@owox/backend 0.35.0 → 0.36.0

package/dist/src/index.d.ts

@@ -5,4 +5,5 @@ export { applyDump } from './dump/apply-dump';
 export { runMigrations, revertMigration, getMigrationStatus } from './config/migrations.config';
 export { createHealthProbe, type HealthProbeAware } from './health/health-probe';
 export { GracefulShutdownService } from './common/scheduler/services/graceful-shutdown.service';
+export { McpHttpEntryService } from './ee/mcp/transport/mcp-http-entry.service';
 export { registerPluginCollectionsBodyParser } from './config/plugin-collections-body-parser.config';

package/dist/src/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerPluginCollectionsBodyParser = exports.GracefulShutdownService = exports.createHealthProbe = exports.getMigrationStatus = exports.revertMigration = exports.runMigrations = exports.applyDump = exports.dumpInserts = exports.bootstrap = void 0;
+exports.registerPluginCollectionsBodyParser = exports.McpHttpEntryService = exports.GracefulShutdownService = exports.createHealthProbe = exports.getMigrationStatus = exports.revertMigration = exports.runMigrations = exports.applyDump = exports.dumpInserts = exports.bootstrap = void 0;
 var bootstrap_1 = require("./bootstrap");
 Object.defineProperty(exports, "bootstrap", { enumerable: true, get: function () { return bootstrap_1.bootstrap; } });
 var create_dump_1 = require("./dump/create-dump");
@@ -15,6 +15,8 @@ var health_probe_1 = require("./health/health-probe");
 Object.defineProperty(exports, "createHealthProbe", { enumerable: true, get: function () { return health_probe_1.createHealthProbe; } });
 var graceful_shutdown_service_1 = require("./common/scheduler/services/graceful-shutdown.service");
 Object.defineProperty(exports, "GracefulShutdownService", { enumerable: true, get: function () { return graceful_shutdown_service_1.GracefulShutdownService; } });
+var mcp_http_entry_service_1 = require("./ee/mcp/transport/mcp-http-entry.service");
+Object.defineProperty(exports, "McpHttpEntryService", { enumerable: true, get: function () { return mcp_http_entry_service_1.McpHttpEntryService; } });
 var plugin_collections_body_parser_config_1 = require("./config/plugin-collections-body-parser.config");
 Object.defineProperty(exports, "registerPluginCollectionsBodyParser", { enumerable: true, get: function () { return plugin_collections_body_parser_config_1.registerPluginCollectionsBodyParser; } });
 //# sourceMappingURL=index.js.map

package/dist/src/migrations/1788048000000-create-connector-definition-tables.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class CreateConnectorDefinitionTables1788048000000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1788048000000-create-connector-definition-tables.js

