@owox/backend 0.35.0 → 0.36.0

package/dist/src/data-marts/use-cases/update-data-mart-definition.service.js

@@ -66,7 +66,7 @@ let UpdateDataMartDefinitionService = class UpdateDataMartDefinitionService {
             this.assertDefinitionTypeChangeAllowed(previousDefinitionType, command.definitionType);
             definitionTypeChanged = true;
         }
-        const connectorCapabilities = this.getConnectorCapabilities(command);
+        const connectorCapabilities = await this.resolveConnectorCapabilities(command);
         this.validateConnectorConfigurationCount(command, connectorCapabilities);
         if (dataMart.storage.type === data_storage_type_enum_1.DataStorageType.LEGACY_GOOGLE_BIGQUERY) {
             if (command.definitionType !== data_mart_definition_type_enum_1.DataMartDefinitionType.SQL) {
@@ -91,11 +91,11 @@ let UpdateDataMartDefinitionService = class UpdateDataMartDefinitionService {
             }
             this.validateSecretReferences(connectorDefinition, previousDefinition, sourceDefinition);
             if (sourceDefinition) {
-                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecretsFromSource(connectorDefinition, sourceDefinition);
-                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecrets(mergedDefinition, previousDefinition);
+                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecretsFromSource(command.projectId, connectorDefinition, sourceDefinition);
+                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecrets(command.projectId, mergedDefinition, previousDefinition);
             }
             else {
-                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecrets(connectorDefinition, previousDefinition);
+                mergedDefinition = await this.connectorSecretService.mergeDefinitionSecrets(command.projectId, connectorDefinition, previousDefinition);
             }
             dataMart.definition = await this.connectorSecretService.extractAndSaveSecrets(dataMart.id, command.projectId, connectorDefinition.connector.source.name, mergedDefinition);
             await this.connectorSecretService.deleteOrphanedSecrets(dataMart.id, dataMart.definition, previousDefinition);
@@ -119,13 +119,15 @@ let UpdateDataMartDefinitionService = class UpdateDataMartDefinitionService {
         await this.advancedSearchIndexSync?.scheduleReindex(search_facade_1.SearchableEntityType.DATA_MART, dataMart.id, command.projectId);
         return this.mapper.toDomainDto(dataMart);
     }
-    getConnectorCapabilities(command) {
+    async resolveConnectorCapabilities(command) {
         if (command.definitionType !== data_mart_definition_type_enum_1.DataMartDefinitionType.CONNECTOR) {
             return undefined;
         }
         const definition = command.definition;
         const source = definition?.connector?.source;
-        return source?.name ? this.connectorService.getConnectorCapabilities(source.name) : undefined;
+        return source?.name
+            ? this.connectorService.resolveConnectorCapabilities(command.projectId, source.name, source.version)
+            : undefined;
     }
     validateConnectorConfigurationCount(command, capabilities) {
         if (!capabilities?.singleConfiguration) {

package/dist/src/data-marts/use-cases/update-data-mart-icon.service.d.ts

@@ -0,0 +1,12 @@
+import { DataMartMapper } from '../mappers/data-mart.mapper';
+import { DataMartDto } from '../dto/domain/data-mart.dto';
+import { DataMartService } from '../services/data-mart.service';
+import { UpdateDataMartIconCommand } from '../dto/domain/update-data-mart-icon.command';
+import { AccessDecisionService } from '../services/access-decision';
+export declare class UpdateDataMartIconService {
+    private readonly dataMartService;
+    private readonly mapper;
+    private readonly accessDecisionService;
+    constructor(dataMartService: DataMartService, mapper: DataMartMapper, accessDecisionService: AccessDecisionService);
+    run(command: UpdateDataMartIconCommand): Promise<DataMartDto>;
+}

