@microsoft/teamsfx-core 3.1.0 → 3.1.1

package/build/component/generator/declarativeAgent/helper.js

@@ -1,7 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveMCPServerNameFromUrl = deriveMCPServerNameFromUrl;
+exports.deriveMCPRegistrationIdFromUrl = deriveMCPRegistrationIdFromUrl;
+exports.deriveMCPNamespaceFromUrl = deriveMCPNamespaceFromUrl;
+exports.createNewActionPluginManifest = createNewActionPluginManifest;
 exports.addExistingPlugin = addExistingPlugin;
 exports.validateSourcePluginManifest = validateSourcePluginManifest;
+exports.setGeneralSensitivityLabel = setGeneralSensitivityLabel;
+exports.createGraphClientWithToken = createGraphClientWithToken;
+exports.getSharePointSiteByRelativePath = getSharePointSiteByRelativePath;
+exports.encodeSharePointUrl = encodeSharePointUrl;
+exports.getDriveItemInfo = getDriveItemInfo;
 exports.getODSPItemInfo = getODSPItemInfo;
 exports.getGraphConnectors = getGraphConnectors;
 exports.generateForMCPForDA = generateForMCPForDA;
@@ -9,24 +18,114 @@ const tslib_1 = require("tslib");
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 const teamsfx_api_1 = require("@microsoft/teamsfx-api");
-const CopilotGptManifestUtils_1 = require("../../driver/teamsApp/utils/CopilotGptManifestUtils");
-const PluginManifestUtils_1 = require("../../driver/teamsApp/utils/PluginManifestUtils");
-const path_1 = tslib_1.__importDefault(require("path"));
+const axios_1 = tslib_1.__importStar(require("axios"));
 const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
-const utils_1 = require("../../driver/teamsApp/utils/utils");
+const path_1 = tslib_1.__importDefault(require("path"));
+const constants_1 = require("../../../common/constants");
+const featureFlags_1 = require("../../../common/featureFlags");
+const globalVars_1 = require("../../../common/globalVars");
 const localizeUtils_1 = require("../../../common/localizeUtils");
-const common_1 = require("../../utils/common");
 const telemetry_1 = require("../../../common/telemetry");
 const error_1 = require("../../../error");
-const axios_1 = tslib_1.__importStar(require("axios"));
-const constants_1 = require("../../../common/constants");
-const oneDriveSharePointHandler_1 = require("./oneDriveSharePointHandler");
-const globalVars_1 = require("../../../common/globalVars");
 const questionNames_1 = require("../../../question/questionNames");
+const CopilotGptManifestUtils_1 = require("../../driver/teamsApp/utils/CopilotGptManifestUtils");
+const PluginManifestUtils_1 = require("../../driver/teamsApp/utils/PluginManifestUtils");
+const utils_1 = require("../../driver/teamsApp/utils/utils");
+const common_1 = require("../../utils/common");
+const mcpAuthScaffolder_1 = require("../../utils/mcpAuthScaffolder");
+const mcpToolFetcher = tslib_1.__importStar(require("../../utils/mcpToolFetcher"));
+const pathUtils_1 = require("../../utils/pathUtils");
+const generatorUtils = tslib_1.__importStar(require("../utils"));
+const oneDriveSharePointHandler = tslib_1.__importStar(require("./oneDriveSharePointHandler"));
+// Non-translatable CLI command template used in warning messages
+const mcpAddActionHint = "atk add action --api-plugin-type mcp --mcp-da-server-url <server-url> --mcp-tools-file-path <path-to-tools-json> --interactive false";
 const logMessageKeys = {
     failValidateOneDriveSharePointItem: "core.createProjectQuestion.log.fail.validateOneDriveSharePointItem",
     invalidOneDriveSharePointURL: "core.createProjectQuestion.log.fail.invalidOneDriveSharePointURL",
 };
+/**
+ * Derives a server entry name for an MCP server from its URL. Used by both the
+ * "DA with MCP" scaffolding (to render `.vscode/mcp.json.tpl`) and the
+ * "Add Action with MCP" flow (to append a new entry into `.vscode/mcp.json`).
