@microsoft/teamsfx-core 3.1.0 → 3.1.1

package/build/v4/inspection/scaffoldMetadataSource.js

@@ -0,0 +1,78 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.metadataArchiveSource = metadataArchiveSource;
+exports.authoredDirectoryMetadataSource = authoredDirectoryMetadataSource;
+const tslib_1 = require("tslib");
+const teamsfx_api_1 = require("@microsoft/teamsfx-api");
+const adm_zip_1 = tslib_1.__importDefault(require("adm-zip"));
+const fs = tslib_1.__importStar(require("fs-extra"));
+const neverthrow_1 = require("neverthrow");
+const path = tslib_1.__importStar(require("path"));
+const localizeUtils_1 = require("../../common/localizeUtils");
+const SOURCE = "Scaffold";
+const PACKAGE_METADATA_FILES = new Set(["descriptor.json", "questions.json", "pipeline.json"]);
+function metadataSourceError(error) {
+    const options = {
+        source: SOURCE,
+        name: "ScaffoldMetadataSourceReadFailed",
+        message: (0, localizeUtils_1.getLocalizedString)("core.v4.scaffoldMetadataSourceReadFailed"),
+    };
+    return error instanceof Error ? new teamsfx_api_1.SystemError({ ...options, error }) : new teamsfx_api_1.SystemError(options);
+}
+function isMetadataFile(relativePath) {
+    const segments = relativePath.split("/");
+    if (segments.length === 3 && segments[0] === "_shared" && segments[1] === "questions") {
+        return segments[2].endsWith(".json");
+    }
+    if (segments[0] !== "create" && segments[0] !== "modify") {
+        return false;
+    }
+    if (segments.length === 2 && segments[1] === "selector.json") {
+        return true;
+    }
+    return segments.length > 2 && PACKAGE_METADATA_FILES.has(segments[segments.length - 1]);
+}
+function collectMetadataFiles(directory, relativeDirectory, files) {
+    const entries = fs
+        .readdirSync(directory, { withFileTypes: true })
+        .sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
+    for (const entry of entries) {
+        const relativePath = path.posix.join(relativeDirectory, entry.name);
+        if (entry.isDirectory()) {
+            if (entry.name !== "content" &&
+                !(relativeDirectory.length === 0 && entry.name === "schema")) {
+                collectMetadataFiles(path.join(directory, entry.name), relativePath, files);
+            }
+        }
+        else if (entry.isFile() && isMetadataFile(relativePath)) {
+            files.push(relativePath);
+        }
+    }
+}
+/** Adapt immutable staged metadata archive bytes to the catalog source port. */
+function metadataArchiveSource(bytes) {
+    return { load: () => (0, neverthrow_1.ok)(bytes) };
+}
+/** Adapt the authored `templates/v4` directory to a metadata-only in-memory archive. */
+function authoredDirectoryMetadataSource(root) {
+    return {
+        load: () => {
+            try {
+                const resolvedRoot = path.resolve(root);
+                const files = [];
+                collectMetadataFiles(resolvedRoot, "", files);
+                const zip = new adm_zip_1.default();
+                for (const file of files) {
+                    zip.addFile(`v4/${file}`, fs.readFileSync(path.join(resolvedRoot, file)));
+                }
+                return (0, neverthrow_1.ok)(zip.toBuffer());
+            }
+            catch (error) {
+                return (0, neverthrow_1.err)(metadataSourceError(error));
+            }
+        },
+    };
+}
+//# sourceMappingURL=scaffoldMetadataSource.js.map

package/build/v4/inspection/scaffoldMetadataSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffoldMetadataSource.js","sourceRoot":"","sources":["../../../src/v4/inspection/scaffoldMetadataSource.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;AAwDlC,sDAEC;AAGD,0EAiBC;;AA5ED,wDAA8D;AAC9D,8DAA6B;AAC7B,qDAA+B;AAC/B,2CAA6C;AAC7C,mDAA6B;AAC7B,8DAAgE;AAGhE,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC,CAAC;AAE/F,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,IAAA,kCAAkB,EAAC,0CAA0C,CAAC;KACxE,CAAC;IACF,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,IAAI,yBAAW,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,yBAAW,CAAC,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,cAAc,CAAC,YAAoB;IAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;QACtF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,iBAAyB,EAAE,KAAe;IACzF,MAAM,OAAO,GAAG,EAAE;SACf,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC/C,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAC5D,CAAC;gBACD,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAgB,qBAAqB,CAAC,KAAa;IACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,eAAE,EAAC,KAAK,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,wFAAwF;AACxF,SAAgB,+BAA+B,CAAC,IAAY;IAC1D,OAAO;QACL,IAAI,EAAE,GAA4B,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,iBAAM,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,IAAA,eAAE,EAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAA,gBAAG,EAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/build/v4/mcp/mcpAuthAction.d.ts