package/dist/src/data-marts/use-cases/update-data-mart-icon.service.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateDataMartIconService = void 0;
+const common_1 = require("@nestjs/common");
+const data_mart_mapper_1 = require("../mappers/data-mart.mapper");
+const data_mart_service_1 = require("../services/data-mart.service");
+const access_decision_1 = require("../services/access-decision");
+let UpdateDataMartIconService = class UpdateDataMartIconService {
+    dataMartService;
+    mapper;
+    accessDecisionService;
+    constructor(dataMartService, mapper, accessDecisionService) {
+        this.dataMartService = dataMartService;
+        this.mapper = mapper;
+        this.accessDecisionService = accessDecisionService;
+    }
+    async run(command) {
+        const dataMart = await this.dataMartService.getByIdAndProjectId(command.id, command.projectId);
+        if (command.userId) {
+            const canEdit = await this.accessDecisionService.canAccess(command.userId, command.roles, access_decision_1.EntityType.DATA_MART, command.id, access_decision_1.Action.EDIT, command.projectId);
+            if (!canEdit) {
+                throw new common_1.ForbiddenException('You do not have permission to edit this DataMart');
+            }
+        }
+        dataMart.icon = command.icon;
+        await this.dataMartService.save(dataMart);
+        return this.mapper.toDomainDto(dataMart);
+    }
+};
+exports.UpdateDataMartIconService = UpdateDataMartIconService;
+exports.UpdateDataMartIconService = UpdateDataMartIconService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [data_mart_service_1.DataMartService,
+        data_mart_mapper_1.DataMartMapper,
+        access_decision_1.AccessDecisionService])
+], UpdateDataMartIconService);
+//# sourceMappingURL=update-data-mart-icon.service.js.map

package/dist/src/data-marts/use-cases/update-data-mart-schema.service.js

@@ -18,7 +18,9 @@ const data_mart_entity_1 = require("../entities/data-mart.entity");
 const calculated_field_utils_1 = require("../calculated-fields/calculated-field.utils");
 const calculated_field_validator_service_1 = require("../calculated-fields/calculated-field-validator.service");
 const formula_violations_1 = require("../calculated-fields/formula-violations");
+const join_grain_1 = require("../calculated-fields/join-grain");
 const data_storage_credentials_resolver_service_1 = require("../data-storage-types/data-storage-credentials-resolver.service");
+const data_mart_schema_utils_1 = require("../data-storage-types/data-mart-schema.utils");
 const data_mart_schema_field_status_enum_1 = require("../data-storage-types/enums/data-mart-schema-field-status.enum");
 const data_mart_schema_parser_facade_service_1 = require("../data-storage-types/facades/data-mart-schema-parser-facade.service");
 const data_mart_mapper_1 = require("../mappers/data-mart.mapper");
@@ -57,6 +59,7 @@ let UpdateDataMartSchemaService = UpdateDataMartSchemaService_1 = class UpdateDa
         }
         const parsed = await this.schemaParserFacade.validateAndParse(command.schema, dataMart.storage.type);
         const introducesNativeField = applyServerOwnedFieldStatuses(parsed, dataMart.schema);
+        const previousFields = dataMart.schema?.fields ?? [];
         dataMart.schema = parsed;
         if (introducesNativeField) {
             dataMart.schemaActualizedAt = null;
@@ -102,7 +105,11 @@ let UpdateDataMartSchemaService = UpdateDataMartSchemaService_1 = class UpdateDa
         await this.saveAndInvalidate(dataMart);
         await this.searchIndexInvalidation?.scheduleDataMartSchemaChanged(dataMart.id, command.projectId);
         this.logger.debug(`Data mart ${command.id} schema updated`);
-        return { ...this.mapper.toDomainDto(dataMart), warnings };
+        return {
+            ...this.mapper.toDomainDto(dataMart),
+            warnings: (0, join_grain_1.withoutUntouchedJoinAdvisories)(warnings, editedCalculatedFields(previousFields, calculatedFields), (0, data_mart_schema_utils_1.declaredPrimaryKeyFields)(previousFields).sort().join('\n') !==
+                (0, data_mart_schema_utils_1.declaredPrimaryKeyFields)(parsed.fields).sort().join('\n')),
+        };
     }
     async saveAndInvalidate(dataMart) {
         await this.dataMartService.save(dataMart);
@@ -158,4 +165,10 @@ function applyFieldStatuses(fields, persistedFields) {
 function nestedFieldsOf(field) {
     return 'fields' in field && Array.isArray(field.fields) ? field.fields : undefined;
 }
+function editedCalculatedFields(previousFields, calculatedFields) {
+    const previous = new Map((0, calculated_field_utils_1.calculatedFieldsOf)(previousFields).map(field => [field.name, field.calculated.formula]));
+    return new Set(calculatedFields
+        .filter(field => previous.get(field.name) !== field.calculated.formula)
+        .map(field => field.name));
+}
 //# sourceMappingURL=update-data-mart-schema.service.js.map

