);\n\n            res.writeHead(200, { 'Content-Type': 'text/html' });\n            res.end(getSuccessTemplate());\n            server?.close();\n            resolve({ token: cachedToken, email });\n          } catch (exchangeError) {\n            logger.error('Token exchange failed', { error: exchangeError instanceof Error ? exchangeError.message : String(exchangeError) });\n            res.writeHead(500, { 'Content-Type': 'text/html' });\n            res.end(getErrorTemplate('Token exchange failed'));\n            server?.close();\n            reject(exchangeError);\n          }\n        } else {\n          res.writeHead(404, { 'Content-Type': 'text/plain' });\n          res.end('Not Found');\n        }\n      });\n\n      // Listen on targetPort (0 for OS assignment, or custom port from redirectUri)\n      server.listen(targetPort, targetHost, () => {\n        const address = server?.address();\n        if (!address || typeof address === 'string') {\n          server?.close();\n          reject(new Error('Failed to start ephemeral server'));\n          return;\n        }\n\n        serverPort = address.port;\n\n        // Construct final redirect URI\n        if (useConfiguredUri && configRedirectUri) {\n          // Use configured redirect URI as-is for production\n          finalRedirectUri = configRedirectUri;\n        } else {\n          // Construct ephemeral redirect URI with actual server port\n          finalRedirectUri = `${targetProtocol}//${targetHost}:${serverPort}${callbackPath}`;\n        }\n\n        // Build Microsoft auth URL\n        const authUrl = new URL(`https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize`);\n        authUrl.searchParams.set('client_id', clientId);\n        authUrl.searchParams.set('redirect_uri', finalRedirectUri);\n        authUrl.searchParams.set('response_type', 'code');\n        authUrl.searchParams.set('scope', scope);\n        authUrl.searchParams.set('response_mode', 'query');\n        authUrl.searchParams.set('code_challenge', codeChallenge);\n        authUrl.searchParams.set('code_challenge_method', 'S256');\n        authUrl.searchParams.set('prompt', 'select_account');\n\n        logger.info('Ephemeral OAuth server started', { port: serverPort, headless });\n\n        if (headless) {\n          // Headless mode: Print auth URL to stderr (stdout is MCP protocol)\n          console.error('\\n🔐 OAuth Authorization Required');\n          console.error('📋 Please visit this URL in your browser:\\n');\n          console.error(`   ${authUrl.toString()}\\n`);\n          console.error('⏳ Waiting for authorization...\\n');\n        } else {\n          // Interactive mode: Open browser automatically\n          logger.info('Opening browser for OAuth authorization');\n          open(authUrl.toString()).catch((error) => {\n            logger.info('Failed to open browser automatically', { error: error.message });\n            console.error('\\n🔐 OAuth Authorization Required');\n            console.error(`   ${authUrl.toString()}\\n`);\n          });\n        }\n      });\n\n      // Timeout after 5 minutes\n      setTimeout(\n        () => {\n          if (server) {\n            server.close();\n            reject(new Error('OAuth flow timed out after 5 minutes'));\n          }\n        },\n        5 * 60 * 1000\n      );\n    });\n  }\n\n  private async exchangeCodeForToken(code: string, codeVerifier: string, redirectUri: string): Promise<TokenResponse> {\n    const { clientId, clientSecret, tenantId } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      code,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      grant_type: 'authorization_code',\n      code_verifier: codeVerifier,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token exchange failed: ${response.status} ${errorText}`);\n    }\n\n    return (await response.json()) as TokenResponse;\n  }\n\n  private async refreshAccessToken(refreshToken: string): Promise<CachedToken> {\n    const { clientId, clientSecret, tenantId, scope } = this.config;\n\n    const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;\n    const params: Record<string, string> = {\n      refresh_token: refreshToken,\n      client_id: clientId,\n      grant_type: 'refresh_token',\n      scope,\n    };\n\n    // Only include client_secret for confidential clients\n    if (clientSecret) {\n      params.client_secret = clientSecret;\n    }\n\n    const body = new URLSearchParams(params);\n\n    const response = await fetchWithTimeout(tokenUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded',\n      },\n      body: body.toString(),\n    });\n\n    if (!response.ok) {\n      const errorText = await response.text();\n      throw new Error(`Token refresh failed: ${response.status} ${errorText}`);\n    }\n\n    const tokenResponse = (await response.json()) as TokenResponse;\n\n    return {\n      accessToken: tokenResponse.access_token,\n      refreshToken: refreshToken, // Keep original refresh token\n      ...(tokenResponse.expires_in !== undefined && { expiresAt: Date.now() + tokenResponse.expires_in * 1000 }),\n      ...(tokenResponse.scope !== undefined && { scope: tokenResponse.scope }),\n    };\n  }\n\n  /**\n   * Create auth middleware for single-user context (single active account per service)\n   *\n   * Single-user mode:\n   * - Maintains per-service active accounts in storage\n   * - Supports backchannel account override via extra._meta.accountId\n   * - Automatically enhances output schemas with auth_required branch\n   *\n   * Example:\n   * ```typescript\n   * const loopback = new LoopbackOAuthProvider({ service: 'outlook', ... });\n   * const middleware = loopback.authMiddleware();\n   * const tools = toolFactories.map(f => f()).map(middleware.withToolAuth);\n   * const resources = resourceFactories.map(f => f()).map(middleware.withResourceAuth);\n   * const prompts = promptFactories.map(f => f()).map(middleware.withPromptAuth);\n   * ```\n   *\n   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods\n   */\n  authMiddleware() {\n    const { service, tokenStore, logger } = this.config;\n\n    // Shared wrapper logic - extracts extra parameter from specified position\n    // Generic T captures the actual module type; handler is cast from unknown to callable\n    const wrapAtPosition = <T extends { name: string; handler: unknown; [key: string]: unknown }>(module: T, extraPosition: number): T => {\n      const operation = module.name;\n      const originalHandler = module.handler as (...args: unknown[]) => Promise<unknown>;\n\n      const wrappedHandler = async (...allArgs: unknown[]) => {\n        // Extract extra from the correct position (defensive: handle arg-less tool pattern)\n        let extra: EnrichedExtra;\n        if (allArgs.length <= extraPosition) {\n          // Arg-less tool pattern: keep args as-is, create separate extra object\n          extra = (allArgs[0] && typeof allArgs[0] === 'object' ? {} : {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        } else {\n          extra = (allArgs[extraPosition] || {}) as EnrichedExtra;\n          allArgs[extraPosition] = extra;\n        }\n\n        try {\n          // Check for backchannel override via _meta.accountId\n          let accountId: string | undefined;\n          try {\n            accountId = extra._meta?.accountId ?? (await getActiveAccount(tokenStore, { service }));\n          } catch (error) {\n            if (error instanceof Error && ((error as { code?: string }).code === 'REQUIRES_AUTHENTICATION' || error.name === 'AccountManagerError')) {\n              accountId = undefined;\n            } else {\n              throw error;\n            }\n          }\n\n          // Eagerly validate token exists or trigger OAuth flow\n          await this.getAccessToken(accountId);\n\n          // After OAuth flow completes, get the actual accountId (email) that was set\n          const effectiveAccountId = accountId ?? (await getActiveAccount(tokenStore, { service }));\n          if (!effectiveAccountId) {\n            throw new Error(`No account found after OAuth flow for service ${service}`);\n          }\n\n          const auth = this.toAuthProvider(effectiveAccountId);\n\n          // Inject authContext and logger into extra\n          (extra as { authContext?: AuthContext }).authContext = {\n            auth,\n            accountId: effectiveAccountId,\n          };\n          (extra as { logger?: unknown }).logger = logger;\n\n          // Call original handler with all args\n          return await originalHandler(...allArgs);\n        } catch (error) {\n          // Token retrieval/refresh failed - return auth required\n          if (error instanceof AuthRequiredError) {\n            logger.info('Authentication required', {\n              service,\n              tool: operation,\n              descriptor: error.descriptor,\n            });\n\n            // Return auth_required response wrapped in { result } to match tool outputSchema pattern\n            // Tools define outputSchema: z.object({ result: discriminatedUnion(...) }) where auth_required is a branch\n            const authRequiredResponse = {\n              type: 'auth_required' as const,\n              provider: service,\n              message: `Authentication required for ${operation}. Please authenticate with ${service}.`,\n              url: error.descriptor.kind === 'auth_url' ? error.descriptor.url : undefined,\n            };\n\n            return {\n              content: [\n                {\n                  type: 'text' as const,\n                  text: JSON.stringify({ result: authRequiredResponse }),\n                },\n              ],\n              structuredContent: { result: authRequiredResponse },\n            };\n          }\n\n          // Other errors - propagate\n          throw error;\n        }\n      };\n\n      return {\n        ...module,\n        handler: wrappedHandler,\n      } as T;\n    };\n\n    return {\n      // Use structural constraints to avoid contravariance check on handler type.\n      // wrapAtPosition is now generic and returns T directly.\n      withToolAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 1),\n      withResourceAuth: <T extends { name: string; template?: unknown; config?: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 2),\n      withPromptAuth: <T extends { name: string; config: unknown; handler: unknown }>(module: T) => wrapAtPosition(module, 0),\n    };\n  }\n}\n\n/**\n * Create a loopback OAuth client for Microsoft services\n * Works for both stdio and HTTP transports\n */\nexport function createMicrosoftFileAuth(config: LoopbackOAuthConfig): OAuth2TokenStorageProvider {\n  return new LoopbackOAuthProvider(config);\n}\n"],"names":["addAccount","generatePKCE","getActiveAccount","getErrorTemplate","getSuccessTemplate","getToken","listAccountIds","setAccountInfo","setActiveAccount","setToken","http","open","fetchWithTimeout","AuthRequiredError","LoopbackOAuthProvider","getAccessToken","accountId","logger","service","tokenStore","config","effectiveAccountId","debug","storedToken","isTokenValid","accessToken","refreshToken","info","refreshedToken","refreshAccessToken","error","Error","message","String","headless","clientId","tenantId","scope","existingAccounts","getExistingAccounts","hasOtherAccounts","length","includes","authUrl","URL","searchParams","set","hint","baseDescriptor","kind","provider","url","toString","descriptor","token","email","performEphemeralOAuthFlow","addedAt","Date","toISOString","toAuthProvider","authenticateNewAccount","getUserEmail","userInfo","response","headers","Authorization","ok","status","text","json","mail","userPrincipalName","expiresAt","now","fetchUserEmailFromToken","errorText","redirectUri","configRedirectUri","targetHost","targetPort","targetProtocol","callbackPath","useConfiguredUri","parsed","hostname","protocol","port","Number","parseInt","pathname","host","path","warn","Promise","resolve","reject","verifier","codeVerifier","challenge","codeChallenge","server","serverPort","finalRedirectUri","createServer","req","res","writeHead","end","close","code","get","tokenResponse","exchangeCodeForToken","cachedToken","access_token","refresh_token","undefined","expires_in","exchangeError","listen","address","console","catch","setTimeout","clientSecret","tokenUrl","params","client_id","redirect_uri","grant_type","code_verifier","client_secret","body","URLSearchParams","method","authMiddleware","wrapAtPosition","module","extraPosition","operation","name","originalHandler","handler","wrappedHandler","allArgs","extra","_meta","auth","authContext","tool","authRequiredResponse","type","content","JSON","stringify","result","structuredContent","withToolAuth","withResourceAuth","withPromptAuth","createMicrosoftFileAuth"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,UAAU,EAAEC,YAAY,EAAEC,gBAAgB,EAAEC,gBAAgB,EAAEC,kBAAkB,EAAEC,QAAQ,EAAEC,cAAc,EAAmCC,cAAc,EAAEC,gBAAgB,EAAEC,QAAQ,QAAQ,eAAe;AACvN,YAAYC,UAAU,OAAO;AAC7B,OAAOC,UAAU,OAAO;AACxB,SAASC,gBAAgB,QAAQ,+BAA+B;AAChE,SAAoDC,iBAAiB,QAAwE,cAAc;AAU3J;;;;;;;;CAQC,GACD,OAAO,MAAMC;IAOX;;;;;GAKC,GACD,MAAMC,eAAeC,SAAkB,EAAmB;QACxD,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAEnD,+CAA+C;QAC/C,MAAMC,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;YAAED;QAAQ;QAEtF,qDAAqD;QACrD,IAAIG,oBAAoB;YACtBJ,OAAOK,KAAK,CAAC,wBAAwB;gBAAEJ;gBAASF,WAAWK;YAAmB;YAE9E,4CAA4C;YAC5C,MAAME,cAAc,MAAMlB,SAAsBc,YAAY;gBAAEH,WAAWK;gBAAoBH;YAAQ;YAErG,IAAIK,eAAe,IAAI,CAACC,YAAY,CAACD,cAAc;gBACjDN,OAAOK,KAAK,CAAC,6BAA6B;oBAAEN,WAAWK;gBAAmB;gBAC1E,OAAOE,YAAYE,WAAW;YAChC;YAEA,6DAA6D;YAC7D,IAAIF,wBAAAA,kCAAAA,YAAaG,YAAY,EAAE;gBAC7B,IAAI;oBACFT,OAAOU,IAAI,CAAC,mCAAmC;wBAAEX,WAAWK;oBAAmB;oBAC/E,MAAMO,iBAAiB,MAAM,IAAI,CAACC,kBAAkB,CAACN,YAAYG,YAAY;oBAC7E,MAAMjB,SAASU,YAAY;wBAAEH,WAAWK;wBAAoBH;oBAAQ,GAAGU;oBACvE,OAAOA,eAAeH,WAAW;gBACnC,EAAE,OAAOK,OAAO;oBACdb,OAAOU,IAAI,CAAC,iDAAiD;wBAC3DX,WAAWK;wBACXS,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;oBACzD;gBACA,iCAAiC;gBACnC;YACF;QACF;QAEA,kEAAkE;QAClE,MAAM,EAAEI,QAAQ,EAAE,GAAG,IAAI,CAACd,MAAM;QAChC,IAAIc,UAAU;YACZ,yDAAyD;YACzD,yEAAyE;YACzE,MAAM,EAAEC,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAACjB,MAAM;YAEjD,6DAA6D;YAC7D,MAAMkB,mBAAmB,MAAM,IAAI,CAACC,mBAAmB;YACvD,MAAMC,mBAAmBnB,qBAAqBiB,iBAAiBG,MAAM,GAAG,KAAK,CAACH,iBAAiBI,QAAQ,CAACrB,sBAAsBiB,iBAAiBG,MAAM,GAAG;YAExJ,kDAAkD;YAClD,uGAAuG;YACvG,MAAME,UAAU,IAAIC,IAAI,CAAC,kCAAkC,EAAER,SAAS,sBAAsB,CAAC;YAC7FO,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaX;YACtCQ,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;YAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;YAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;YAEnC,wDAAwD;YACxD,IAAIC;YACJ,IAAIP,kBAAkB;gBACpBO,OAAO,CAAC,SAAS,EAAE7B,QAAQ,8GAA8G,CAAC;YAC5I,OAAO,IAAIG,oBAAoB;gBAC7B0B,OAAO,CAAC,gCAAgC,EAAE1B,oBAAoB;YAChE,OAAO;gBACL0B,OAAO;YACT;YAEA,MAAMC,iBAAiB;gBACrBC,MAAM;gBACNC,UAAU;gBACVC,KAAKR,QAAQS,QAAQ;gBACrBL;YACF;YAEA,MAAMM,aAA0DhC,qBAAqB;gBAAE,GAAG2B,cAAc;gBAAEhC,WAAWK;YAAmB,IAAI2B;YAE5I,MAAM,IAAInC,kBAAkBwC;QAC9B;QAEA,gDAAgD;QAChDpC,OAAOU,IAAI,CAAC,iCAAiC;YAAET;YAASgB;QAAS;QACjE,MAAM,EAAEoB,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,sCAAsC;QACtC,MAAM/C,SAASU,YAAY;YAAEH,WAAWuC;YAAOrC;QAAQ,GAAGoC;QAE1D,gDAAgD;QAChD,MAAMtD,WAAWmB,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAEzD,qEAAqE;QACrE,MAAM/C,iBAAiBW,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAE/D,kDAAkD;QAClD,MAAMhD,eACJY,YACA;YAAED;YAASF,WAAWuC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGF1C,OAAOU,IAAI,CAAC,wBAAwB;YAAET;YAASF,WAAWuC;QAAM;QAEhE,OAAOD,MAAM7B,WAAW;IAC1B;IAEA;;;;;GAKC,GACDmC,eAAe5C,SAAkB,EAA6C;QAC5E,yDAAyD;QACzD,MAAMX,WAAW,IAAM,IAAI,CAACU,cAAc,CAACC;QAE3C,OAAO;YACLD,gBAAgBV;QAClB;IACF;IAEA;;;;;;GAMC,GACD,MAAMwD,yBAA0C;QAC9C,MAAM,EAAE5C,MAAM,EAAEiB,QAAQ,EAAEhB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAE7D,IAAIc,UAAU;YACZ,MAAM,IAAIH,MAAM;QAClB;QAEAd,OAAOU,IAAI,CAAC,uCAAuC;YAAET;QAAQ;QAE7D,uCAAuC;QACvC,MAAM,EAAEoC,KAAK,EAAEC,KAAK,EAAE,GAAG,MAAM,IAAI,CAACC,yBAAyB;QAE7D,cAAc;QACd,MAAM/C,SAASU,YAAY;YAAEH,WAAWuC;YAAOrC;QAAQ,GAAGoC;QAE1D,mBAAmB;QACnB,MAAMtD,WAAWmB,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAEzD,wBAAwB;QACxB,MAAM/C,iBAAiBW,YAAY;YAAED;YAASF,WAAWuC;QAAM;QAE/D,yBAAyB;QACzB,MAAMhD,eACJY,YACA;YAAED;YAASF,WAAWuC;QAAM,GAC5B;YACEA;YACAE,SAAS,IAAIC,OAAOC,WAAW;QACjC;QAGF1C,OAAOU,IAAI,CAAC,6BAA6B;YAAET;YAASqC;QAAM;QAC1D,OAAOA;IACT;IAEA;;;;;;GAMC,GACD,MAAMO,aAAa9C,SAAkB,EAAmB;YAgB/C+C;QAfP,iCAAiC;QACjC,MAAMT,QAAQ,MAAM,IAAI,CAACvC,cAAc,CAACC;QAExC,mCAAmC;QACnC,MAAMgD,WAAW,MAAMpD,iBAAiB,uCAAuC;YAC7EqD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAEZ,OAAO;YAClC;QACF;QAEA,IAAI,CAACU,SAASG,EAAE,EAAE;YAChB,MAAM,IAAIpC,MAAM,CAAC,yBAAyB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAE,MAAMJ,SAASK,IAAI,IAAI;QACxF;QAEA,MAAMN,WAAY,MAAMC,SAASM,IAAI;QACrC,QAAOP,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;IACpD;IAEA;;;;;;GAMC,GACD,MAAcjC,sBAAyC;QACrD,MAAM,EAAErB,OAAO,EAAEC,UAAU,EAAE,GAAG,IAAI,CAACC,MAAM;QAC3C,OAAOd,eAAea,YAAYD;IACpC;IAEQM,aAAa8B,KAAkB,EAAW;QAChD,IAAI,CAACA,MAAMmB,SAAS,EAAE,OAAO,MAAM,2BAA2B;QAC9D,OAAOf,KAAKgB,GAAG,KAAKpB,MAAMmB,SAAS,GAAG,OAAO,kBAAkB;IACjE;IAEA;;;;;;GAMC,GACD,MAAcE,wBAAwBlD,WAAmB,EAAmB;YAe5DsC;QAdd,MAAM,EAAE9C,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAE9B,MAAM4C,WAAW,MAAMpD,iBAAiB,uCAAuC;YAC7EqD,SAAS;gBACPC,eAAe,CAAC,OAAO,EAAEzC,aAAa;YACxC;QACF;QAEA,IAAI,CAACuC,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,iCAAiC,EAAEiC,SAASI,MAAM,CAAC,GAAG,EAAEQ,WAAW;QACtF;QAEA,MAAMb,WAAY,MAAMC,SAASM,IAAI;QACrC,MAAMf,SAAQQ,iBAAAA,SAASQ,IAAI,cAAbR,4BAAAA,iBAAiBA,SAASS,iBAAiB;QAEzDvD,OAAOK,KAAK,CAAC,qCAAqC;YAAEiC;QAAM;QAC1D,OAAOA;IACT;IAEA,MAAcC,4BAA4E;QACxF,MAAM,EAAErB,QAAQ,EAAEC,QAAQ,EAAEC,KAAK,EAAEH,QAAQ,EAAEjB,MAAM,EAAE4D,aAAaC,iBAAiB,EAAE,GAAG,IAAI,CAAC1D,MAAM;QAEnG,0EAA0E;QAC1E,IAAI2D,aAAa,aAAa,mFAAmF;QACjH,IAAIC,aAAa,GAAG,sCAAsC;QAC1D,IAAIC,iBAAiB,SAAS,gBAAgB;QAC9C,IAAIC,eAAe,aAAa,wBAAwB;QACxD,IAAIC,mBAAmB;QAEvB,IAAIL,mBAAmB;YACrB,IAAI;gBACF,MAAMM,SAAS,IAAIxC,IAAIkC;gBAEvB,+DAA+D;gBAC/DC,aAAaK,OAAOC,QAAQ;gBAC5BJ,iBAAiBG,OAAOE,QAAQ;gBAEhC,6DAA6D;gBAC7D,IAAIF,OAAOG,IAAI,EAAE;oBACfP,aAAaQ,OAAOC,QAAQ,CAACL,OAAOG,IAAI,EAAE;gBAC5C,OAAO;oBACLP,aAAaI,OAAOE,QAAQ,KAAK,WAAW,MAAM;gBACpD;gBAEA,qEAAqE;gBACrE,IAAIF,OAAOM,QAAQ,IAAIN,OAAOM,QAAQ,KAAK,KAAK;oBAC9CR,eAAeE,OAAOM,QAAQ;gBAChC;gBAEAP,mBAAmB;gBAEnBlE,OAAOK,KAAK,CAAC,iCAAiC;oBAC5CqE,MAAMZ;oBACNO,UAAUL;oBACVM,MAAMP;oBACNY,MAAMV;oBACNL,aAAaC;gBACf;YACF,EAAE,OAAOhD,OAAO;gBACdb,OAAO4E,IAAI,CAAC,yDAAyD;oBACnEhB,aAAaC;oBACbhD,OAAOA,iBAAiBC,QAAQD,MAAME,OAAO,GAAGC,OAAOH;gBACzD;YACA,8DAA8D;YAChE;QACF;QAEA,OAAO,IAAIgE,QAAQ,CAACC,SAASC;YAC3B,0BAA0B;YAC1B,MAAM,EAAEC,UAAUC,YAAY,EAAEC,WAAWC,aAAa,EAAE,GAAGnG;YAE7D,IAAIoG,SAA6B;YACjC,IAAIC;YACJ,IAAIC,kBAA0B,wCAAwC;YAEtE,2DAA2D;YAC3DF,SAAS3F,KAAK8F,YAAY,CAAC,OAAOC,KAAKC;gBACrC,IAAI,CAACD,IAAItD,GAAG,EAAE;oBACZuD,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAY;oBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;oBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIjE,MAAM;oBACjB;gBACF;gBACA,MAAMoB,MAAM,IAAIP,IAAI6D,IAAItD,GAAG,EAAE,CAAC,iBAAiB,EAAEmD,YAAY;gBAE7D,IAAInD,IAAIuC,QAAQ,KAAKR,cAAc;oBACjC,MAAM4B,OAAO3D,IAAIN,YAAY,CAACkE,GAAG,CAAC;oBAClC,MAAMjF,QAAQqB,IAAIN,YAAY,CAACkE,GAAG,CAAC;oBAEnC,IAAIjF,OAAO;wBACT4E,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB2B;wBACzBuE,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIjE,MAAM,CAAC,aAAa,EAAED,OAAO;wBACxC;oBACF;oBAEA,IAAI,CAACgF,MAAM;wBACTJ,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;wBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAO,IAAIjE,MAAM;wBACjB;oBACF;oBAEA,IAAI;wBACF,mFAAmF;wBACnF,MAAMiF,gBAAgB,MAAM,IAAI,CAACC,oBAAoB,CAACH,MAAMZ,cAAcK;wBAE1E,qBAAqB;wBACrB,MAAMW,cAA2B;4BAC/BzF,aAAauF,cAAcG,YAAY;4BACvC,GAAIH,cAAcI,aAAa,KAAKC,aAAa;gCAAE3F,cAAcsF,cAAcI,aAAa;4BAAC,CAAC;4BAC9F,GAAIJ,cAAcM,UAAU,KAAKD,aAAa;gCAAE5C,WAAWf,KAAKgB,GAAG,KAAKsC,cAAcM,UAAU,GAAG;4BAAK,CAAC;4BACzG,GAAIN,cAAc3E,KAAK,KAAKgF,aAAa;gCAAEhF,OAAO2E,cAAc3E,KAAK;4BAAC,CAAC;wBACzE;wBAEA,0DAA0D;wBAC1D,MAAMkB,QAAQ,MAAM,IAAI,CAACoB,uBAAuB,CAACqC,cAAcG,YAAY;wBAE3ET,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACxG;wBACRiG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbd,QAAQ;4BAAEzC,OAAO4D;4BAAa3D;wBAAM;oBACtC,EAAE,OAAOgE,eAAe;wBACtBtG,OAAOa,KAAK,CAAC,yBAAyB;4BAAEA,OAAOyF,yBAAyBxF,QAAQwF,cAAcvF,OAAO,GAAGC,OAAOsF;wBAAe;wBAC9Hb,IAAIC,SAAS,CAAC,KAAK;4BAAE,gBAAgB;wBAAY;wBACjDD,IAAIE,GAAG,CAACzG,iBAAiB;wBACzBkG,mBAAAA,6BAAAA,OAAQQ,KAAK;wBACbb,OAAOuB;oBACT;gBACF,OAAO;oBACLb,IAAIC,SAAS,CAAC,KAAK;wBAAE,gBAAgB;oBAAa;oBAClDD,IAAIE,GAAG,CAAC;gBACV;YACF;YAEA,8EAA8E;YAC9EP,OAAOmB,MAAM,CAACxC,YAAYD,YAAY;gBACpC,MAAM0C,UAAUpB,mBAAAA,6BAAAA,OAAQoB,OAAO;gBAC/B,IAAI,CAACA,WAAW,OAAOA,YAAY,UAAU;oBAC3CpB,mBAAAA,6BAAAA,OAAQQ,KAAK;oBACbb,OAAO,IAAIjE,MAAM;oBACjB;gBACF;gBAEAuE,aAAamB,QAAQlC,IAAI;gBAEzB,+BAA+B;gBAC/B,IAAIJ,oBAAoBL,mBAAmB;oBACzC,mDAAmD;oBACnDyB,mBAAmBzB;gBACrB,OAAO;oBACL,2DAA2D;oBAC3DyB,mBAAmB,GAAGtB,eAAe,EAAE,EAAEF,WAAW,CAAC,EAAEuB,aAAapB,cAAc;gBACpF;gBAEA,2BAA2B;gBAC3B,MAAMvC,UAAU,IAAIC,IAAI,CAAC,kCAAkC,EAAER,SAAS,sBAAsB,CAAC;gBAC7FO,QAAQE,YAAY,CAACC,GAAG,CAAC,aAAaX;gBACtCQ,QAAQE,YAAY,CAACC,GAAG,CAAC,gBAAgByD;gBACzC5D,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;gBAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,SAAST;gBAClCM,QAAQE,YAAY,CAACC,GAAG,CAAC,iBAAiB;gBAC1CH,QAAQE,YAAY,CAACC,GAAG,CAAC,kBAAkBsD;gBAC3CzD,QAAQE,YAAY,CAACC,GAAG,CAAC,yBAAyB;gBAClDH,QAAQE,YAAY,CAACC,GAAG,CAAC,UAAU;gBAEnC7B,OAAOU,IAAI,CAAC,kCAAkC;oBAAE4D,MAAMe;oBAAYpE;gBAAS;gBAE3E,IAAIA,UAAU;oBACZ,mEAAmE;oBACnEwF,QAAQ5F,KAAK,CAAC;oBACd4F,QAAQ5F,KAAK,CAAC;oBACd4F,QAAQ5F,KAAK,CAAC,CAAC,GAAG,EAAEa,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC1CsE,QAAQ5F,KAAK,CAAC;gBAChB,OAAO;oBACL,+CAA+C;oBAC/Cb,OAAOU,IAAI,CAAC;oBACZhB,KAAKgC,QAAQS,QAAQ,IAAIuE,KAAK,CAAC,CAAC7F;wBAC9Bb,OAAOU,IAAI,CAAC,wCAAwC;4BAAEG,OAAOA,MAAME,OAAO;wBAAC;wBAC3E0F,QAAQ5F,KAAK,CAAC;wBACd4F,QAAQ5F,KAAK,CAAC,CAAC,GAAG,EAAEa,QAAQS,QAAQ,GAAG,EAAE,CAAC;oBAC5C;gBACF;YACF;YAEA,0BAA0B;YAC1BwE,WACE;gBACE,IAAIvB,QAAQ;oBACVA,OAAOQ,KAAK;oBACZb,OAAO,IAAIjE,MAAM;gBACnB;YACF,GACA,IAAI,KAAK;QAEb;IACF;IAEA,MAAckF,qBAAqBH,IAAY,EAAEZ,YAAoB,EAAErB,WAAmB,EAA0B;QAClH,MAAM,EAAE1C,QAAQ,EAAE0F,YAAY,EAAEzF,QAAQ,EAAE,GAAG,IAAI,CAAChB,MAAM;QAExD,MAAM0G,WAAW,CAAC,kCAAkC,EAAE1F,SAAS,kBAAkB,CAAC;QAClF,MAAM2F,SAAiC;YACrCjB;YACAkB,WAAW7F;YACX8F,cAAcpD;YACdqD,YAAY;YACZC,eAAejC;QACjB;QAEA,sDAAsD;QACtD,IAAI2B,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM/D,WAAW,MAAMpD,iBAAiBkH,UAAU;YAChDS,QAAQ;YACRtE,SAAS;gBACP,gBAAgB;YAClB;YACAoE,MAAMA,KAAKjF,QAAQ;QACrB;QAEA,IAAI,CAACY,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,uBAAuB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAEQ,WAAW;QAC1E;QAEA,OAAQ,MAAMZ,SAASM,IAAI;IAC7B;IAEA,MAAczC,mBAAmBH,YAAoB,EAAwB;QAC3E,MAAM,EAAES,QAAQ,EAAE0F,YAAY,EAAEzF,QAAQ,EAAEC,KAAK,EAAE,GAAG,IAAI,CAACjB,MAAM;QAE/D,MAAM0G,WAAW,CAAC,kCAAkC,EAAE1F,SAAS,kBAAkB,CAAC;QAClF,MAAM2F,SAAiC;YACrCX,eAAe1F;YACfsG,WAAW7F;YACX+F,YAAY;YACZ7F;QACF;QAEA,sDAAsD;QACtD,IAAIwF,cAAc;YAChBE,OAAOK,aAAa,GAAGP;QACzB;QAEA,MAAMQ,OAAO,IAAIC,gBAAgBP;QAEjC,MAAM/D,WAAW,MAAMpD,iBAAiBkH,UAAU;YAChDS,QAAQ;YACRtE,SAAS;gBACP,gBAAgB;YAClB;YACAoE,MAAMA,KAAKjF,QAAQ;QACrB;QAEA,IAAI,CAACY,SAASG,EAAE,EAAE;YAChB,MAAMS,YAAY,MAAMZ,SAASK,IAAI;YACrC,MAAM,IAAItC,MAAM,CAAC,sBAAsB,EAAEiC,SAASI,MAAM,CAAC,CAAC,EAAEQ,WAAW;QACzE;QAEA,MAAMoC,gBAAiB,MAAMhD,SAASM,IAAI;QAE1C,OAAO;YACL7C,aAAauF,cAAcG,YAAY;YACvCzF,cAAcA;YACd,GAAIsF,cAAcM,UAAU,KAAKD,aAAa;gBAAE5C,WAAWf,KAAKgB,GAAG,KAAKsC,cAAcM,UAAU,GAAG;YAAK,CAAC;YACzG,GAAIN,cAAc3E,KAAK,KAAKgF,aAAa;gBAAEhF,OAAO2E,cAAc3E,KAAK;YAAC,CAAC;QACzE;IACF;IAEA;;;;;;;;;;;;;;;;;;GAkBC,GACDmG,iBAAiB;QACf,MAAM,EAAEtH,OAAO,EAAEC,UAAU,EAAEF,MAAM,EAAE,GAAG,IAAI,CAACG,MAAM;QAEnD,0EAA0E;QAC1E,sFAAsF;QACtF,MAAMqH,iBAAiB,CAAuEC,QAAWC;YACvG,MAAMC,YAAYF,OAAOG,IAAI;YAC7B,MAAMC,kBAAkBJ,OAAOK,OAAO;YAEtC,MAAMC,iBAAiB,OAAO,GAAGC;gBAC/B,oFAAoF;gBACpF,IAAIC;gBACJ,IAAID,QAAQxG,MAAM,IAAIkG,eAAe;oBACnC,uEAAuE;oBACvEO,QAASD,OAAO,CAAC,EAAE,IAAI,OAAOA,OAAO,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC;oBAC9DA,OAAO,CAACN,cAAc,GAAGO;gBAC3B,OAAO;oBACLA,QAASD,OAAO,CAACN,cAAc,IAAI,CAAC;oBACpCM,OAAO,CAACN,cAAc,GAAGO;gBAC3B;gBAEA,IAAI;oBACF,qDAAqD;oBACrD,IAAIlI;oBACJ,IAAI;;4BACUkI;wBAAZlI,qBAAYkI,eAAAA,MAAMC,KAAK,cAAXD,mCAAAA,aAAalI,SAAS,uCAAK,MAAMd,iBAAiBiB,YAAY;4BAAED;wBAAQ;oBACtF,EAAE,OAAOY,OAAO;wBACd,IAAIA,iBAAiBC,SAAU,CAAA,AAACD,MAA4BgF,IAAI,KAAK,6BAA6BhF,MAAM+G,IAAI,KAAK,qBAAoB,GAAI;4BACvI7H,YAAYqG;wBACd,OAAO;4BACL,MAAMvF;wBACR;oBACF;oBAEA,sDAAsD;oBACtD,MAAM,IAAI,CAACf,cAAc,CAACC;oBAE1B,4EAA4E;oBAC5E,MAAMK,qBAAqBL,sBAAAA,uBAAAA,YAAc,MAAMd,iBAAiBiB,YAAY;wBAAED;oBAAQ;oBACtF,IAAI,CAACG,oBAAoB;wBACvB,MAAM,IAAIU,MAAM,CAAC,8CAA8C,EAAEb,SAAS;oBAC5E;oBAEA,MAAMkI,OAAO,IAAI,CAACxF,cAAc,CAACvC;oBAEjC,2CAA2C;oBAC1C6H,MAAwCG,WAAW,GAAG;wBACrDD;wBACApI,WAAWK;oBACb;oBACC6H,MAA+BjI,MAAM,GAAGA;oBAEzC,sCAAsC;oBACtC,OAAO,MAAM6H,mBAAmBG;gBAClC,EAAE,OAAOnH,OAAO;oBACd,wDAAwD;oBACxD,IAAIA,iBAAiBjB,mBAAmB;wBACtCI,OAAOU,IAAI,CAAC,2BAA2B;4BACrCT;4BACAoI,MAAMV;4BACNvF,YAAYvB,MAAMuB,UAAU;wBAC9B;wBAEA,yFAAyF;wBACzF,2GAA2G;wBAC3G,MAAMkG,uBAAuB;4BAC3BC,MAAM;4BACNtG,UAAUhC;4BACVc,SAAS,CAAC,4BAA4B,EAAE4G,UAAU,2BAA2B,EAAE1H,QAAQ,CAAC,CAAC;4BACzFiC,KAAKrB,MAAMuB,UAAU,CAACJ,IAAI,KAAK,aAAanB,MAAMuB,UAAU,CAACF,GAAG,GAAGkE;wBACrE;wBAEA,OAAO;4BACLoC,SAAS;gCACP;oCACED,MAAM;oCACNnF,MAAMqF,KAAKC,SAAS,CAAC;wCAAEC,QAAQL;oCAAqB;gCACtD;6BACD;4BACDM,mBAAmB;gCAAED,QAAQL;4BAAqB;wBACpD;oBACF;oBAEA,2BAA2B;oBAC3B,MAAMzH;gBACR;YACF;YAEA,OAAO;gBACL,GAAG4G,MAAM;gBACTK,SAASC;YACX;QACF;QAEA,OAAO;YACL,4EAA4E;YAC5E,wDAAwD;YACxDc,cAAc,CAAgEpB,SAAcD,eAAeC,QAAQ;YACnHqB,kBAAkB,CAAqFrB,SAAcD,eAAeC,QAAQ;YAC5IsB,gBAAgB,CAAgEtB,SAAcD,eAAeC,QAAQ;QACvH;IACF;IA7mBA,YAAYtH,MAA2B,CAAE;QACvC,IAAI,CAACA,MAAM,GAAGA;IAChB;AA4mBF;AAEA;;;CAGC,GACD,OAAO,SAAS6I,wBAAwB7I,MAA2B;IACjE,OAAO,IAAIN,sBAAsBM;AACnC"}

package/dist/esm/schemas/index.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+export declare const AuthRequiredBranchSchema: z.ZodObject<{
+    type: z.ZodLiteral<"auth_required">;
+    provider: z.ZodString;
+    message: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;