@@ -0,0 +1,36 @@
+import { FxError } from "@microsoft/teamsfx-api";
+import { Result } from "neverthrow";
+export declare const MCP_DCR_WELL_KNOWN_URL_PLACEHOLDER = "<PLEASE_FILL_IN_WELL_KNOWN_AUTHORIZATION_SERVER_URL>";
+/**
+ * Placeholders for a static `oauth` action whose authorization / token URLs could not be
+ * discovered. `identityProvider: Custom` is unusable without both, and omitting the fields
+ * hides the gap; the placeholders make it visible and editable.
+ */
+export declare const MCP_OAUTH_AUTHORIZATION_URL_PLACEHOLDER = "<PLEASE_FILL_IN_AUTHORIZATION_URL>";
+export declare const MCP_OAUTH_TOKEN_URL_PLACEHOLDER = "<PLEASE_FILL_IN_TOKEN_URL>";
+export interface ResolvedMCPAuthEndpoints {
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    refreshUrl?: string;
+    wellKnownUrl?: string;
+}
+export interface MCPAuthActionArgs {
+    authType: string;
+    authName: string;
+    registrationId: string;
+    mcpServerUrl: string;
+    endpoints: ResolvedMCPAuthEndpoints;
+    credentialEnvNames?: {
+        clientId: string;
+        clientSecret?: string;
+        scope?: string;
+    };
+}
+export interface MCPAuthActionResult {
+    yaml: string;
+    wellKnownUrlPlaceholderUsed: boolean;
+    oauthUrlPlaceholderUsed: boolean;
+}
+/** Add an MCP auth provision action while preserving the surrounding YAML document. */
+export declare function injectMcpAuthActionYaml(yaml: string, args: MCPAuthActionArgs): Result<MCPAuthActionResult, FxError>;
+//# sourceMappingURL=mcpAuthAction.d.ts.map

package/build/v4/mcp/mcpAuthAction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuthAction.d.ts","sourceRoot":"","sources":["../../../src/v4/mcp/mcpAuthAction.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAe,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAW,MAAM,YAAY,CAAC;AAO7C,eAAO,MAAM,kCAAkC,yDACS,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,uCAAuC,CAAC;AAC5F,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAE5E,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,wBAAwB,CAAC;IACpC,kBAAkB,CAAC,EAAE;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B,EAAE,OAAO,CAAC;IACrC,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAwHD,uFAAuF;AACvF,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,iBAAiB,GACtB,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,CA6DtC"}