package/dist/src/data-marts/use-cases/update-report.service.js

@@ -32,6 +32,7 @@ const report_access_service_1 = require("../services/report-access.service");
 const report_data_cache_service_1 = require("../services/report-data-cache.service");
 const output_controls_validator_service_1 = require("../services/output-controls-validator.service");
 const unique_count_sources_1 = require("../dto/schemas/unique-count-sources");
+const auto_aggregation_opt_out_schema_1 = require("../dto/schemas/auto-aggregation-opt-out.schema");
 const advanced_search_index_sync_service_1 = require("../services/advanced-search-index-sync.service");
 const search_facade_1 = require("../../common/search/search.facade");
 let UpdateReportService = class UpdateReportService {
@@ -132,6 +133,11 @@ let UpdateReportService = class UpdateReportService {
         const previousDateTruncConfig = report.dateTruncConfig ?? null;
         const nextDateTruncConfig = command.dateTruncConfig ?? null;
         const dateTruncChanged = JSON.stringify(previousDateTruncConfig) !== JSON.stringify(nextDateTruncConfig);
+        const previousAutoAggregationOptOut = (0, auto_aggregation_opt_out_schema_1.foldEmptyAutoAggregationOptOut)(report.autoAggregationOptOut);
+        const nextAutoAggregationOptOut = (0, auto_aggregation_opt_out_schema_1.selectedAutoAggregationOptOut)(command.autoAggregationOptOut === undefined
+            ? previousAutoAggregationOptOut
+            : command.autoAggregationOptOut, nextColumnConfig);
+        const autoAggregationOptOutChanged = JSON.stringify(previousAutoAggregationOptOut) !== JSON.stringify(nextAutoAggregationOptOut);
         report.title = command.title;
         report.dataDestination = dataDestination;
         report.destinationConfig = command.destinationConfig;
@@ -142,6 +148,7 @@ let UpdateReportService = class UpdateReportService {
         report.aggregationConfig = nextAggregationConfig;
         report.dateTruncConfig = nextDateTruncConfig;
         report.uniqueCountConfig = nextUniqueCountConfig;
+        report.autoAggregationOptOut = nextAutoAggregationOptOut;
         const updatedReport = await this.reportRepository.save(report);
         await this.advancedSearchIndexSync?.scheduleReindex(search_facade_1.SearchableEntityType.REPORT, updatedReport.id, command.projectId);
         if (command.ownerIds !== undefined) {
@@ -158,7 +165,8 @@ let UpdateReportService = class UpdateReportService {
             limitChanged ||
             aggregationChanged ||
             dateTruncChanged ||
-            uniqueCountChanged) {
+            uniqueCountChanged ||
+            autoAggregationOptOutChanged) {
             await this.reportDataCacheService.invalidateByReportId(updatedReport.id);
         }
         const fresh = await this.reportRepository.findOne({