+export declare const AuthRequiredSchema: z.ZodObject<{
+    type: z.ZodLiteral<"auth_required">;
+    provider: z.ZodString;
+    message: z.ZodString;
+    url: z.ZodString;
+    flow: z.ZodOptional<z.ZodString>;
+    instructions: z.ZodString;
+    user_code: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodNumber>;
+    accountId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthRequired = z.infer<typeof AuthRequiredSchema>;

package/dist/esm/schemas/index.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export const AuthRequiredBranchSchema = z.object({
+    type: z.literal('auth_required'),
+    provider: z.string(),
+    message: z.string(),
+    url: z.string().optional()
+});
+export const AuthRequiredSchema = z.object({
+    type: z.literal('auth_required'),
+    provider: z.string().describe('OAuth provider name (e.g., "google")'),
+    message: z.string().describe('Human-readable message explaining why auth is needed'),
+    url: z.string().url().describe('Authentication URL to open in browser'),
+    flow: z.string().optional().describe('Authentication flow type (e.g., "auth_url", "device_code")'),
+    instructions: z.string().describe('Clear instructions for the user'),
+    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),
+    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),
+    accountId: z.string().optional().describe('Account identifier (email) that requires authentication')
+}).describe('Authentication required with clear actionable instructions for user');

package/dist/esm/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/schemas/index.ts"],"sourcesContent":["import { z } from 'zod';\n\nexport const AuthRequiredBranchSchema = z.object({\n  type: z.literal('auth_required'),\n  provider: z.string(),\n  message: z.string(),\n  url: z.string().optional(),\n});\nexport type AuthRequiredBranch = z.infer<typeof AuthRequiredBranchSchema>;\n\nexport const AuthRequiredSchema = z\n  .object({\n    type: z.literal('auth_required'),\n    provider: z.string().describe('OAuth provider name (e.g., \"google\")'),\n    message: z.string().describe('Human-readable message explaining why auth is needed'),\n    url: z.string().url().describe('Authentication URL to open in browser'),\n    flow: z.string().optional().describe('Authentication flow type (e.g., \"auth_url\", \"device_code\")'),\n    instructions: z.string().describe('Clear instructions for the user'),\n    user_code: z.string().optional().describe('Code user must enter at verification URL (device flows only)'),\n    expires_in: z.number().optional().describe('Seconds until code expires (device flows only)'),\n    accountId: z.string().optional().describe('Account identifier (email) that requires authentication'),\n  })\n  .describe('Authentication required with clear actionable instructions for user');\n\nexport type AuthRequired = z.infer<typeof AuthRequiredSchema>;\n"],"names":["z","AuthRequiredBranchSchema","object","type","literal","provider","string","message","url","optional","AuthRequiredSchema","describe","flow","instructions","user_code","expires_in","number","accountId"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAM;AAExB,OAAO,MAAMC,2BAA2BD,EAAEE,MAAM,CAAC;IAC/CC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM;IAClBC,SAASP,EAAEM,MAAM;IACjBE,KAAKR,EAAEM,MAAM,GAAGG,QAAQ;AAC1B,GAAG;AAGH,OAAO,MAAMC,qBAAqBV,EAC/BE,MAAM,CAAC;IACNC,MAAMH,EAAEI,OAAO,CAAC;IAChBC,UAAUL,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC9BJ,SAASP,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAC7BH,KAAKR,EAAEM,MAAM,GAAGE,GAAG,GAAGG,QAAQ,CAAC;IAC/BC,MAAMZ,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IACrCE,cAAcb,EAAEM,MAAM,GAAGK,QAAQ,CAAC;IAClCG,WAAWd,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;IAC1CI,YAAYf,EAAEgB,MAAM,GAAGP,QAAQ,GAAGE,QAAQ,CAAC;IAC3CM,WAAWjB,EAAEM,MAAM,GAAGG,QAAQ,GAAGE,QAAQ,CAAC;AAC5C,GACCA,QAAQ,CAAC,uEAAuE"}

package/dist/esm/setup/config.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Microsoft OAuth configuration parsing from CLI arguments and environment variables.
+ *
+ * This module provides utilities to parse Microsoft OAuth configuration from
+ * CLI arguments and environment variables, following the same pattern as @mcp-z/server's
+ * parseConfig().
+ */
+import type { DcrConfig, OAuthConfig } from '../types.js';
+export type { DcrConfig, OAuthConfig };
+/**
+ * Transport type for MCP servers
+ */
+type TransportType = 'stdio' | 'http';
+/**
+ * Parse Microsoft OAuth configuration from CLI arguments and environment variables.
+ *
+ * CLI Arguments:
+ * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')
+ *   - Default: 'loopback-oauth' (if flag is omitted)
+ * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)
+ * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)
+ * - --tenant-id: Override Microsoft tenant ID
+ *
+ * Required environment variables:
+ * - MS_CLIENT_ID: Azure AD application (client) ID
+ * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)
+ *
+ * Optional environment variables:
+ * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)
+ * - AUTH_MODE: OAuth mode (same format as --auth flag)
+ * - HEADLESS: Headless mode flag ('true' to enable)
+ * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)
+ *
+ * @param args - CLI arguments array (typically process.argv)
+ * @param env - Environment variables object (typically process.env)
+ * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.
+ * @returns Parsed Microsoft OAuth configuration
+ * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport
+ *
+ * @example Default mode (no flags)
+ * ```typescript
+ * const config = parseConfig(process.argv, process.env);
+ * // { auth: 'loopback-oauth' }
+ * ```
+ *
+ * @example Override auth mode
+ * ```typescript
+ * parseConfig(['--auth=loopback-oauth'], process.env);
+ * parseConfig(['--auth=device-code'], process.env);
+ * ```
+ *
+ * @example With transport validation
+ * ```typescript
+ * parseConfig(['--auth=dcr'], process.env, 'http'); // OK
+ * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error
+ * ```
+ *
+ * Valid auth modes:
+ * - loopback-oauth (default)
+ * - device-code
+ * - dcr (HTTP transport only)
+ */
+export declare function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig;
+/**
+ * Build production configuration from process globals.
+ * Entry point for production server.
+ */
+export declare function createConfig(): OAuthConfig;
+/**
+ * Parse DCR configuration from CLI arguments and environment variables.