package/build/v4/mcp/mcpAuthAction.js

@@ -0,0 +1,177 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_OAUTH_TOKEN_URL_PLACEHOLDER = exports.MCP_OAUTH_AUTHORIZATION_URL_PLACEHOLDER = exports.MCP_DCR_WELL_KNOWN_URL_PLACEHOLDER = void 0;
+exports.injectMcpAuthActionYaml = injectMcpAuthActionYaml;
+const teamsfx_api_1 = require("@microsoft/teamsfx-api");
+const neverthrow_1 = require("neverthrow");
+const yaml_1 = require("yaml");
+const SOURCE = "Scaffold";
+const MIN_DCR_YAML_VERSION = "v1.13";
+const SUPPORTED_AUTH_TYPES = new Set(["none", "oauth", "entra-sso", "oauth-dynamic"]);
+exports.MCP_DCR_WELL_KNOWN_URL_PLACEHOLDER = "<PLEASE_FILL_IN_WELL_KNOWN_AUTHORIZATION_SERVER_URL>";
+/**
+ * Placeholders for a static `oauth` action whose authorization / token URLs could not be
+ * discovered. `identityProvider: Custom` is unusable without both, and omitting the fields
+ * hides the gap; the placeholders make it visible and editable.
+ */
+exports.MCP_OAUTH_AUTHORIZATION_URL_PLACEHOLDER = "<PLEASE_FILL_IN_AUTHORIZATION_URL>";
+exports.MCP_OAUTH_TOKEN_URL_PLACEHOLDER = "<PLEASE_FILL_IN_TOKEN_URL>";
+function failure(message) {
+    return (0, neverthrow_1.err)(new teamsfx_api_1.SystemError({ source: SOURCE, name: "McpAuthInjectFailed", message }));
+}
+function registrationId(item) {
+    if (!(0, yaml_1.isMap)(item)) {
+        return undefined;
+    }
+    const output = item.get("writeToEnvironmentFile", true);
+    if (!(0, yaml_1.isMap)(output)) {
+        return undefined;
+    }
+    const value = output.get("configurationId");
+    return typeof value === "string" ? value : undefined;
+}
+function uses(item) {
+    if (!(0, yaml_1.isMap)(item)) {
+        return undefined;
+    }
+    const value = item.get("uses");
+    return typeof value === "string" ? value : undefined;
+}
+function teamsAppId(item) {
+    if (uses(item) !== "teamsApp/create" || !(0, yaml_1.isMap)(item)) {
+        return undefined;
+    }
+    const output = item.get("writeToEnvironmentFile", true);
+    if (!(0, yaml_1.isMap)(output)) {
+        return undefined;
+    }
+    const value = output.get("teamsAppId");
+    return typeof value === "string" ? value : undefined;
+}
+function ensureMinimumVersion(current, minimum) {
+    if (typeof current !== "string") {
+        return undefined;
+    }
+    const parse = (version) => {
+        const match = /^v?(\d+(?:\.\d+){1,2})$/.exec(version);
+        return match?.[1].split(".").map((part) => Number.parseInt(part, 10));
+    };
+    const currentParts = parse(current);
+    const minimumParts = parse(minimum);
+    if (!currentParts || !minimumParts) {
+        return undefined;
+    }
+    const width = Math.max(currentParts.length, minimumParts.length);
+    for (let index = 0; index < width; index++) {
+        const currentPart = currentParts[index] ?? 0;
+        const minimumPart = minimumParts[index] ?? 0;
+        if (currentPart > minimumPart) {
+            return undefined;
+        }
+        if (currentPart < minimumPart) {
+            return minimum;
+        }
+    }
+    return undefined;
+}
+function oauthAction(args, appIdEnvName) {
+    const endpointFields = {};
+    if (args.authType === "oauth") {
+        endpointFields.authorizationUrl =
+            args.endpoints.authorizationUrl ?? exports.MCP_OAUTH_AUTHORIZATION_URL_PLACEHOLDER;
+        endpointFields.tokenUrl = args.endpoints.tokenUrl ?? exports.MCP_OAUTH_TOKEN_URL_PLACEHOLDER;
+        if (args.endpoints.refreshUrl) {
+            endpointFields.refreshUrl = args.endpoints.refreshUrl;
+        }
+    }
+    return {
+        uses: "oauth/register",
+        with: {
+            name: args.authName,
+            appId: `\${{${appIdEnvName}}}`,
+            flow: "authorizationCode",
+            ...(args.authType === "oauth"
+                ? { ...endpointFields, identityProvider: "Custom" }
+                : { identityProvider: "MicrosoftEntra" }),
+            baseUrl: args.mcpServerUrl,
+            ...(args.credentialEnvNames
+                ? {
+                    clientId: `\${{${args.credentialEnvNames.clientId}}}`,
+                    ...(args.credentialEnvNames.clientSecret
+                        ? { clientSecret: `\${{${args.credentialEnvNames.clientSecret}}}` }
+                        : {}),
+                    ...(args.credentialEnvNames.scope
+                        ? { scope: `\${{${args.credentialEnvNames.scope}}}` }
+                        : {}),
+                }
+                : {}),
+        },
+        writeToEnvironmentFile: { configurationId: args.registrationId },
+    };
+}
+function dcrAction(args, appIdEnvName, wellKnownUrl) {
+    return {
+        uses: "dcr/register",
+        with: {
+            name: args.authName,
+            appId: `\${{${appIdEnvName}}}`,
+            applicableToApps: "AnyApp",
+            targetAudience: "HomeTenant",
+            wellKnownAuthorizationServer: wellKnownUrl,
+            targetUrlsShouldStartWith: [args.mcpServerUrl],
+        },
+        writeToEnvironmentFile: { configurationId: args.registrationId },
+    };
+}
+/** Add an MCP auth provision action while preserving the surrounding YAML document. */
+function injectMcpAuthActionYaml(yaml, args) {
+    if (!SUPPORTED_AUTH_TYPES.has(args.authType)) {
+        return failure(`Unsupported MCP auth type '${args.authType}'.`);
+    }
+    if (args.authType === "none") {
+        return (0, neverthrow_1.ok)({ yaml, wellKnownUrlPlaceholderUsed: false, oauthUrlPlaceholderUsed: false });
+    }
+    const document = (0, yaml_1.parseDocument)(yaml);
+    if (document.errors.length > 0) {
+        return failure("The rendered m365agents.yml is not valid YAML.");
+    }
+    const provision = document.get("provision", true);
+    if (!(0, yaml_1.isSeq)(provision)) {
+        return failure("The rendered m365agents.yml does not declare a provision sequence.");
+    }
+    const actionUses = args.authType === "oauth-dynamic" ? "dcr/register" : "oauth/register";
+    const alreadyRegistered = provision.items.some((item) => uses(item) === actionUses && registrationId(item) === args.registrationId);
+    if (alreadyRegistered) {
+        return (0, neverthrow_1.ok)({
+            yaml: document.toString(),
+            wellKnownUrlPlaceholderUsed: false,
+            oauthUrlPlaceholderUsed: false,
+        });
+    }
+    provision.items = provision.items.filter((item) => uses(item) !== undefined);
+    const teamsAppIndex = provision.items.findIndex((item) => uses(item) === "teamsApp/create");
+    const appIdEnvName = teamsAppIndex >= 0 ? teamsAppId(provision.items[teamsAppIndex]) : undefined;
+    if (!appIdEnvName) {
+        return failure("The rendered m365agents.yml does not expose a Teams app id.");
+    }
+    const placeholderUsed = args.authType === "oauth-dynamic" && !args.endpoints.wellKnownUrl;
+    const oauthUrlPlaceholderUsed = args.authType === "oauth" && (!args.endpoints.authorizationUrl || !args.endpoints.tokenUrl);
+    const action = args.authType === "oauth-dynamic"
+        ? dcrAction(args, appIdEnvName, args.endpoints.wellKnownUrl ?? exports.MCP_DCR_WELL_KNOWN_URL_PLACEHOLDER)
+        : oauthAction(args, appIdEnvName);
+    provision.items.splice(teamsAppIndex + 1, 0, document.createNode(action));
+    if (args.authType === "oauth-dynamic") {
+        const version = ensureMinimumVersion(document.get("version"), MIN_DCR_YAML_VERSION);
+        if (version) {
+            document.set("version", version);
+        }
+    }
+    return (0, neverthrow_1.ok)({
+        yaml: document.toString(),
+        wellKnownUrlPlaceholderUsed: placeholderUsed,
+        oauthUrlPlaceholderUsed,
+    });
+}
+//# sourceMappingURL=mcpAuthAction.js.map