+ *
+ * Strips non-alphanumeric characters from the host and truncates to 10 chars.
+ * Falls back to `"mcpServer"` when the URL is missing or invalid.
+ */
+function deriveMCPServerNameFromUrl(mcpServerUrl) {
+    const fallback = "mcpServer";
+    if (!mcpServerUrl) {
+        return fallback;
+    }
+    try {
+        const host = new URL(mcpServerUrl).host.replace(/[^a-zA-Z0-9]/g, "").substring(0, 10);
+        return host || fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Derives the env-var name that holds the `oauth/register` configurationId for
+ * the given MCP server URL. Format: `MCP_DA_AUTH_ID_<UPPERCASED>` where
+ * `<UPPERCASED>` is `deriveMCPServerNameFromUrl(url).toUpperCase()`. Reused
+ * across multiple actions that target the same MCP server so they share one
+ * registration. Used by the Dynamic Tool Discovery (DT) DA-with-MCP flow.
+ */
+function deriveMCPRegistrationIdFromUrl(mcpServerUrl) {
+    return `MCP_DA_AUTH_ID_${deriveMCPServerNameFromUrl(mcpServerUrl).toUpperCase()}`;
+}
+/**
+ * Derives the `ai-plugin.json` `namespace` (and the matching `oauth/register`
+ * action `name`) for an MCP-backed action from the MCP server URL. Format:
+ * `deriveMCPServerNameFromUrl(url).toLowerCase()` — a schema-valid
+ * (alphanumeric, lowercase) token unique per MCP server host. Shared by both
+ * the create flow and the add-action flow so actions targeting different MCP
+ * servers get distinct namespaces while actions sharing one server stay aligned
+ * with the single registration they share.
+ */
+function deriveMCPNamespaceFromUrl(mcpServerUrl) {
+    return deriveMCPServerNameFromUrl(mcpServerUrl).toLowerCase();
+}
+/**
+ * Creates a brand-new empty action plugin manifest (`ai-plugin.json`) under the
+ * project's `appPackage` folder and registers it as a new action in the
+ * declarative agent manifest.
+ *
+ * Used by the "Add MCP Action" flow when the user opts to create a new
+ * action manifest rather than reuse an existing one.
+ *
+ * @param projectPath Absolute project root.
+ * @param desiredFileName File name (no path) for the new plugin manifest, e.g. "ai-plugin.json".
+ *                       If a file with this name already exists, an incrementing suffix is added.
+ * @param declarativeAgentManifestPath Absolute path to the declarative agent manifest file
+ *                       (e.g. `appPackage/declarativeAgent.json`).
+ * @returns The absolute path to the newly-created plugin manifest and the action id used to register it.
+ */
+async function createNewActionPluginManifest(projectPath, desiredFileName, declarativeAgentManifestPath) {
+    const appPackageFolder = path_1.default.join(projectPath, teamsfx_api_1.AppPackageFolderName);
+    const fileName = desiredFileName?.trim() || teamsfx_api_1.DefaultPluginManifestFileName;
+    const destinationPluginManifestPath = await CopilotGptManifestUtils_1.copilotGptManifestUtils.getDefaultNextAvailablePluginManifestPath(appPackageFolder, fileName);
+    const projectName = path_1.default.basename(projectPath);
+    const namespace = projectName.toLowerCase().replace(/[^a-z0-9]/g, "") || "actions";
+    const skeleton = {
+        $schema: "https://developer.microsoft.com/json-schemas/copilot/plugin/v2.4/schema.json",
+        schema_version: "v2.4",
+        name_for_human: projectName,
+        description_for_human: projectName,
+        namespace,
+        functions: [],
+        runtimes: [],
+    };
+    await fs_extra_1.default.ensureFile(destinationPluginManifestPath);
+    await fs_extra_1.default.writeJSON(destinationPluginManifestPath, skeleton, { spaces: 4 });
+    const actionId = path_1.default.basename(destinationPluginManifestPath, path_1.default.extname(destinationPluginManifestPath));
+    const relativePluginPath = (0, utils_1.normalizePath)(path_1.default.relative(path_1.default.dirname(declarativeAgentManifestPath), destinationPluginManifestPath), true);
+    const addActionRes = await CopilotGptManifestUtils_1.copilotGptManifestUtils.addAction(declarativeAgentManifestPath, actionId, relativePluginPath);