+ *
+ * CLI Arguments:
+ * - --dcr-mode: DCR mode ('self-hosted' | 'external')
+ *   - Default: 'self-hosted' (if flag is omitted)
+ * - --dcr-verify-url: External verification endpoint URL (required for external mode)
+ * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)
+ * - --tenant-id: Override Microsoft tenant ID
+ *
+ * Required environment variables:
+ * - MS_CLIENT_ID: Azure AD application (client) ID
+ * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)
+ *
+ * Optional environment variables:
+ * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)
+ * - DCR_MODE: DCR mode (same format as --dcr-mode flag)
+ * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)
+ * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)
+ *
+ * @param args - CLI arguments array (typically process.argv)
+ * @param env - Environment variables object (typically process.env)
+ * @param scope - OAuth scopes to request (space-separated)
+ * @returns Parsed DCR configuration
+ * @throws Error if required environment variables are missing or validation fails
+ *
+ * @example Self-hosted mode
+ * ```typescript
+ * const config = parseDcrConfig(
+ *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],
+ *   process.env,
+ *   'https://graph.microsoft.com/.default'
+ * );
+ * ```
+ *
+ * @example External mode
+ * ```typescript
+ * const config = parseDcrConfig(
+ *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],
+ *   process.env,
+ *   'https://graph.microsoft.com/.default'
+ * );
+ * ```
+ */
+export declare function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig;

package/dist/esm/setup/config.js

@@ -0,0 +1,268 @@
+/**
+ * Microsoft OAuth configuration parsing from CLI arguments and environment variables.
+ *
+ * This module provides utilities to parse Microsoft OAuth configuration from
+ * CLI arguments and environment variables, following the same pattern as @mcp-z/server's
+ * parseConfig().
+ */ import { parseArgs } from 'util';
+/**
+ * Parse OAuth mode string into auth mode.
+ *
+ * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')
+ * @returns Parsed auth mode
+ * @throws Error if value is invalid
+ *
+ * @example Valid formats
+ * ```typescript
+ * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }
+ * parseAuthMode('device-code')      // { auth: 'device-code' }
+ * parseAuthMode('dcr')              // { auth: 'dcr' }
+ * ```
+ */ function parseAuthMode(value) {
+    // Validate auth mode
+    if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {
+        throw new Error(`Invalid --auth value: "${value}". Valid values: loopback-oauth, device-code, dcr`);
+    }
+    return {
+        auth: value
+    };
+}
+/**
+ * Parse Microsoft OAuth configuration from CLI arguments and environment variables.
+ *
+ * CLI Arguments:
+ * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')
+ *   - Default: 'loopback-oauth' (if flag is omitted)
+ * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)
+ * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)
+ * - --tenant-id: Override Microsoft tenant ID
+ *
+ * Required environment variables:
+ * - MS_CLIENT_ID: Azure AD application (client) ID
+ * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)
+ *
+ * Optional environment variables:
+ * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)
+ * - AUTH_MODE: OAuth mode (same format as --auth flag)
+ * - HEADLESS: Headless mode flag ('true' to enable)
+ * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)
+ *
+ * @param args - CLI arguments array (typically process.argv)
+ * @param env - Environment variables object (typically process.env)
+ * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.
+ * @returns Parsed Microsoft OAuth configuration
+ * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport
+ *
+ * @example Default mode (no flags)
+ * ```typescript
+ * const config = parseConfig(process.argv, process.env);
+ * // { auth: 'loopback-oauth' }
+ * ```
+ *
+ * @example Override auth mode
+ * ```typescript
+ * parseConfig(['--auth=loopback-oauth'], process.env);
+ * parseConfig(['--auth=device-code'], process.env);
+ * ```
+ *
+ * @example With transport validation
+ * ```typescript
+ * parseConfig(['--auth=dcr'], process.env, 'http'); // OK
+ * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error
+ * ```
+ *
+ * Valid auth modes:
+ * - loopback-oauth (default)
+ * - device-code
+ * - dcr (HTTP transport only)
+ */ export function parseConfig(args, env, transport) {
+    var _ref;
+    function requiredEnv(key) {
+        const value = env[key];
+        if (!value) {
+            throw new Error(`Environment variable ${key} is required for Microsoft OAuth`);
+        }
+        return value;
+    }
+    // Parse CLI arguments
+    const { values } = parseArgs({
+        args,
+        options: {
+            auth: {
+                type: 'string'
+            },
+            headless: {
+                type: 'boolean'
+            },
+            'redirect-uri': {
+                type: 'string'
+            },
+            'tenant-id': {
+                type: 'string'
+            }
+        },
+        strict: false,
+        allowPositionals: true
+    });
+    // Parse OAuth mode
+    const authArg = typeof values.auth === 'string' ? values.auth : undefined;
+    const envAuthMode = env.AUTH_MODE;
+    const mode = authArg || envAuthMode;
+    let auth;
+    if (mode) {
+        const parsed = parseAuthMode(mode);
+        auth = parsed.auth;
+    } else {
+        // DEFAULT: No flags provided, use loopback-oauth
+        auth = 'loopback-oauth';
+    }
+    // Validate: DCR only works with HTTP transport
+    if (auth === 'dcr' && transport === 'stdio') {
+        throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');
+    }
+    // Parse headless mode
+    const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;
+    const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;
+    const headless = (_ref = cliHeadless !== null && cliHeadless !== void 0 ? cliHeadless : envHeadless) !== null && _ref !== void 0 ? _ref : false;
+    // Parse redirect-uri (CLI overrides ENV)
+    const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;
+    const envRedirectUri = env.REDIRECT_URI;
+    const redirectUri = cliRedirectUri !== null && cliRedirectUri !== void 0 ? cliRedirectUri : envRedirectUri;
+    // Parse tenant-id (CLI overrides environment)
+    const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;
+    const tenantId = cliTenantId !== null && cliTenantId !== void 0 ? cliTenantId : requiredEnv('MS_TENANT_ID');
+    // Parse credentials
+    const clientId = requiredEnv('MS_CLIENT_ID');
+    const clientSecret = env.MS_CLIENT_SECRET;
+    return {
+        clientId,
+        tenantId,
+        ...clientSecret && {
+            clientSecret
+        },
+        auth,
+        headless,
+        ...redirectUri && {
+            redirectUri
+        }
+    };
+}
+/**
+ * Build production configuration from process globals.
+ * Entry point for production server.
+ */ export function createConfig() {
+    return parseConfig(process.argv, process.env);
+}
+/**
+ * Parse DCR configuration from CLI arguments and environment variables.