package/build/v4/mcp/mcpAuthAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuthAction.js","sourceRoot":"","sources":["../../../src/v4/mcp/mcpAuthAction.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAsKlC,0DAgEC;AApOD,wDAA8D;AAC9D,2CAA6C;AAC7C,+BAAmD;AAEnD,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACrC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;AAEzE,QAAA,kCAAkC,GAC7C,sDAAsD,CAAC;AAEzD;;;;GAIG;AACU,QAAA,uCAAuC,GAAG,oCAAoC,CAAC;AAC/E,QAAA,+BAA+B,GAAG,4BAA4B,CAAC;AA4B5E,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAA,gBAAG,EAAC,IAAI,yBAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,IAAa;IACnC,IAAI,CAAC,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,YAAK,EAAC,MAAM,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,IAAI,CAAC,IAAa;IACzB,IAAI,CAAC,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,IAAA,YAAK,EAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,IAAA,YAAK,EAAC,MAAM,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,OAAe;IAC7D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,OAAe,EAAwB,EAAE;QACtD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACjE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,WAAW,GAAG,WAAW,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAuB,EAAE,YAAoB;IAChE,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,cAAc,CAAC,gBAAgB;YAC7B,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,+CAAuC,CAAC;QAC7E,cAAc,CAAC,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,uCAA+B,CAAC;QACrF,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9B,cAAc,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,KAAK,EAAE,OAAO,YAAY,IAAI;YAC9B,IAAI,EAAE,mBAAmB;YACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,CAAC,EAAE,GAAG,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE;gBACnD,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,GAAG,CAAC,IAAI,CAAC,kBAAkB;gBACzB,CAAC,CAAC;oBACE,QAAQ,EAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,IAAI;oBACrD,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY;wBACtC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,YAAY,IAAI,EAAE;wBACnE,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK;wBAC/B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;wBACrD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,sBAAsB,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,IAAuB,EACvB,YAAoB,EACpB,YAAoB;IAEpB,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE;YACJ,IAAI,EAAE,IAAI,CAAC,QAAQ;YACnB,KAAK,EAAE,OAAO,YAAY,IAAI;YAC9B,gBAAgB,EAAE,QAAQ;YAC1B,cAAc,EAAE,YAAY;YAC5B,4BAA4B,EAAE,YAAY;YAC1C,yBAAyB,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC/C;QACD,sBAAsB,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,SAAgB,uBAAuB,CACrC,IAAY,EACZ,IAAuB;IAEvB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,8BAA8B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO,IAAA,eAAE,EAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,IAAA,YAAK,EAAC,SAAS,CAAC,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,oEAAoE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACzF,MAAM,iBAAiB,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAC5C,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CACpF,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,IAAA,eAAE,EAAC;YACR,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE;YACzB,2BAA2B,EAAE,KAAK;YAClC,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,6DAA6D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IAC1F,MAAM,uBAAuB,GAC3B,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9F,MAAM,MAAM,GACV,IAAI,CAAC,QAAQ,KAAK,eAAe;QAC/B,CAAC,CAAC,SAAS,CACP,IAAI,EACJ,YAAY,EACZ,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,0CAAkC,CAClE;QACH,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1E,IAAI,IAAI,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACpF,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,IAAA,eAAE,EAAC;QACR,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACzB,2BAA2B,EAAE,eAAe;QAC5C,uBAAuB;KACxB,CAAC,CAAC;AACL,CAAC"}