+    if (addActionRes.isErr()) {
+        return (0, teamsfx_api_1.err)(addActionRes.error);
+    }
+    return (0, teamsfx_api_1.ok)({ pluginManifestPath: destinationPluginManifestPath, actionId });
+}
 const pluginManifestPlaceholderWarning = "add-exsiting-plugin-manifest-placehoder";
 const apiSpecPlaceholderWarning = "add-exsiting-plugin-api-spec-placehoder";
 const readApiSpecErrorTelemetry = "read-api-spec-error";
@@ -120,17 +219,32 @@ function validateSourcePluginManifest(manifest, source) {
     }
     return (0, teamsfx_api_1.ok)(undefined);
 }
+async function setGeneralSensitivityLabel(context, manifestPath) {
+    await generatorUtils.setGeneralSensitivityLabel(context, manifestPath);
+}
+async function createGraphClientWithToken(context) {
+    return oneDriveSharePointHandler.createGraphClientWithToken(context);
+}
+async function getSharePointSiteByRelativePath(graphClient, itemUrl) {
+    return oneDriveSharePointHandler.getSharePointSiteByRelativePath(graphClient, itemUrl);
+}
+function encodeSharePointUrl(itemUrl) {
+    return oneDriveSharePointHandler.encodeSharePointUrl(itemUrl);
+}
+async function getDriveItemInfo(graphClient, encodedUrl) {
+    return oneDriveSharePointHandler.getDriveItemInfo(graphClient, encodedUrl);
+}
 async function getODSPItemInfo(context, itemUrl) {
     if (!itemUrl) {
         return (0, teamsfx_api_1.err)(new teamsfx_api_1.UserError("validateOneDriveSharePointItem", "InvalidInput", "Item URL is required"));
     }
     try {
-        const graphClientResult = await (0, oneDriveSharePointHandler_1.createGraphClientWithToken)(context);
+        const graphClientResult = await oneDriveSharePointHandler.createGraphClientWithToken(context);
         if (graphClientResult.isErr()) {
             return (0, teamsfx_api_1.err)(graphClientResult.error);
         }
         const graphClient = graphClientResult.value;
-        const siteResult = await (0, oneDriveSharePointHandler_1.getSharePointSiteByRelativePath)(graphClient, itemUrl);
+        const siteResult = await oneDriveSharePointHandler.getSharePointSiteByRelativePath(graphClient, itemUrl);
         if (siteResult.isOk()) {
             const site = siteResult.value;
             return (0, teamsfx_api_1.ok)([
@@ -142,8 +256,8 @@ async function getODSPItemInfo(context, itemUrl) {
                 },
             ]);
         }
-        const encodedUrl = (0, oneDriveSharePointHandler_1.encodeSharePointUrl)(itemUrl);
-        const driveItem = await (0, oneDriveSharePointHandler_1.getDriveItemInfo)(graphClient, encodedUrl);
+        const encodedUrl = oneDriveSharePointHandler.encodeSharePointUrl(itemUrl);
+        const driveItem = await oneDriveSharePointHandler.getDriveItemInfo(graphClient, encodedUrl);
         return (0, teamsfx_api_1.ok)([
             {
                 id: driveItem.id,
@@ -202,81 +316,373 @@ async function getGraphConnectors() {
     }
 }
 async function generateForMCPForDA(destinationPath, inputs) {
+    const mcpServerUrl = inputs[questionNames_1.QuestionNames.MCPForDAServerUrl];
+    if (!mcpServerUrl) {
+        return (0, teamsfx_api_1.err)(new teamsfx_api_1.UserError({
+            source: "Scaffold",
+            name: "InputValidationFailed",
+            message: "mcpServerUrl is required when --api-plugin-type is mcp.",
+            displayMessage: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.missingServerUrl"),
+        }));
+    }
     // 1. Get ai-plugin.json
     const aiPluginFilePath = path_1.default.join(destinationPath, teamsfx_api_1.AppPackageFolderName, teamsfx_api_1.DefaultPluginManifestFileName);
     if (!(await fs_extra_1.default.pathExists(aiPluginFilePath))) {
         const error = new teamsfx_api_1.SystemError("MCPForDAPluginManifestNotFound", "PluginManifestNotFound", (0, localizeUtils_1.getDefaultString)("core.MCPForDA.pluginManifestNotFound", aiPluginFilePath), (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.pluginManifestNotFound", aiPluginFilePath));
         return (0, teamsfx_api_1.err)(error);
     }