package/dist/src/ee/ee.module.js

@@ -15,15 +15,13 @@ const mcp_resource_module_1 = require("../mcp-resource/mcp-resource.module");
 const project_settings_module_1 = require("../project-settings/project-settings.module");
 const idp_mcp_auth_adapter_1 = require("./mcp/auth/idp-mcp-auth.adapter");
 const mcp_auth_port_1 = require("./mcp/auth/mcp-auth.port");
-const mcp_auth_exception_filter_1 = require("./mcp/auth/mcp-auth.exception-filter");
-const mcp_auth_guard_1 = require("./mcp/auth/mcp-auth.guard");
+const mcp_auth_middleware_1 = require("./mcp/auth/mcp-auth.middleware");
 const mcp_config_1 = require("./mcp/config/mcp.config");
 const mcp_metadata_controller_1 = require("./mcp/controllers/mcp-metadata.controller");
-const mcp_transport_controller_1 = require("./mcp/controllers/mcp-transport.controller");
 const mcp_bus_extras_module_1 = require("./mcp/observability/mcp-bus-extras.module");
 const mcp_call_instrumentation_1 = require("./mcp/observability/mcp-call-instrumentation");
 const mcp_sdk_server_factory_1 = require("./mcp/sdk/mcp-sdk-server.factory");
-const mcp_streamable_http_transport_handler_1 = require("./mcp/sdk/mcp-streamable-http-transport.handler");
+const mcp_http_entry_service_1 = require("./mcp/transport/mcp-http-entry.service");
 const mcp_instructions_service_1 = require("./mcp/instructions/mcp-instructions.service");
 const mcp_tool_providers_1 = require("./mcp/tools/mcp-tool.providers");
 const mcp_tool_registry_1 = require("./mcp/tools/mcp-tool.registry");
@@ -40,7 +38,7 @@ exports.EeModule = EeModule = __decorate([
             project_settings_module_1.ProjectSettingsModule,
             mcp_bus_extras_module_1.McpBusExtrasModule,
         ],
-        controllers: [mcp_metadata_controller_1.McpMetadataController, mcp_transport_controller_1.McpTransportController],
+        controllers: [mcp_metadata_controller_1.McpMetadataController],
         providers: [
             mcp_config_1.McpConfigService,
             idp_mcp_auth_adapter_1.IdpMcpAuthAdapter,
@@ -48,15 +46,14 @@ exports.EeModule = EeModule = __decorate([
                 provide: mcp_auth_port_1.MCP_AUTH_PORT,
                 useExisting: idp_mcp_auth_adapter_1.IdpMcpAuthAdapter,
             },
-            mcp_auth_guard_1.McpAuthGuard,
-            mcp_auth_exception_filter_1.McpAuthExceptionFilter,
+            mcp_auth_middleware_1.McpAuthMiddleware,
             ...mcp_tool_providers_1.MCP_TOOL_PROVIDER_CLASSES,
             mcp_tool_providers_1.MCP_TOOL_DEFINITIONS_PROVIDER,
             mcp_tool_registry_1.McpToolRegistry,
             mcp_call_instrumentation_1.McpCallInstrumentation,
             mcp_sdk_server_factory_1.McpSdkServerFactory,
             mcp_instructions_service_1.McpInstructionsService,
-            mcp_streamable_http_transport_handler_1.McpStreamableHttpTransportHandler,
+            mcp_http_entry_service_1.McpHttpEntryService,
         ],
         exports: [mcp_config_1.McpConfigService],
     })

package/dist/src/ee/mcp/auth/mcp-auth-context.d.ts

@@ -1,6 +1,2 @@
-import type { Request } from 'express';
 import type { McpTokenPayload } from '@owox/idp-protocol';
 export type McpAuthContext = McpTokenPayload;
-export interface McpAuthenticatedRequest extends Request {
-    mcpContext: McpAuthContext;
-}

package/dist/src/ee/mcp/auth/mcp-auth.middleware.d.ts

@@ -0,0 +1,26 @@
+import type { Request, RequestHandler } from 'express';
+import type { AuthInfo } from '@modelcontextprotocol/server';
+import type { McpTokenPayload } from '@owox/idp-protocol';
+import { McpResourceResolverService } from '../../../mcp-resource/mcp-resource-resolver.service';
+import { McpConfigService } from '../config/mcp.config';
+import { type McpAuthPort } from './mcp-auth.port';
+export interface McpAuthenticatedRequest extends Request {
+    auth?: AuthInfo;
+}
+export declare class McpAuthMiddleware {
+    private readonly auth;
+    private readonly resourceResolver;
+    private readonly config;
+    private readonly logger;
+    constructor(auth: McpAuthPort, resourceResolver: McpResourceResolverService, config: McpConfigService);
+    handle: RequestHandler;
+    private verify;
+    private reject;
+    private rejectUnexpected;
+    private extractBearerToken;
+    private getRequestedSessionId;
+    private assertPayload;
+    private getChallengeHeader;
+    private isExpectedAnonymousProbe;
+}
+export declare function toMcpAuthContext(authInfo: AuthInfo | undefined): McpTokenPayload;