+ *
+ * CLI Arguments:
+ * - --dcr-mode: DCR mode ('self-hosted' | 'external')
+ *   - Default: 'self-hosted' (if flag is omitted)
+ * - --dcr-verify-url: External verification endpoint URL (required for external mode)
+ * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)
+ * - --tenant-id: Override Microsoft tenant ID
+ *
+ * Required environment variables:
+ * - MS_CLIENT_ID: Azure AD application (client) ID
+ * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)
+ *
+ * Optional environment variables:
+ * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)
+ * - DCR_MODE: DCR mode (same format as --dcr-mode flag)
+ * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)
+ * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)
+ *
+ * @param args - CLI arguments array (typically process.argv)
+ * @param env - Environment variables object (typically process.env)
+ * @param scope - OAuth scopes to request (space-separated)
+ * @returns Parsed DCR configuration
+ * @throws Error if required environment variables are missing or validation fails
+ *
+ * @example Self-hosted mode
+ * ```typescript
+ * const config = parseDcrConfig(
+ *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],
+ *   process.env,
+ *   'https://graph.microsoft.com/.default'
+ * );
+ * ```
+ *
+ * @example External mode
+ * ```typescript
+ * const config = parseDcrConfig(
+ *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],
+ *   process.env,
+ *   'https://graph.microsoft.com/.default'
+ * );
+ * ```
+ */ export function parseDcrConfig(args, env, scope) {
+    function requiredEnv(key) {
+        const value = env[key];
+        if (!value) {
+            throw new Error(`Environment variable ${key} is required for DCR configuration`);
+        }
+        return value;
+    }
+    // Parse CLI arguments
+    const { values } = parseArgs({
+        args,
+        options: {
+            'dcr-mode': {
+                type: 'string'
+            },
+            'dcr-verify-url': {
+                type: 'string'
+            },
+            'dcr-store-uri': {
+                type: 'string'
+            },
+            'tenant-id': {
+                type: 'string'
+            }
+        },
+        strict: false,
+        allowPositionals: true
+    });
+    // Parse DCR mode (CLI overrides environment)
+    const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;
+    const envMode = env.DCR_MODE;
+    const mode = cliMode || envMode || 'self-hosted';
+    // Validate DCR mode
+    if (mode !== 'self-hosted' && mode !== 'external') {
+        throw new Error(`Invalid --dcr-mode value: "${mode}". Valid values: self-hosted, external`);
+    }
+    // Parse verify URL (CLI overrides environment)
+    const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;
+    const envVerifyUrl = env.DCR_VERIFY_URL;
+    const verifyUrl = cliVerifyUrl || envVerifyUrl;
+    // Parse store URI (CLI overrides environment)
+    const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;
+    const envStoreUri = env.DCR_STORE_URI;
+    const storeUri = cliStoreUri || envStoreUri;
+    // Validate mode-specific required fields
+    if (mode === 'external' && !verifyUrl) {
+        throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');
+    }
+    // Parse tenant-id (CLI overrides environment)
+    const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;
+    const tenantId = cliTenantId !== null && cliTenantId !== void 0 ? cliTenantId : requiredEnv('MS_TENANT_ID');
+    // Parse credentials
+    const clientId = requiredEnv('MS_CLIENT_ID');
+    const clientSecret = env.MS_CLIENT_SECRET;
+    return {
+        mode,
+        ...verifyUrl && {
+            verifyUrl
+        },
+        ...storeUri && {
+            storeUri
+        },
+        clientId,
+        ...clientSecret && {
+            clientSecret
+        },
+        tenantId,
+        scope
+    };
+}

package/dist/esm/setup/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/kevin/Dev/Projects/ai/mcp-z/oauth/oauth-microsoft/src/setup/config.ts"],"sourcesContent":["/**\n * Microsoft OAuth configuration parsing from CLI arguments and environment variables.\n *\n * This module provides utilities to parse Microsoft OAuth configuration from\n * CLI arguments and environment variables, following the same pattern as @mcp-z/server's\n * parseConfig().\n */\n\nimport { parseArgs } from 'util';\nimport type { DcrConfig, OAuthConfig } from '../types.ts';\n\n// Re-export for external use\nexport type { DcrConfig, OAuthConfig };\n\n/**\n * Auth mode type (from OAuthConfig)\n */\ntype AuthMode = 'loopback-oauth' | 'device-code' | 'dcr';\n\n/**\n * Parse OAuth mode string into auth mode.\n *\n * @param value - OAuth mode string ('loopback-oauth', 'device-code', or 'dcr')\n * @returns Parsed auth mode\n * @throws Error if value is invalid\n *\n * @example Valid formats\n * ```typescript\n * parseAuthMode('loopback-oauth')   // { auth: 'loopback-oauth' }\n * parseAuthMode('device-code')      // { auth: 'device-code' }\n * parseAuthMode('dcr')              // { auth: 'dcr' }\n * ```\n */\nfunction parseAuthMode(value: string): {\n  auth: AuthMode;\n} {\n  // Validate auth mode\n  if (value !== 'loopback-oauth' && value !== 'device-code' && value !== 'dcr') {\n    throw new Error(`Invalid --auth value: \"${value}\". Valid values: loopback-oauth, device-code, dcr`);\n  }\n\n  return {\n    auth: value as AuthMode,\n  };\n}\n\n/**\n * Transport type for MCP servers\n */\ntype TransportType = 'stdio' | 'http';\n\n/**\n * Parse Microsoft OAuth configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --auth: OAuth mode ('loopback-oauth' | 'device-code' | 'dcr')\n *   - Default: 'loopback-oauth' (if flag is omitted)\n * - --headless: Disable browser opening for OAuth flow (default: false, true in test env)\n * - --redirect-uri: Override OAuth redirect URI (default: ephemeral loopback)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - AUTH_MODE: OAuth mode (same format as --auth flag)\n * - HEADLESS: Headless mode flag ('true' to enable)\n * - REDIRECT_URI: OAuth redirect URI (overridden by --redirect-uri CLI flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param transport - Optional transport type. If 'stdio' and auth mode is 'dcr', throws an error.\n * @returns Parsed Microsoft OAuth configuration\n * @throws Error if required environment variables are missing, values are invalid, or DCR is used with stdio transport\n *\n * @example Default mode (no flags)\n * ```typescript\n * const config = parseConfig(process.argv, process.env);\n * // { auth: 'loopback-oauth' }\n * ```\n *\n * @example Override auth mode\n * ```typescript\n * parseConfig(['--auth=loopback-oauth'], process.env);\n * parseConfig(['--auth=device-code'], process.env);\n * ```\n *\n * @example With transport validation\n * ```typescript\n * parseConfig(['--auth=dcr'], process.env, 'http'); // OK\n * parseConfig(['--auth=dcr'], process.env, 'stdio'); // Throws error\n * ```\n *\n * Valid auth modes:\n * - loopback-oauth (default)\n * - device-code\n * - dcr (HTTP transport only)\n */\nexport function parseConfig(args: string[], env: Record<string, string | undefined>, transport?: TransportType): OAuthConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for Microsoft OAuth`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      auth: { type: 'string' },\n      headless: { type: 'boolean' },\n      'redirect-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse OAuth mode\n  const authArg = typeof values.auth === 'string' ? values.auth : undefined;\n  const envAuthMode = env.AUTH_MODE;\n  const mode = authArg || envAuthMode;\n\n  let auth: AuthMode;\n\n  if (mode) {\n    const parsed = parseAuthMode(mode);\n    auth = parsed.auth;\n  } else {\n    // DEFAULT: No flags provided, use loopback-oauth\n    auth = 'loopback-oauth';\n  }\n\n  // Validate: DCR only works with HTTP transport\n  if (auth === 'dcr' && transport === 'stdio') {\n    throw new Error('DCR authentication mode requires HTTP transport. DCR is not supported with stdio transport.');\n  }\n\n  // Parse headless mode\n  const cliHeadless = typeof values.headless === 'boolean' ? values.headless : undefined;\n  const envHeadless = env.HEADLESS === 'true' ? true : env.HEADLESS === 'false' ? false : undefined;\n  const headless = cliHeadless ?? envHeadless ?? false;\n\n  // Parse redirect-uri (CLI overrides ENV)\n  const cliRedirectUri = typeof values['redirect-uri'] === 'string' ? values['redirect-uri'] : undefined;\n  const envRedirectUri = env.REDIRECT_URI;\n  const redirectUri = cliRedirectUri ?? envRedirectUri;\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    clientId,\n    tenantId,\n    ...