-    const mcpServerUrl = inputs[questionNames_1.QuestionNames.MCPForDAServerUrl];
+    // Dynamic Tool Discovery flow: skip static tool fetch/selection entirely;
+    // the agent host discovers tools at runtime against the MCP server. Per
+    // SCN-DA-CREATE-WITH-MCP-SERVER this DT runtime shape is gated behind
+    // TEAMSFX_MCP_FOR_DA_DT: when the flag is off the create flow keeps the
+    // legacy static-tools behavior (populated `functions` + `mcp-tools-1.json`),
+    // matching the add-action flow. We also require the auth-type answer so
+    // legacy fixtures that mock inputs without it stay on the static-tools path.
+    if (featureFlags_1.featureFlagManager.getBooleanValue(featureFlags_1.FeatureFlags.MCPForDADT) &&
+        inputs[questionNames_1.QuestionNames.MCPForDAAuthType]) {
+        return generateForMCPForDAWithAuth(destinationPath, aiPluginFilePath, inputs);
+    }
     const serverName = inputs[questionNames_1.QuestionNames.MCPForDAServerName];
-    const mcpTool = inputs[questionNames_1.QuestionNames.MCPForDATool];
+    const warnings = [];
+    // If a tools file is provided (CLI flow), load tools from it
+    const toolsFilePath = inputs[questionNames_1.QuestionNames.MCPToolsFilePath];
+    const existingTools = inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools];
+    if (toolsFilePath && (!existingTools || existingTools.length === 0)) {
+        try {
+            const fileTools = await mcpToolFetcher.readMCPToolsFromFile(toolsFilePath);
+            inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools] = fileTools;
+            if (!inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools]) {
+                inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools] = fileTools.map((t) => t.name);
+            }
+        }
+        catch {
+            warnings.push({
+                type: "mcpToolsFileReadError",
+                content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.toolsFileReadError", toolsFilePath, mcpAddActionHint),
+            });
+        }
+    }
+    // Probe auth if tools were loaded from file but auth not yet detected
+    if (inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools]?.length > 0 &&
+        !inputs[questionNames_1.QuestionNames.MCPForDAAuth] &&
+        mcpServerUrl) {
+        try {
+            const authProbe = await mcpToolFetcher.probeMCPServerAuth(mcpServerUrl);
+            if (authProbe.requiresAuth) {
+                inputs[questionNames_1.QuestionNames.MCPForDAAuth] = "OAuthPluginVault";
+                if (authProbe.authMetadataUrl) {
+                    inputs[questionNames_1.QuestionNames.MCPForDAAuthMetadataUrl] = authProbe.authMetadataUrl;
+                }
+            }
+        }
+        catch {
+            // Auth probe failed — continue without auth
+        }
+    }
+    // Auto-fetch tools from MCP server if no tools loaded yet
+    const currentTools = inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools];
+    if ((!currentTools || currentTools.length === 0) && mcpServerUrl) {
+        try {
+            const result = await mcpToolFetcher.fetchMCPTools(mcpServerUrl);
+            if (!result.requiresAuth && result.tools.length > 0) {
+                inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools] = result.tools;
+                if (!inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools]) {
+                    inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools] = result.tools.map((t) => t.name);
+                }
+            }
+            else if (result.requiresAuth) {
+                // Store auth metadata for later use
+                inputs[questionNames_1.QuestionNames.MCPForDAAuth] = "OAuthPluginVault";
+                if (result.authMetadataUrl) {
+                    inputs[questionNames_1.QuestionNames.MCPForDAAuthMetadataUrl] = result.authMetadataUrl;
+                }
+                warnings.push({
+                    type: "mcpAuthRequired",
+                    content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.authRequired", mcpServerUrl, mcpAddActionHint),