package/dist/src/ee/mcp/auth/mcp-auth.middleware.js

@@ -0,0 +1,184 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var McpAuthMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthMiddleware = void 0;
+exports.toMcpAuthContext = toMcpAuthContext;
+const common_1 = require("@nestjs/common");
+const internal_helpers_1 = require("@owox/internal-helpers");
+const mcp_resource_resolver_service_1 = require("../../../mcp-resource/mcp-resource-resolver.service");
+const mcp_config_1 = require("../config/mcp.config");
+const http_headers_util_1 = require("../http-headers.util");
+const mcp_auth_port_1 = require("./mcp-auth.port");
+const REQUIRED_SCOPES = ['mcp:read'];
+class McpAuthRejection extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'McpAuthRejection';
+    }
+}
+let McpAuthMiddleware = McpAuthMiddleware_1 = class McpAuthMiddleware {
+    auth;
+    resourceResolver;
+    config;
+    logger = new common_1.Logger(McpAuthMiddleware_1.name);
+    constructor(auth, resourceResolver, config) {
+        this.auth = auth;
+        this.resourceResolver = resourceResolver;
+        this.config = config;
+    }
+    handle = async (request, response, next) => {
+        let resourceContext = null;
+        try {
+            resourceContext = this.resourceResolver.tryResolveRequest(request);
+            request.auth = await this.verify(request, resourceContext);
+            next();
+        }
+        catch (error) {
+            if (error instanceof McpAuthRejection) {
+                this.reject(request, response, error.message, resourceContext);
+            }
+            else {
+                this.rejectUnexpected(request, response, error);
+            }
+        }
+    };
+    async verify(request, resourceContext) {
+        const token = this.extractBearerToken(request);
+        if (!resourceContext) {
+            throw new McpAuthRejection('Invalid MCP resource');
+        }
+        const payload = await this.auth.verifyToken(token, resourceContext.resource, REQUIRED_SCOPES);
+        if (!payload) {
+            throw new McpAuthRejection('Invalid MCP bearer token');
+        }
+        this.assertPayload(payload, resourceContext);
+        this.logger.debug('MCP auth accepted', {
+            method: request.method,
+            url: request.originalUrl ?? request.url,
+            requestSessionId: this.getRequestedSessionId(request),
+            projectId: payload.projectId,
+            clientId: payload.clientId,
+            resource: payload.resource,
+            scopes: payload.scopes,
+            roles: payload.roles,
+        });
+        return {
+            token,
+            clientId: payload.clientId,
+            scopes: payload.scopes,
+            extra: { mcpContext: payload },
+        };
+    }
+    reject(request, response, message, resourceContext) {
+        const metadata = {
+            method: request.method,
+            url: request.originalUrl ?? request.url,
+            requestSessionId: this.getRequestedSessionId(request),
+            accept: request.headers?.accept,
+            contentType: request.headers?.['content-type'],
+            hasAuthorization: Boolean(request.headers?.authorization),
+            message,
+        };
+        if (this.isExpectedAnonymousProbe(request, message)) {
+            this.logger.log('MCP auth rejected', metadata);
+        }
+        else {
+            this.logger.warn('MCP auth rejected', metadata);
+        }
+        response.setHeader('WWW-Authenticate', this.getChallengeHeader(resourceContext));