@@ -0,0 +1,116 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateConnectorDefinitionTables1788048000000 = void 0;
+const typeorm_1 = require("typeorm");
+const migration_utils_1 = require("./migration-utils");
+const CONNECTOR_DEFINITION = 'connector_definition';
+const CONNECTOR_DEFINITION_VERSION = 'connector_definition_version';
+const CONNECTOR_DEFINITION_INDICES = [
+    'IDX_connector_definition_projectId',
+    'IDX_connector_definition_projectId_name',
+];
+const CONNECTOR_DEFINITION_VERSION_INDICES = [
+    'IDX_connector_definition_version_definitionId',
+    'IDX_connector_definition_version_definitionId_version',
+];
+class CreateConnectorDefinitionTables1788048000000 {
+    name = 'CreateConnectorDefinitionTables1788048000000';
+    async up(queryRunner) {
+        if (!(await queryRunner.hasTable(CONNECTOR_DEFINITION))) {
+            await queryRunner.createTable(new typeorm_1.Table({
+                name: CONNECTOR_DEFINITION,
+                columns: [
+                    { name: 'id', type: 'varchar', isPrimary: true },
+                    { name: 'projectId', type: 'varchar', isNullable: false },
+                    { name: 'name', type: 'varchar', isNullable: false },
+                    { name: 'title', type: 'varchar', isNullable: false },
+                    { name: 'description', type: 'text', isNullable: true, default: null },
+                    { name: 'logo', type: 'text', isNullable: true, default: null },
+                    { name: 'docUrl', type: 'varchar', isNullable: true, default: null },
+                    { name: 'activeVersionId', type: 'varchar', isNullable: true, default: null },
+                    { name: 'createdById', type: 'varchar', isNullable: true, default: null },
+                    { name: 'createdAt', type: 'datetime', default: 'CURRENT_TIMESTAMP' },
+                    { name: 'modifiedAt', type: 'datetime', default: 'CURRENT_TIMESTAMP' },
+                    { name: 'deletedAt', type: 'datetime', isNullable: true, default: null },
+                ],
+            }));
+        }
+        await createIndexIfMissing(queryRunner, CONNECTOR_DEFINITION, new typeorm_1.TableIndex({
+            name: 'IDX_connector_definition_projectId',
+            columnNames: ['projectId'],
+        }));
+        await createIndexIfMissing(queryRunner, CONNECTOR_DEFINITION, new typeorm_1.TableIndex({
+            name: 'IDX_connector_definition_projectId_name',
+            columnNames: ['projectId', 'name'],
+            isUnique: true,
+        }));
+        if (!(await queryRunner.hasTable(CONNECTOR_DEFINITION_VERSION))) {
+            await queryRunner.createTable(new typeorm_1.Table({
+                name: CONNECTOR_DEFINITION_VERSION,
+                columns: [
+                    { name: 'id', type: 'varchar', isPrimary: true },
+                    { name: 'connectorDefinitionId', type: 'varchar', isNullable: false },
+                    { name: 'version', type: 'integer', isNullable: false },
+                    { name: 'manifest', type: 'json', isNullable: false },
+                    { name: 'status', type: 'varchar', default: "'draft'" },
+                    { name: 'createdById', type: 'varchar', isNullable: true, default: null },
+                    { name: 'createdAt', type: 'datetime', default: 'CURRENT_TIMESTAMP' },
+                    { name: 'publishedAt', type: 'datetime', isNullable: true, default: null },
+                ],
+            }));
+        }
+        await createIndexIfMissing(queryRunner, CONNECTOR_DEFINITION_VERSION, new typeorm_1.TableIndex({
+            name: 'IDX_connector_definition_version_definitionId',
+            columnNames: ['connectorDefinitionId'],
+        }));
+        await createIndexIfMissing(queryRunner, CONNECTOR_DEFINITION_VERSION, new typeorm_1.TableIndex({
+            name: 'IDX_connector_definition_version_definitionId_version',
+            columnNames: ['connectorDefinitionId', 'version'],
+            isUnique: true,
+        }));
+        await createForeignKeyIfMissing(queryRunner, CONNECTOR_DEFINITION_VERSION, new typeorm_1.TableForeignKey({
+            columnNames: ['connectorDefinitionId'],
+            referencedTableName: CONNECTOR_DEFINITION,
+            referencedColumnNames: ['id'],
+            onDelete: 'NO ACTION',
+            onUpdate: 'NO ACTION',
+        }));
+    }
+    async down(queryRunner) {
+        await softDropTableWithIndices(queryRunner, CONNECTOR_DEFINITION_VERSION, CONNECTOR_DEFINITION_VERSION_INDICES);
+        await softDropTableWithIndices(queryRunner, CONNECTOR_DEFINITION, CONNECTOR_DEFINITION_INDICES);
+    }
+}
+exports.CreateConnectorDefinitionTables1788048000000 = CreateConnectorDefinitionTables1788048000000;
+async function createIndexIfMissing(queryRunner, table, index) {
+    const loadedTable = await queryRunner.getTable(table);
+    if ((loadedTable?.indices ?? []).some(existing => existing.name === index.name)) {
+        return;
+    }
+    await queryRunner.createIndex(loadedTable ?? table, index);
+}
+async function createForeignKeyIfMissing(queryRunner, table, foreignKey) {
+    const loadedTable = await queryRunner.getTable(table);
+    const columns = foreignKey.columnNames.join(',');
+    const alreadyConstrained = (loadedTable?.foreignKeys ?? []).some(existing => existing.columnNames.join(',') === columns);
+    if (alreadyConstrained) {
+        return;
+    }
+    await queryRunner.createForeignKey(loadedTable ?? table, foreignKey);
+}
+async function softDropTableWithIndices(queryRunner, table, indices) {
+    if (!(await queryRunner.hasTable(table))) {
+        return;
+    }
+    const loadedTable = await queryRunner.getTable(table);
+    const ownForeignKeys = [...(loadedTable?.foreignKeys ?? [])];
+    const ownIndices = (loadedTable?.indices ?? []).filter(index => index.name && indices.includes(index.name));
+    for (const foreignKey of ownForeignKeys) {
+        await queryRunner.dropForeignKey(loadedTable ?? table, foreignKey);
+    }
+    for (const index of ownIndices) {
+        await queryRunner.dropIndex(loadedTable ?? table, index);
+    }
+    await (0, migration_utils_1.softDropTable)(queryRunner, table);
+}
+//# sourceMappingURL=1788048000000-create-connector-definition-tables.js.map

package/dist/src/migrations/1790156789783-add-auto-aggregation-opt-out-to-report.d.ts