+                });
+            }
+            else {
+                warnings.push({
+                    type: "mcpNoToolsFetched",
+                    content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.noToolsFetched", mcpServerUrl, mcpAddActionHint),
+                });
+            }
+        }
+        catch {
+            warnings.push({
+                type: "mcpFetchError",
+                content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.fetchError", mcpServerUrl, mcpAddActionHint),
+            });
+        }
+    }
     // 2. Read ai-plugin.json
     const aiPluginContent = await fs_extra_1.default.readJSON(aiPluginFilePath);
-    // For dynamic fetch tools, keep the functions empty and add runtime info
-    if (mcpTool === "dynamic-fetch") {
-        aiPluginContent.functions = [];
-        aiPluginContent.runtimes = [
-            {
-                type: "RemoteMCPServer",
-                spec: {
-                    url: mcpServerUrl,
-                    enable_dynamic_discovery: true,
-                },
-            },
-        ];
-    }
-    else {
-        // For pre-fetch tools, add the tool info to ai-plugin.json
-        const mcpToolsDetail = inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools];
-        const mcpToolsSelected = inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools];
+    const mcpToolsDetail = inputs[questionNames_1.QuestionNames.MCPForDAAvailableTools];
+    const mcpToolsSelected = inputs[questionNames_1.QuestionNames.MCPForDAPreFetchTools];
+    if (mcpToolsDetail &&
+        mcpToolsDetail.length > 0 &&
+        mcpToolsSelected &&
+        mcpToolsSelected.length > 0) {
         const mcpAuth = inputs[questionNames_1.QuestionNames.MCPForDAAuth];
-        if (!mcpToolsDetail || !mcpToolsSelected) {
-            const error = new teamsfx_api_1.UserError("MCPForDAPreFetchToolsNotFound", "PreFetchToolsNotFound", (0, localizeUtils_1.getDefaultString)("core.MCPForDA.preFetchToolsNotFound"), (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.preFetchToolsNotFound"));
-            return (0, teamsfx_api_1.err)(error);
+        // Process tools: if serverName exists (VS Code flow), strip the prefix; otherwise use as-is (CLI flow)
+        let processedTools;
+        if (serverName) {
+            processedTools = mcpToolsDetail
+                .filter((tool) => tool.name.includes(serverName))
+                .map((tool) => {
+                const index = tool.name.indexOf(serverName);
+                const newName = tool.name.substring(index + serverName.length + 1);
+                return {
+                    ...tool,
+                    name: newName,
+                };
+            })
+                .filter((tool) => mcpToolsSelected.includes(tool.name));
         }
-        aiPluginContent.functions = mcpToolsDetail
-            .filter((tool) => tool.name.includes(serverName))
-            .map((tool) => {
-            const index = tool.name.indexOf(serverName);
-            const newName = tool.name.substring(index + serverName.length + 1);
-            return {
-                name: newName,
-                description: tool.description,
-                inputSchema: tool.inputSchema,
-                tags: tool.tags,
-            };
-        })
-            .filter((tool) => mcpToolsSelected.includes(tool.name))
-            .map((tool) => {
+        else {
+            processedTools = mcpToolsDetail.filter((tool) => mcpToolsSelected.includes(tool.name));
+        }
+        aiPluginContent.functions = processedTools.map((tool) => {
             return {
                 name: tool.name,
-                description: tool.description,
-                parameters: {
-                    type: tool.inputSchema.type || "object",
-                    properties: tool.inputSchema.properties,
-                    required: tool.inputSchema.required || [],
-                },
+                description: tool.description || "",
             };
         });