+        response.status(401).json({
+            statusCode: 401,
+            message,
+            error: 'Unauthorized',
+        });
+    }
+    rejectUnexpected(request, response, error) {
+        this.logger.error('MCP auth failed unexpectedly', {
+            method: request.method,
+            url: request.originalUrl ?? request.url,
+            requestSessionId: this.getRequestedSessionId(request),
+            message: (0, internal_helpers_1.castError)(error).message,
+        });
+        response.status(500).json({
+            statusCode: 500,
+            message: 'Internal server error',
+            error: 'Internal Server Error',
+        });
+    }
+    extractBearerToken(request) {
+        const authorization = request.headers.authorization;
+        const value = Array.isArray(authorization) ? authorization[0] : authorization;
+        if (!value?.startsWith('Bearer ')) {
+            throw new McpAuthRejection('Missing MCP bearer token');
+        }
+        const token = value.slice('Bearer '.length).trim();
+        if (!token) {
+            throw new McpAuthRejection('Missing MCP bearer token');
+        }
+        return token;
+    }
+    getRequestedSessionId(request) {
+        return (0, http_headers_util_1.firstHeaderValue)(request, 'mcp-session-id');
+    }
+    assertPayload(payload, resourceContext) {
+        if (payload.authFlow !== 'mcp') {
+            throw new McpAuthRejection('Invalid MCP auth flow');
+        }
+        if (payload.resource !== resourceContext.resource) {
+            throw new McpAuthRejection('Invalid MCP resource');
+        }
+        if (resourceContext.kind === 'project' && payload.projectId !== resourceContext.projectId) {
+            throw new McpAuthRejection('Invalid MCP project context');
+        }
+        if (!payload.projectId) {
+            throw new McpAuthRejection('Missing MCP project context');
+        }
+        if (!payload.roles.length) {
+            throw new McpAuthRejection('Missing MCP project roles');
+        }
+        for (const scope of REQUIRED_SCOPES) {
+            if (!payload.scopes.includes(scope)) {
+                throw new McpAuthRejection('Missing MCP scope');
+            }
+        }
+    }
+    getChallengeHeader(resourceContext) {
+        const metadataUrl = resourceContext
+            ? `${resourceContext.publicBaseUrl}/.well-known/oauth-protected-resource`
+            : this.config.protectedResourceMetadataUrl;
+        return `Bearer resource_metadata="${metadataUrl}", scope="${this.config.scopes.join(' ')}"`;
+    }
+    isExpectedAnonymousProbe(request, message) {
+        return (request.method === 'GET' &&
+            (request.originalUrl ?? request.url) === '/mcp' &&
+            !request.headers?.authorization &&
+            message === 'Missing MCP bearer token');
+    }
+};
+exports.McpAuthMiddleware = McpAuthMiddleware;
+exports.McpAuthMiddleware = McpAuthMiddleware = McpAuthMiddleware_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(mcp_auth_port_1.MCP_AUTH_PORT)),
+    __metadata("design:paramtypes", [Object, mcp_resource_resolver_service_1.McpResourceResolverService,
+        mcp_config_1.McpConfigService])
+], McpAuthMiddleware);
+function toMcpAuthContext(authInfo) {
+    const mcpContext = authInfo?.extra?.mcpContext;
+    if (!mcpContext) {
+        throw new Error('MCP request reached the server factory without a verified auth context');
+    }
+    return mcpContext;
+}
+//# sourceMappingURL=mcp-auth.middleware.js.map