package/build/v4/mcp/mcpAuthScaffold.d.ts

@@ -0,0 +1,37 @@
+import { FxError } from "@microsoft/teamsfx-api";
+import { Result } from "neverthrow";
+import { probeMCPServerAuth, resolveMCPOAuthMetadata } from "../../common/mcpToolFetcher";
+import { StepContext } from "../pipeline/runScaffoldPipeline";
+/** Indirection seam so unit tests can stub the network probes on a plain object. */
+export declare const mcpAuthScaffoldDeps: {
+    probeMCPServerAuth: typeof probeMCPServerAuth;
+    resolveMCPOAuthMetadata: typeof resolveMCPOAuthMetadata;
+};
+/**
+ * Inject the `oauth/register` (or `dcr/register`) provision action into the rendered
+ * `m365agents.yml` (idempotent; inserted after `teamsApp/create`, which writes the
+ * `${{TEAMS_APP_ID}}` the action references).
+ */
+export declare function injectMcpAuthAction(ctx: StepContext, args: {
+    ymlPath: string;
+    authType: string;
+    mcpServerUrl: string;
+    credentialFields?: {
+        clientId: boolean;
+        clientSecret: boolean;
+        scope: boolean;
+    };
+}): Promise<Result<void, FxError>>;
+/**
+ * Persist the deterministic registration placeholder and the static credentials collected during
+ * create. The runtime routes `SECRET_*` through its encrypted user-environment storage.
+ */
+export declare function persistMcpAuthRegistrationEnv(ctx: StepContext, args: {
+    authType: string;
+    mcpServerUrl: string;
+    oauthClientId?: string;
+    oauthClientSecret?: string;
+    oauthScopes?: string;
+    entraClientId?: string;
+}): Promise<Result<void, FxError>>;
+//# sourceMappingURL=mcpAuthScaffold.d.ts.map

package/build/v4/mcp/mcpAuthScaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuthScaffold.d.ts","sourceRoot":"","sources":["../../../src/v4/mcp/mcpAuthScaffold.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAwB,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAW,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAkB9D,oFAAoF;AACpF,eAAO,MAAM,mBAAmB;;;CAG/B,CAAC;AAgFF;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CACjF,GACA,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAkDhC;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GACA,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAiBhC"}