+        // Write mcp-tools-1.json with full tool definitions (no field filtering)
+        const mcpToolsFileName = "mcp-tools-1.json";
+        const mcpToolsOutputPath = path_1.default.join(destinationPath, teamsfx_api_1.AppPackageFolderName, mcpToolsFileName);
+        await fs_extra_1.default.writeJSON(mcpToolsOutputPath, { tools: processedTools }, { spaces: 4 });
+        const runtimeSpec = {
+            url: mcpServerUrl,
+            mcp_tool_description: {
+                file: mcpToolsFileName,
+            },
+        };
         aiPluginContent.runtimes = [
             {
                 type: "RemoteMCPServer",
-                spec: {
-                    url: mcpServerUrl,
-                },
+                spec: runtimeSpec,
                 run_for_functions: aiPluginContent.functions.map((func) => func.name),
             },
         ];
+        // Auth handling
         if (mcpAuth === "OAuthPluginVault") {
-            aiPluginContent.runtimes[0].auth = {
-                type: "OAuthPluginVault",
-                reference_id: "${{MCP_DA_AUTH_ID}}",
-            };
+            const authType = inputs[questionNames_1.QuestionNames.MCPForDAAuthType];
+            if (!authType) {
+                return (0, teamsfx_api_1.err)(new teamsfx_api_1.UserError("MCPForDA", "MissingMCPAuthType", (0, localizeUtils_1.getDefaultString)("core.MCPForDA.missingAuthType"), (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.missingAuthType")));
+            }
+            const registrationId = "MCP_DA_AUTH_ID_ACTION_1";
+            const manifestOAuth = (0, mcpAuthScaffolder_1.deriveMCPManifestOAuth)(authType, registrationId);
+            if (manifestOAuth) {
+                aiPluginContent.runtimes[0].auth = manifestOAuth;
+            }
+            // Resolve OAuth metadata and inject oauth/register into m365agents.yml
+            try {
+                const endpoints = await (0, mcpAuthScaffolder_1.resolveMCPAuthEndpoints)(authType, inputs);
+                const ymlPath = pathUtils_1.pathUtils.getYmlFilePath(destinationPath);
+                if (ymlPath) {
+                    const injectResult = await (0, mcpAuthScaffolder_1.injectMCPAuthActionToYml)({
+                        ymlPath,
+                        authType,
+                        authName: aiPluginContent.namespace || "action_1",
+                        registrationId,
+                        mcpServerUrl,
+                        endpoints,
+                    });
+                    if (injectResult.wellKnownUrlPlaceholderUsed) {
+                        warnings.push({
+                            type: "mcpAuthDcrWellKnownUrlPlaceholder",
+                            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthDcrPlaceholderWarning"),
+                        });
+                    }
+                    if (injectResult.oauthUrlPlaceholderUsed) {
+                        warnings.push({
+                            type: "mcpAuthOAuthUrlPlaceholder",
+                            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthOAuthPlaceholderWarning"),
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                warnings.push({
+                    type: "mcpAuthMetadataError",
+                    content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthMetadataMissingError", error.message),
+                });
+            }
         }
     }
+    // If no tools available, leave ai-plugin.json with empty functions/runtimes (template default)
     // 3. Write ai-plugin.json
     await fs_extra_1.default.writeJSON(aiPluginFilePath, aiPluginContent, { spaces: 4 });
-    return (0, teamsfx_api_1.ok)([]); // Return empty warnings
+    return (0, teamsfx_api_1.ok)({ warnings });
+}
+/**
+ * Modern DA-with-MCP scaffolder. Selected by `generateForMCPForDA` only when
+ * TEAMSFX_MCP_FOR_DA_DT is on AND the create flow answered `MCPForDAAuthType`.
+ * When the flag is off, the dispatcher keeps the legacy static-tools path
+ * instead, so this function never runs with the flag off.