package/dist/src/ee/mcp/http-headers.util.d.ts

@@ -0,0 +1,2 @@
+import type { Request } from 'express';
+export declare function firstHeaderValue(request: Request, name: string): string | undefined;

package/dist/src/ee/mcp/http-headers.util.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.firstHeaderValue = firstHeaderValue;
+function firstHeaderValue(request, name) {
+    const header = request.headers?.[name];
+    return Array.isArray(header) ? header[0] : header;
+}
+//# sourceMappingURL=http-headers.util.js.map

package/dist/src/ee/mcp/observability/mcp-bus-wiring.js

@@ -3,15 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.mcpOffloadPathBuilder = mcpOffloadPathBuilder;
 exports.mcpSpanMapper = mcpSpanMapper;
 exports.buildMcpBusExtras = buildMcpBusExtras;
-const zod_1 = require("zod");
+const zod_v4_1 = require("zod-v4");
 const node_crypto_1 = require("node:crypto");
 const internal_helpers_1 = require("@owox/internal-helpers");
 const DEFAULT_INLINE_MAX_BYTES = 4096;
 const GCS_TIMEOUT_MS = 10000;
 const logger = internal_helpers_1.LoggerFactory.createNamedLogger('McpBusWiring');
-const logSchema = zod_1.z.object({
-    MCP_LOG_GCS_BUCKET: zod_1.z.string().trim().min(1).optional().catch(undefined),
-    MCP_LOG_INLINE_MAX_BYTES: zod_1.z.coerce.number().int().positive().optional().catch(undefined),
+const logSchema = zod_v4_1.z.object({
+    MCP_LOG_GCS_BUCKET: zod_v4_1.z.string().trim().min(1).optional().catch(undefined),
+    MCP_LOG_INLINE_MAX_BYTES: zod_v4_1.z.coerce.number().int().positive().optional().catch(undefined),
 });
 function mcpOffloadPathBuilder(payload) {
     const date = new Date().toISOString().slice(0, 10);

package/dist/src/ee/mcp/observability/mcp-call-instrumentation.d.ts

@@ -1,10 +1,8 @@
+import type { ServerContext } from '@modelcontextprotocol/server';
 import { OwoxEventDispatcher } from '../../../common/event-dispatcher/owox-event-dispatcher';
 import { ClsContextService } from '../../../common/logger/cls-context.service';
 import type { McpToolResult } from '../tools/mcp-tool.definition';
-export type SdkToolCallback = (input: unknown, extra?: {
-    signal?: AbortSignal;
-    _meta?: Record<string, unknown>;
-}) => Promise<McpToolResult>;
+export type SdkToolCallback = (input: unknown, ctx?: ServerContext) => Promise<McpToolResult>;
 export declare class McpCallInstrumentation {
     private readonly dispatcher;
     private readonly cls;

package/dist/src/ee/mcp/observability/mcp-call-instrumentation.js

@@ -24,7 +24,7 @@ let McpCallInstrumentation = class McpCallInstrumentation {
         this.cls = cls;
     }
     wrap(toolName, callback) {
-        return async (input, extra) => {
+        return async (input, ctx) => {
             try {
                 this.cls.set(mcp_tool_diagnostics_1.MCP_TOOL_DIAGNOSTICS_KEY, {});
             }
@@ -32,21 +32,21 @@ let McpCallInstrumentation = class McpCallInstrumentation {
             }
             const startedAt = Date.now();
             try {
-                const result = await callback(input, extra);
-                this.emit(toolName, input, Date.now() - startedAt, { result }, extra);
+                const result = await callback(input, ctx);
+                this.emit(toolName, input, Date.now() - startedAt, { result }, ctx);
                 return result;
             }
             catch (error) {
-                this.emit(toolName, input, Date.now() - startedAt, { error }, extra);
+                this.emit(toolName, input, Date.now() - startedAt, { error }, ctx);
                 throw error;
             }
         };
     }
-    emit(toolName, input, durationMs, outcome, extra) {
+    emit(toolName, input, durationMs, outcome, ctx) {
         try {
             const context = this.cls.get(mcp_log_context_1.MCP_LOG_CONTEXT_KEY) ?? {};
             const diagnostics = this.cls.get(mcp_tool_diagnostics_1.MCP_TOOL_DIAGNOSTICS_KEY) ?? {};
-            const meta = extra?._meta;
+            const meta = ctx?.mcpReq?._meta;
             const event = (0, mcp_tool_call_event_1.buildMcpToolCallEvent)({
                 methodName: 'tools/call',
                 toolName,

package/dist/src/ee/mcp/sdk/mcp-sdk-server.factory.d.ts

@@ -1,4 +1,4 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpServer } from '@modelcontextprotocol/server';
 import type { McpAuthContext } from '../auth/mcp-auth-context';
 import { McpConfigService } from '../config/mcp.config';
 import { McpCallInstrumentation } from '../observability/mcp-call-instrumentation';