package/build/v4/mcp/mcpAuthScaffold.js

@@ -0,0 +1,162 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpAuthScaffoldDeps = void 0;
+exports.injectMcpAuthAction = injectMcpAuthAction;
+exports.persistMcpAuthRegistrationEnv = persistMcpAuthRegistrationEnv;
+const teamsfx_api_1 = require("@microsoft/teamsfx-api");
+const neverthrow_1 = require("neverthrow");
+const localizeUtils_1 = require("../../common/localizeUtils");
+const mcpAuthAction_1 = require("./mcpAuthAction");
+const mcpToolFetcher_1 = require("../../common/mcpToolFetcher");
+const whitelist_1 = require("../runtime/whitelist");
+/**
+ * v4 MCP-auth facade. The v4-owned YAML action mutator produces the create/add auth action shape
+ * for every auth type (`oauth`/`entra-sso` -> `oauth/register`, `oauth-dynamic` -> `dcr/register`
+ * with the v1.13 schema bump).
+ *
+ * Static OAuth and Entra credentials follow the v3 contract: the action references deterministic
+ * environment names and the runtime environment writer persists regular values separately from
+ * `SECRET_*` values. Dynamic registration has no static credential fields.
+ */
+const SOURCE = "Scaffold";
+/** MCP create scaffolding persists collected credentials to the default development environment. */
+const CREATE_ENVIRONMENT = "dev";
+/** Indirection seam so unit tests can stub the network probes on a plain object. */
+exports.mcpAuthScaffoldDeps = {
+    probeMCPServerAuth: mcpToolFetcher_1.probeMCPServerAuth,
+    resolveMCPOAuthMetadata: mcpToolFetcher_1.resolveMCPOAuthMetadata,
+};
+function systemError(name, message) {
+    return new teamsfx_api_1.SystemError({ source: SOURCE, name, message });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** The MCP namespace, registration id, and uppercase server name derived from the server URL. */
+function mcpAuthIdentifiers(mcpServerUrl) {
+    const namespace = (0, whitelist_1.deriveMcpServerName)(mcpServerUrl);
+    const uppercaseNamespace = namespace.toUpperCase();
+    return {
+        namespace,
+        registrationId: `MCP_DA_AUTH_ID_${uppercaseNamespace}`,
+        clientId: `MCP_DA_OAUTH_CLIENT_ID_${uppercaseNamespace}`,
+        clientSecret: `SECRET_MCP_DA_OAUTH_CLIENT_SECRET_${uppercaseNamespace}`,
+        scope: `MCP_DA_OAUTH_SCOPE_${uppercaseNamespace}`,
+    };
+}
+/**
+ * Best-effort resolution of the authorization-server endpoints for `oauth` / `oauth-dynamic`,
+ * mirroring the v3 create flow: probe the server for its `resource_metadata`, then resolve the
+ * well-known OAuth metadata. Any failure yields empty endpoints — the action is still injected and
+ * the developer fills the URLs before provisioning, matching v3's best-effort behavior. `entra-sso`
+ * and `none` need no endpoints (no network).
+ */
+async function resolveEndpoints(authType, mcpServerUrl, warn) {
+    if (authType !== "oauth" && authType !== "oauth-dynamic") {
+        return {};
+    }
+    try {
+        const probe = await exports.mcpAuthScaffoldDeps.probeMCPServerAuth(mcpServerUrl);
+        // A mistyped server URL would otherwise leave no trace: endpoint discovery falls back to
+        // the host and happily returns its authorization server, so the scaffold looks complete.
+        // Advisory, so it covers every `notEndpoint` shape — not just the 404 that blocks at input
+        // time (ADR-0020).
+        if (probe.endpointStatus === "notEndpoint") {
+            warn?.({
+                type: "mcpServerUrlNotAnEndpoint",
+                content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpServerUrlNotAnEndpoint", mcpServerUrl, String(probe.responseStatus)),
+            });
+        }
+        const metadata = await exports.mcpAuthScaffoldDeps.resolveMCPOAuthMetadata(probe.authMetadataUrl, undefined, mcpServerUrl);
+        return {
+            authorizationUrl: metadata.authorizationUrl,
+            tokenUrl: metadata.tokenUrl,
+            refreshUrl: metadata.refreshUrl,
+            wellKnownUrl: metadata.wellKnownUrl,
+        };
+    }
+    catch (error) {
+        warn?.({
+            type: "mcpAuthMetadataError",
+            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthMetadataMissingError", errorMessage(error)),
+        });
+        return {};
+    }
+}
+/**
+ * Inject the `oauth/register` (or `dcr/register`) provision action into the rendered
+ * `m365agents.yml` (idempotent; inserted after `teamsApp/create`, which writes the
+ * `${{TEAMS_APP_ID}}` the action references).
+ */
+async function injectMcpAuthAction(ctx, args) {
+    const current = ctx.read(args.ymlPath);
+    if (current === undefined) {
+        return (0, neverthrow_1.err)(systemError("McpAuthYmlMissing", `Cannot inject the auth action: '${args.ymlPath}' was not produced by the render phase.`));
+    }
+    const identifiers = mcpAuthIdentifiers(args.mcpServerUrl);
+    const endpoints = await resolveEndpoints(args.authType, args.mcpServerUrl, ctx.warn);
+    const injectResult = (0, mcpAuthAction_1.injectMcpAuthActionYaml)(current.toString("utf8"), {
+        authType: args.authType,
+        authName: identifiers.namespace,
+        registrationId: identifiers.registrationId,
+        mcpServerUrl: args.mcpServerUrl,
+        endpoints,
+        ...(args.authType === "oauth" && args.credentialFields?.clientId
+            ? {
+                credentialEnvNames: {
+                    clientId: identifiers.clientId,
+                    ...(args.credentialFields.clientSecret
+                        ? { clientSecret: identifiers.clientSecret }
+                        : {}),
+                    ...(args.credentialFields.scope ? { scope: identifiers.scope } : {}),
+                },
+            }
+            : {}),
+        ...(args.authType === "entra-sso" && args.credentialFields?.clientId
+            ? { credentialEnvNames: { clientId: identifiers.clientId } }
+            : {}),
+    });
+    if (injectResult.isErr()) {
+        return (0, neverthrow_1.err)(injectResult.error);
+    }
+    if (injectResult.value.wellKnownUrlPlaceholderUsed) {
+        ctx.warn?.({
+            type: "mcpAuthDcrWellKnownUrlPlaceholder",
+            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthDcrPlaceholderWarning"),
+        });
+    }
+    if (injectResult.value.oauthUrlPlaceholderUsed) {
+        ctx.warn?.({
+            type: "mcpAuthOAuthUrlPlaceholder",
+            content: (0, localizeUtils_1.getLocalizedString)("core.MCPForDA.mcpAuthOAuthPlaceholderWarning"),
+        });
+    }
+    ctx.write(args.ymlPath, Buffer.from(injectResult.value.yaml, "utf8"));
+    return (0, neverthrow_1.ok)(undefined);
+}
+/**
+ * Persist the deterministic registration placeholder and the static credentials collected during
+ * create. The runtime routes `SECRET_*` through its encrypted user-environment storage.
+ */
+function persistMcpAuthRegistrationEnv(ctx, args) {
+    const identifiers = mcpAuthIdentifiers(args.mcpServerUrl);
+    const values = { [identifiers.registrationId]: "" };
+    if (args.authType === "oauth") {
+        if (args.oauthClientId !== undefined) {
+            values[identifiers.clientId] = args.oauthClientId;
+        }
+        if (args.oauthClientSecret !== undefined) {
+            values[identifiers.clientSecret] = args.oauthClientSecret;
+        }
+        if (args.oauthScopes?.trim()) {
+            values[identifiers.scope] = args.oauthScopes;
+        }
+    }
+    else if (args.authType === "entra-sso" && args.entraClientId !== undefined) {
+        values[identifiers.clientId] = args.entraClientId;
+    }
+    return ctx.writeEnvironment(CREATE_ENVIRONMENT, values);
+}
+//# sourceMappingURL=mcpAuthScaffold.js.map