+ *
+ * Emits the Dynamic Tool Discovery runtime shape per
+ * SCN-DA-CREATE-WITH-MCP-SERVER: `RemoteMCPServer` with a `spec` that carries
+ * only the MCP server `url` (no `mcp_tool_description`) and
+ * `run_for_functions: ["*"]`. Per the v2.4 plugin schema, omitting
+ * `mcp_tool_description` is what makes the host use dynamic tool discovery — no
+ * `mcp-tools-N.json` is written and `functions` stays an empty array
+ * (schema-required field; tools are discovered at runtime rather than declared
+ * statically). This DT shape is gated behind TEAMSFX_MCP_FOR_DA_DT via the
+ * dispatcher; with the flag off the create flow produces the legacy static
+ * shape instead.
+ *
+ * OAuth credentials reach the provisioned `oauth/register` action as
+ * `${{MCP_DA_OAUTH_*_<SUFFIX>}}` refs in m365agents.yml, persisted to
+ * env/.env.<env>(.user). (The in-process `process.env` bridge below is a
+ * defensive fallback for the flag-off path, which the dispatcher no longer
+ * routes here.)
+ */
+async function generateForMCPForDAWithAuth(destinationPath, aiPluginFilePath, inputs) {
+    const mcpServerUrl = inputs[questionNames_1.QuestionNames.MCPForDAServerUrl];
+    const warnings = [];
+    const aiPluginContent = await fs_extra_1.default.readJSON(aiPluginFilePath);
+    aiPluginContent.functions = [];
+    // Namespace the action by the MCP server host (shared rule with the
+    // add-action flow) instead of the project name, so actions targeting
+    // different MCP servers get distinct namespaces and the matching
+    // oauth/register `name` derives from the same source.
+    if (mcpServerUrl) {
+        aiPluginContent.namespace = deriveMCPNamespaceFromUrl(mcpServerUrl);
+    }
+    const runtime = {
+        type: "RemoteMCPServer",
+        spec: { url: mcpServerUrl },
+        run_for_functions: ["*"],
+    };
+    if (mcpServerUrl) {
+        const authType = inputs[questionNames_1.QuestionNames.MCPForDAAuthType];
+        if (authType === "none") {
+            runtime.auth = { type: "None" };
+        }
+        else if (authType) {
+            const serverName = deriveMCPServerNameFromUrl(mcpServerUrl).toUpperCase();
+            const registrationId = deriveMCPRegistrationIdFromUrl(mcpServerUrl);
+            const manifestOAuth = (0, mcpAuthScaffolder_1.deriveMCPManifestOAuth)(authType, registrationId);
+            if (manifestOAuth) {
+                runtime.auth = manifestOAuth;
+            }
+            // Probe the MCP server for resource_metadata so `resolveMCPAuthEndpoints`
+            // can discover authorization/token URLs. The legacy `generateForMCPForDA`
+            // branch populates `MCPForDAAuthMetadataUrl` via fetchMCPTools; the DT
+            // branch skips tool fetch, so we need an explicit probe here. Best-effort.
+            if (!inputs[questionNames_1.QuestionNames.MCPForDAAuthMetadataUrl]) {
+                try {
+                    const authProbe = await mcpToolFetcher.probeMCPServerAuth(mcpServerUrl);
+                    if (authProbe.authMetadataUrl) {
+                        inputs[questionNames_1.QuestionNames.MCPForDAAuthMetadataUrl] = authProbe.authMetadataUrl;
+                    }
+                    // This branch never fetches tools, so a mistyped server URL would otherwise leave no
+                    // trace at all: endpoint discovery falls back to the host and happily returns its
+                    // authorization server, and the scaffold looks complete. Warns on every `notEndpoint`
+                    // shape, not just 404 — this is advisory, so it can be broader than the blocking rule
+                    // applied when the URL is first entered.
+                    if (authProbe.endpointStatus === "notEndpoint") {
+                        warnings.push({
+                            type: "mcpServerUrlNotAnEndpoint",
+                            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpServerUrlNotAnEndpoint", mcpServerUrl, String(authProbe.responseStatus)),
+                        });
+                    }
+                }
+                catch {
+                    // Probe failed — continue; endpoint resolution below will best-effort
+                    // and yml injection will still run with undefined endpoints.