package/dist/src/ee/mcp/sdk/mcp-sdk-server.factory.js

@@ -11,7 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpSdkServerFactory = void 0;
 const common_1 = require("@nestjs/common");
-const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
+const server_1 = require("@modelcontextprotocol/server");
 const mcp_config_1 = require("../config/mcp.config");
 const mcp_call_instrumentation_1 = require("../observability/mcp-call-instrumentation");
 const mcp_tool_registry_1 = require("../tools/mcp-tool.registry");
@@ -30,13 +30,13 @@ let McpSdkServerFactory = class McpSdkServerFactory {
             version: this.config.serverVersion,
         };
         const server = instructions
-            ? new mcp_js_1.McpServer(serverInfo, { instructions })
-            : new mcp_js_1.McpServer(serverInfo);
+            ? new server_1.McpServer(serverInfo, { instructions })
+            : new server_1.McpServer(serverInfo);
         const sdkToolRegistrar = server;
         for (const tool of this.toolRegistry.getTools()) {
-            const wrapped = this.instrumentation.wrap(tool.name, async (input, extra) => {
+            const wrapped = this.instrumentation.wrap(tool.name, async (input, ctx) => {
                 this.assertScopes(mcpContext, tool.requiredScopes);
-                return tool.handler(input, mcpContext, extra?.signal);
+                return tool.handler(input, mcpContext, ctx?.mcpReq?.signal);
             });
             sdkToolRegistrar.registerTool(tool.name, {
                 description: tool.description,

package/dist/src/ee/mcp/tools/add-destination.tool.d.ts

@@ -1,22 +1,21 @@
-import { z } from 'zod';
+import { z } from 'zod-v4';
 import type { McpScope } from '@owox/idp-protocol';
 import { PublicOriginService } from '../../../common/config/public-origin.service';
 import { type McpDataDestinationsFacade } from '../../../data-marts/facades/mcp-data-destinations.facade';
 import type { McpAuthContext } from '../auth/mcp-auth-context';
 import { type McpToolDefinition, type McpToolResult } from './mcp-tool.definition';
 declare const inputSchema: z.ZodObject<{
-    destination_type: z.ZodEnum<["google_sheets", "looker_studio", "email", "slack", "teams", "google_chat"]>;
+    destination_type: z.ZodEnum<{
+        email: "email";
+        looker_studio: "looker_studio";
+        google_sheets: "google_sheets";
+        slack: "slack";
+        teams: "teams";
+        google_chat: "google_chat";
+    }>;
     title: z.ZodOptional<z.ZodString>;
-    emails: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "strict", z.ZodTypeAny, {
-    destination_type: "email" | "looker_studio" | "google_sheets" | "slack" | "teams" | "google_chat";
-    title?: string | undefined;
-    emails?: string[] | undefined;
-}, {
-    destination_type: "email" | "looker_studio" | "google_sheets" | "slack" | "teams" | "google_chat";
-    title?: string | undefined;
-    emails?: string[] | undefined;
-}>;
+    emails: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 type AddDestinationInput = z.infer<typeof inputSchema>;
 export declare class AddDestinationTool implements McpToolDefinition<AddDestinationInput> {
     private readonly destinations;
@@ -24,9 +23,16 @@ export declare class AddDestinationTool implements McpToolDefinition<AddDestinat
     readonly name = "add_destination";
     readonly description: string;
     readonly zodSchema: {
-        destination_type: z.ZodEnum<["google_sheets", "looker_studio", "email", "slack", "teams", "google_chat"]>;
+        destination_type: z.ZodEnum<{
+            email: "email";
+            looker_studio: "looker_studio";
+            google_sheets: "google_sheets";
+            slack: "slack";
+            teams: "teams";
+            google_chat: "google_chat";
+        }>;
         title: z.ZodOptional<z.ZodString>;
-        emails: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        emails: z.ZodOptional<z.ZodArray<z.ZodString>>;
     };
     readonly outputSchema: {
         authorization_url: z.ZodOptional<z.ZodString>;