package/build/v4/mcp/mcpAuthScaffold.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpAuthScaffold.js","sourceRoot":"","sources":["../../../src/v4/mcp/mcpAuthScaffold.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAkHlC,kDA0DC;AAMD,sEA2BC;AA3MD,wDAAuE;AACvE,2CAA6C;AAC7C,8DAAgE;AAChE,mDAAoF;AACpF,gEAA0F;AAE1F,oDAA2D;AAE3D;;;;;;;;GAQG;AAEH,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,oFAAoF;AACvE,QAAA,mBAAmB,GAAG;IACjC,kBAAkB,EAAlB,mCAAkB;IAClB,uBAAuB,EAAvB,wCAAuB;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,OAAO,IAAI,yBAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,iGAAiG;AACjG,SAAS,kBAAkB,CAAC,YAAoB;IAO9C,MAAM,SAAS,GAAG,IAAA,+BAAmB,EAAC,YAAY,CAAC,CAAC;IACpD,MAAM,kBAAkB,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO;QACL,SAAS;QACT,cAAc,EAAE,kBAAkB,kBAAkB,EAAE;QACtD,QAAQ,EAAE,0BAA0B,kBAAkB,EAAE;QACxD,YAAY,EAAE,qCAAqC,kBAAkB,EAAE;QACvE,KAAK,EAAE,sBAAsB,kBAAkB,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAgB,EAChB,YAAoB,EACpB,IAAiC;IAEjC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACzD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,2BAAmB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzE,yFAAyF;QACzF,yFAAyF;QACzF,2FAA2F;QAC3F,mBAAmB;QACnB,IAAI,KAAK,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;YAC3C,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,IAAA,kCAAkB,EACzB,yCAAyC,EACzC,YAAY,EACZ,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAC7B;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,2BAAmB,CAAC,uBAAuB,CAChE,KAAK,CAAC,eAAe,EACrB,SAAS,EACT,YAAY,CACb,CAAC;QACF,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,EAAE,CAAC;YACL,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,IAAA,kCAAkB,EAAC,2CAA2C,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;SAC9F,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,mBAAmB,CACvC,GAAgB,EAChB,IAKC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAA,gBAAG,EACR,WAAW,CACT,mBAAmB,EACnB,mCAAmC,IAAI,CAAC,OAAO,yCAAyC,CACzF,CACF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,IAAA,uCAAuB,EAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;QACrE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,WAAW,CAAC,SAAS;QAC/B,cAAc,EAAE,WAAW,CAAC,cAAc;QAC1C,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,gBAAgB,EAAE,QAAQ;YAC9D,CAAC,CAAC;gBACE,kBAAkB,EAAE;oBAClB,QAAQ,EAAE,WAAW,CAAC,QAAQ;oBAC9B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,YAAY;wBACpC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,QAAQ;YAClE,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,IAAA,gBAAG,EAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC;QACnD,GAAG,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,IAAA,kCAAkB,EAAC,4CAA4C,CAAC;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,YAAY,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,EAAE,CAAC;YACT,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAA,kCAAkB,EAAC,8CAA8C,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,OAAO,IAAA,eAAE,EAAC,SAAS,CAAC,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAC3C,GAAgB,EAChB,IAOC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAA2B,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC5D,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/build/v4/mcp/mcpStaticTools.d.ts