+                }
+            }
+            // Endpoint resolution is best-effort: a failure (server unreachable, no
+            // well-known metadata, etc.) must not block credential persistence or
+            // yml injection. The OAuth action injector tolerates undefined endpoint
+            // URLs; the developer can fill them in later.
+            let endpoints = {};
+            try {
+                endpoints = await (0, mcpAuthScaffolder_1.resolveMCPAuthEndpoints)(authType, inputs);
+            }
+            catch (error) {
+                warnings.push({
+                    type: "mcpAuthMetadataError",
+                    content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthMetadataMissingError", error.message),
+                });
+            }
+            const dtOn = featureFlags_1.featureFlagManager.getBooleanValue(featureFlags_1.FeatureFlags.MCPForDADT);
+            try {
+                const ymlPath = pathUtils_1.pathUtils.getYmlFilePath(destinationPath);
+                if (ymlPath) {
+                    const injectResult = await (0, mcpAuthScaffolder_1.injectMCPAuthActionToYml)({
+                        ymlPath,
+                        authType,
+                        authName: aiPluginContent.namespace || "action_1",
+                        registrationId,
+                        mcpServerUrl,
+                        endpoints,
+                        persistCredentialEnvRefs: dtOn,
+                        serverName,
+                        scopes: inputs[questionNames_1.QuestionNames.MCPForDAScopes],
+                    });
+                    if (injectResult.wellKnownUrlPlaceholderUsed) {
+                        warnings.push({
+                            type: "mcpAuthDcrWellKnownUrlPlaceholder",
+                            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthDcrPlaceholderWarning"),
+                        });
+                    }
+                    if (injectResult.oauthUrlPlaceholderUsed) {
+                        warnings.push({
+                            type: "mcpAuthOAuthUrlPlaceholder",
+                            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthOAuthPlaceholderWarning"),
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                warnings.push({
+                    type: "mcpAuthYmlInjectionError",
+                    content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthMetadataMissingError", error.message),
+                });
+            }
+            if (dtOn) {
+                try {
+                    await (0, mcpAuthScaffolder_1.persistMCPAuthCredentialEnvVars)({
+                        projectPath: destinationPath,
+                        authType,
+                        serverName,
+                        clientId: inputs[questionNames_1.QuestionNames.MCPForDAClientId],
+                        clientSecret: inputs[questionNames_1.QuestionNames.MCPForDAClientSecret],
+                        scopes: inputs[questionNames_1.QuestionNames.MCPForDAScopes],
+                    });
+                }
+                catch (error) {
+                    warnings.push({
+                        type: "mcpAuthEnvPersistError",
+                        content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthMetadataMissingError", error.message),
+                    });
+                }
+            }
+            else {
+                // Populate the in-process bridge consumed by oauth/create.ts so
+                // provision picks up create-time answers without re-prompting via
+                // QuestionMW. Only static OAuth and Entra SSO contribute creds.
+                const clientId = inputs[questionNames_1.QuestionNames.MCPForDAClientId];
+                const clientSecret = inputs[questionNames_1.QuestionNames.MCPForDAClientSecret];
+                const scopes = inputs[questionNames_1.QuestionNames.MCPForDAScopes];
+                if (clientId) {
+                    process.env[questionNames_1.QuestionNames.OauthClientId] = clientId;
+                }
+                if (clientSecret) {
+                    process.env[questionNames_1.QuestionNames.OauthClientSecret] = clientSecret;
+                }
+                if (scopes) {
+                    process.env[questionNames_1.QuestionNames.OAuthScope] = scopes;
+                }
+            }
+        }
+    }
+    aiPluginContent.runtimes = [runtime];
+    await fs_extra_1.default.writeJSON(aiPluginFilePath, aiPluginContent, { spaces: 4 });
+    return (0, teamsfx_api_1.ok)({ warnings });
 }
 //# sourceMappingURL=helper.js.map