(clientSecret && { clientSecret }),\n    auth,\n    headless,\n    ...(redirectUri && { redirectUri }),\n  };\n}\n\n/**\n * Build production configuration from process globals.\n * Entry point for production server.\n */\nexport function createConfig(): OAuthConfig {\n  return parseConfig(process.argv, process.env);\n}\n\n/**\n * Parse DCR configuration from CLI arguments and environment variables.\n *\n * CLI Arguments:\n * - --dcr-mode: DCR mode ('self-hosted' | 'external')\n *   - Default: 'self-hosted' (if flag is omitted)\n * - --dcr-verify-url: External verification endpoint URL (required for external mode)\n * - --dcr-store-uri: DCR client storage URI (required for self-hosted mode)\n * - --tenant-id: Override Microsoft tenant ID\n *\n * Required environment variables:\n * - MS_CLIENT_ID: Azure AD application (client) ID\n * - MS_TENANT_ID: Azure AD tenant ID ('common', 'organizations', 'consumers', or tenant GUID)\n *\n * Optional environment variables:\n * - MS_CLIENT_SECRET: Azure AD client secret (optional for public clients)\n * - DCR_MODE: DCR mode (same format as --dcr-mode flag)\n * - DCR_VERIFY_URL: External verification URL (same as --dcr-verify-url flag)\n * - DCR_STORE_URI: DCR storage URI (same as --dcr-store-uri flag)\n *\n * @param args - CLI arguments array (typically process.argv)\n * @param env - Environment variables object (typically process.env)\n * @param scope - OAuth scopes to request (space-separated)\n * @returns Parsed DCR configuration\n * @throws Error if required environment variables are missing or validation fails\n *\n * @example Self-hosted mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=self-hosted', '--dcr-store-uri=file:///path/to/store.json'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n *\n * @example External mode\n * ```typescript\n * const config = parseDcrConfig(\n *   ['--dcr-mode=external', '--dcr-verify-url=https://auth0.example.com/verify'],\n *   process.env,\n *   'https://graph.microsoft.com/.default'\n * );\n * ```\n */\nexport function parseDcrConfig(args: string[], env: Record<string, string | undefined>, scope: string): DcrConfig {\n  function requiredEnv(key: string): string {\n    const value = env[key];\n    if (!value) {\n      throw new Error(`Environment variable ${key} is required for DCR configuration`);\n    }\n    return value;\n  }\n\n  // Parse CLI arguments\n  const { values } = parseArgs({\n    args,\n    options: {\n      'dcr-mode': { type: 'string' },\n      'dcr-verify-url': { type: 'string' },\n      'dcr-store-uri': { type: 'string' },\n      'tenant-id': { type: 'string' },\n    },\n    strict: false, // Allow other arguments\n    allowPositionals: true,\n  });\n\n  // Parse DCR mode (CLI overrides environment)\n  const cliMode = typeof values['dcr-mode'] === 'string' ? values['dcr-mode'] : undefined;\n  const envMode = env.DCR_MODE;\n  const mode = cliMode || envMode || 'self-hosted';\n\n  // Validate DCR mode\n  if (mode !== 'self-hosted' && mode !== 'external') {\n    throw new Error(`Invalid --dcr-mode value: \"${mode}\". Valid values: self-hosted, external`);\n  }\n\n  // Parse verify URL (CLI overrides environment)\n  const cliVerifyUrl = typeof values['dcr-verify-url'] === 'string' ? values['dcr-verify-url'] : undefined;\n  const envVerifyUrl = env.DCR_VERIFY_URL;\n  const verifyUrl = cliVerifyUrl || envVerifyUrl;\n\n  // Parse store URI (CLI overrides environment)\n  const cliStoreUri = typeof values['dcr-store-uri'] === 'string' ? values['dcr-store-uri'] : undefined;\n  const envStoreUri = env.DCR_STORE_URI;\n  const storeUri = cliStoreUri || envStoreUri;\n\n  // Validate mode-specific required fields\n  if (mode === 'external' && !verifyUrl) {\n    throw new Error('DCR external mode requires --dcr-verify-url or DCR_VERIFY_URL environment variable');\n  }\n\n  // Parse tenant-id (CLI overrides environment)\n  const cliTenantId = typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined;\n  const tenantId = cliTenantId ?? requiredEnv('MS_TENANT_ID');\n\n  // Parse credentials\n  const clientId = requiredEnv('MS_CLIENT_ID');\n  const clientSecret = env.MS_CLIENT_SECRET;\n\n  return {\n    mode,\n    ...(verifyUrl && { verifyUrl }),\n    ...(storeUri && { storeUri }),\n    clientId,\n    ...(clientSecret && { clientSecret }),\n    tenantId,\n    scope,\n  };\n}\n"],"names":["parseArgs","parseAuthMode","value","Error","auth","parseConfig","args","env","transport","cliHeadless","requiredEnv","key","values","options","type","headless","strict","allowPositionals","authArg","undefined","envAuthMode","AUTH_MODE","mode","parsed","envHeadless","HEADLESS","cliRedirectUri","envRedirectUri","REDIRECT_URI","redirectUri","cliTenantId","tenantId","clientId","clientSecret","MS_CLIENT_SECRET","createConfig","process","argv","parseDcrConfig","scope","cliMode","envMode","DCR_MODE","cliVerifyUrl","envVerifyUrl","DCR_VERIFY_URL","verifyUrl","cliStoreUri","envStoreUri","DCR_STORE_URI","storeUri"],"mappings":"AAAA;;;;;;CAMC,GAED,SAASA,SAAS,QAAQ,OAAO;AAWjC;;;;;;;;;;;;;CAaC,GACD,SAASC,cAAcC,KAAa;IAGlC,qBAAqB;IACrB,IAAIA,UAAU,oBAAoBA,UAAU,iBAAiBA,UAAU,OAAO;QAC5E,MAAM,IAAIC,MAAM,CAAC,uBAAuB,EAAED,MAAM,iDAAiD,CAAC;IACpG;IAEA,OAAO;QACLE,MAAMF;IACR;AACF;AAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDC,GACD,OAAO,SAASG,YAAYC,IAAc,EAAEC,GAAuC,EAAEC,SAAyB;QA6C3FC;IA5CjB,SAASC,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,gCAAgC,CAAC;QAC/E;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACPT,MAAM;gBAAEU,MAAM;YAAS;YACvBC,UAAU;gBAAED,MAAM;YAAU;YAC5B,gBAAgB;gBAAEA,MAAM;YAAS;YACjC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,mBAAmB;IACnB,MAAMC,UAAU,OAAON,OAAOR,IAAI,KAAK,WAAWQ,OAAOR,IAAI,GAAGe;IAChE,MAAMC,cAAcb,IAAIc,SAAS;IACjC,MAAMC,OAAOJ,WAAWE;IAExB,IAAIhB;IAEJ,IAAIkB,MAAM;QACR,MAAMC,SAAStB,cAAcqB;QAC7BlB,OAAOmB,OAAOnB,IAAI;IACpB,OAAO;QACL,iDAAiD;QACjDA,OAAO;IACT;IAEA,+CAA+C;IAC/C,IAAIA,SAAS,SAASI,cAAc,SAAS;QAC3C,MAAM,IAAIL,MAAM;IAClB;IAEA,sBAAsB;IACtB,MAAMM,cAAc,OAAOG,OAAOG,QAAQ,KAAK,YAAYH,OAAOG,QAAQ,GAAGI;IAC7E,MAAMK,cAAcjB,IAAIkB,QAAQ,KAAK,SAAS,OAAOlB,IAAIkB,QAAQ,KAAK,UAAU,QAAQN;IACxF,MAAMJ,YAAWN,OAAAA,wBAAAA,yBAAAA,cAAee,yBAAff,kBAAAA,OAA8B;IAE/C,yCAAyC;IACzC,MAAMiB,iBAAiB,OAAOd,MAAM,CAAC,eAAe,KAAK,WAAWA,MAAM,CAAC,eAAe,GAAGO;IAC7F,MAAMQ,iBAAiBpB,IAAIqB,YAAY;IACvC,MAAMC,cAAcH,2BAAAA,4BAAAA,iBAAkBC;IAEtC,8CAA8C;IAC9C,MAAMG,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLF;QACAD;QACA,GAAIE,gBAAgB;YAAEA;QAAa,CAAC;QACpC7B;QACAW;QACA,GAAIc,eAAe;YAAEA;QAAY,CAAC;IACpC;AACF;AAEA;;;CAGC,GACD,OAAO,SAASM;IACd,OAAO9B,YAAY+B,QAAQC,IAAI,EAAED,QAAQ7B,GAAG;AAC9C;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CC,GACD,OAAO,SAAS+B,eAAehC,IAAc,EAAEC,GAAuC,EAAEgC,KAAa;IACnG,SAAS7B,YAAYC,GAAW;QAC9B,MAAMT,QAAQK,GAAG,CAACI,IAAI;QACtB,IAAI,CAACT,OAAO;YACV,MAAM,IAAIC,MAAM,CAAC,qBAAqB,EAAEQ,IAAI,kCAAkC,CAAC;QACjF;QACA,OAAOT;IACT;IAEA,sBAAsB;IACtB,MAAM,EAAEU,MAAM,EAAE,GAAGZ,UAAU;QAC3BM;QACAO,SAAS;YACP,YAAY;gBAAEC,MAAM;YAAS;YAC7B,kBAAkB;gBAAEA,MAAM;YAAS;YACnC,iBAAiB;gBAAEA,MAAM;YAAS;YAClC,aAAa;gBAAEA,MAAM;YAAS;QAChC;QACAE,QAAQ;QACRC,kBAAkB;IACpB;IAEA,6CAA6C;IAC7C,MAAMuB,UAAU,OAAO5B,MAAM,CAAC,WAAW,KAAK,WAAWA,MAAM,CAAC,WAAW,GAAGO;IAC9E,MAAMsB,UAAUlC,IAAImC,QAAQ;IAC5B,MAAMpB,OAAOkB,WAAWC,WAAW;IAEnC,oBAAoB;IACpB,IAAInB,SAAS,iBAAiBA,SAAS,YAAY;QACjD,MAAM,IAAInB,MAAM,CAAC,2BAA2B,EAAEmB,KAAK,sCAAsC,CAAC;IAC5F;IAEA,+CAA+C;IAC/C,MAAMqB,eAAe,OAAO/B,MAAM,CAAC,iBAAiB,KAAK,WAAWA,MAAM,CAAC,iBAAiB,GAAGO;IAC/F,MAAMyB,eAAerC,IAAIsC,cAAc;IACvC,MAAMC,YAAYH,gBAAgBC;IAElC,8CAA8C;IAC9C,MAAMG,cAAc,OAAOnC,MAAM,CAAC,gBAAgB,KAAK,WAAWA,MAAM,CAAC,gBAAgB,GAAGO;IAC5F,MAAM6B,cAAczC,IAAI0C,aAAa;IACrC,MAAMC,WAAWH,eAAeC;IAEhC,yCAAyC;IACzC,IAAI1B,SAAS,cAAc,CAACwB,WAAW;QACrC,MAAM,IAAI3C,MAAM;IAClB;IAEA,8CAA8C;IAC9C,MAAM2B,cAAc,OAAOlB,MAAM,CAAC,YAAY,KAAK,WAAWA,MAAM,CAAC,YAAY,GAAGO;IACpF,MAAMY,WAAWD,wBAAAA,yBAAAA,cAAepB,YAAY;IAE5C,oBAAoB;IACpB,MAAMsB,WAAWtB,YAAY;IAC7B,MAAMuB,eAAe1B,IAAI2B,gBAAgB;IAEzC,OAAO;QACLZ;QACA,GAAIwB,aAAa;YAAEA;QAAU,CAAC;QAC9B,GAAII,YAAY;YAAEA;QAAS,CAAC;QAC5BlB;QACA,GAAIC,gBAAgB;YAAEA;QAAa,CAAC;QACpCF;QACAQ;IACF;AACF"}