@@ -0,0 +1,17 @@
+/** v4-local parser for static MCP tools JSON. */
+export interface McpStaticTool {
+    name: string;
+    description: string;
+    raw: Record<string, unknown>;
+}
+export type McpStaticToolsParseResult = {
+    ok: true;
+    tools: McpStaticTool[];
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+export declare function parseMcpStaticToolsJson(toolsJson: string): McpStaticToolsParseResult;
+export declare function selectMcpStaticTools(tools: McpStaticTool[], selected: string[]): McpStaticToolsParseResult;
+//# sourceMappingURL=mcpStaticTools.d.ts.map

package/build/v4/mcp/mcpStaticTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpStaticTools.d.ts","sourceRoot":"","sources":["../../../src/v4/mcp/mcpStaticTools.ts"],"names":[],"mappings":"AAGA,iDAAiD;AAEjD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAUjD,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAyCpF;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EAAE,EACtB,QAAQ,EAAE,MAAM,EAAE,GACjB,yBAAyB,CAe3B"}

package/build/v4/mcp/mcpStaticTools.js

@@ -0,0 +1,70 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMcpStaticToolsJson = parseMcpStaticToolsJson;
+exports.selectMcpStaticTools = selectMcpStaticTools;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function parseMcpStaticToolsJson(toolsJson) {
+    let parsed;
+    try {
+        parsed = JSON.parse(toolsJson);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            code: "McpStaticToolsParse",
+            message: `MCP tools JSON is not valid JSON: ${errorMessage(error)}`,
+        };
+    }
+    if (!isRecord(parsed)) {
+        return {
+            ok: false,
+            code: "McpStaticToolsShape",
+            message: "MCP tools JSON must be an object with a 'tools' array.",
+        };
+    }
+    const tools = parsed.tools;
+    if (!Array.isArray(tools)) {
+        return {
+            ok: false,
+            code: "McpStaticToolsArray",
+            message: "MCP tools JSON must contain a 'tools' array.",
+        };
+    }
+    const parsedTools = [];
+    for (const tool of tools) {
+        if (!isRecord(tool) || typeof tool.name !== "string" || tool.name.length === 0) {
+            return {
+                ok: false,
+                code: "McpStaticToolName",
+                message: "Every MCP tool must be an object with a non-empty string 'name'.",
+            };
+        }
+        const description = typeof tool.description === "string" ? tool.description : "";
+        parsedTools.push({ name: tool.name, description, raw: tool });
+    }
+    return { ok: true, tools: parsedTools };
+}
+function selectMcpStaticTools(tools, selected) {
+    const byName = new Map(tools.map((tool) => [tool.name, tool]));
+    const selectedTools = [];
+    for (const name of selected) {
+        const tool = byName.get(name);
+        if (tool === undefined) {
+            return {
+                ok: false,
+                code: "McpStaticToolMissing",
+                message: `Selected MCP tool '${name}' does not exist in the tools JSON.`,
+            };
+        }
+        selectedTools.push(tool);
+    }
+    return { ok: true, tools: selectedTools };
+}
+//# sourceMappingURL=mcpStaticTools.js.map

package/build/v4/mcp/mcpStaticTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpStaticTools.js","sourceRoot":"","sources":["../../../src/v4/mcp/mcpStaticTools.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;AAsBlC,0DAyCC;AAED,oDAkBC;AArED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAgB,uBAAuB,CAAC,SAAiB;IACvD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,qCAAqC,YAAY,CAAC,KAAK,CAAC,EAAE;SACpE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,8CAA8C;SACxD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/E,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,kEAAkE;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAC1C,CAAC;AAED,SAAgB,oBAAoB,CAClC,KAAsB,EACtB,QAAkB;IAElB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,sBAAsB,IAAI,qCAAqC;aACzE,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC5C,CAAC"}