@@ -0,0 +1,8 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddAutoAggregationOptOutToReport1790156789783 implements MigrationInterface {
+    readonly name = "AddAutoAggregationOptOutToReport1790156789783";
+    private readonly TABLE;
+    private readonly COLUMN;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790156789783-add-auto-aggregation-opt-out-to-report.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddAutoAggregationOptOutToReport1790156789783 = void 0;
+const typeorm_1 = require("typeorm");
+const migration_utils_1 = require("./migration-utils");
+class AddAutoAggregationOptOutToReport1790156789783 {
+    name = 'AddAutoAggregationOptOutToReport1790156789783';
+    TABLE = 'report';
+    COLUMN = new typeorm_1.TableColumn({
+        name: 'autoAggregationOptOut',
+        type: 'json',
+        isNullable: true,
+    });
+    async up(queryRunner) {
+        const table = await (0, migration_utils_1.getTable)(queryRunner, this.TABLE);
+        const exists = table.columns.some(c => c.name === this.COLUMN.name);
+        if (!exists) {
+            await queryRunner.addColumn(table, this.COLUMN);
+        }
+    }
+    async down(queryRunner) {
+        const table = await (0, migration_utils_1.getTable)(queryRunner, this.TABLE);
+        const exists = table.columns.some(c => c.name === this.COLUMN.name);
+        if (exists) {
+            await queryRunner.dropColumn(table, this.COLUMN.name);
+        }
+    }
+}
+exports.AddAutoAggregationOptOutToReport1790156789783 = AddAutoAggregationOptOutToReport1790156789783;
+//# sourceMappingURL=1790156789783-add-auto-aggregation-opt-out-to-report.js.map

package/dist/src/migrations/1790247861000-add-icon-to-data-mart.d.ts

@@ -0,0 +1,8 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class AddIconToDataMart1790247861000 implements MigrationInterface {
+    readonly name = "AddIconToDataMart1790247861000";
+    private readonly TABLE;
+    private readonly COLUMN;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}

package/dist/src/migrations/1790247861000-add-icon-to-data-mart.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddIconToDataMart1790247861000 = void 0;
+const typeorm_1 = require("typeorm");
+const migration_utils_1 = require("./migration-utils");
+class AddIconToDataMart1790247861000 {
+    name = 'AddIconToDataMart1790247861000';
+    TABLE = 'data_mart';
+    COLUMN = new typeorm_1.TableColumn({
+        name: 'icon',
+        type: 'varchar',
+        length: '64',
+        isNullable: true,
+    });
+    async up(queryRunner) {
+        const table = await (0, migration_utils_1.getTable)(queryRunner, this.TABLE);
+        const exists = table.columns.some(c => c.name === this.COLUMN.name);
+        if (!exists) {
+            await queryRunner.addColumn(table, this.COLUMN);
+        }
+    }
+    async down(queryRunner) {
+        const table = await (0, migration_utils_1.getTable)(queryRunner, this.TABLE);
+        const exists = table.columns.some(c => c.name === this.COLUMN.name);
+        if (exists) {
+            await queryRunner.dropColumn(table, this.COLUMN.name);
+        }
+    }
+}
+exports.AddIconToDataMart1790247861000 = AddIconToDataMart1790247861000;
+//# sourceMappingURL=1790247861000-add-icon-to-data-mart.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owox/backend",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "OWOX Data Marts Backend - Full-stack data orchestration platform",
   "author": "OWOX",
   "license": "ELv2",
@@ -78,7 +78,8 @@
     "@google-cloud/pubsub": "^4.0.7",
     "@google-cloud/storage": "^7.21.0",
     "@huggingface/transformers": "^3.0.0",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "@nestjs/common": "^11.0.1",
     "@nestjs/config": "^4.0.2",
     "@nestjs/core": "^11.1.2",
@@ -91,9 +92,9 @@
     "@opentelemetry/exporter-trace-otlp-http": "^0.220.0",
     "@opentelemetry/sdk-trace-base": "^2.9.0",
     "@opentelemetry/sdk-trace-node": "^2.9.0",
-    "@owox/connectors": "0.35.0",
-    "@owox/idp-protocol": "0.35.0",
-    "@owox/internal-helpers": "0.35.0",
+    "@owox/connectors": "0.36.0",
+    "@owox/idp-protocol": "0.36.0",
+    "@owox/internal-helpers": "0.36.0",
     "better-sqlite3": "^12.2.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.2",
@@ -102,6 +103,7 @@
     "env-paths": "^3.0.0",
     "googleapis": "^150.0.1",
     "handlebars": "^4.7.9",
+    "hono": "^4.11.4",
     "ipaddr.js": "^1.9.1",
     "jsonwebtoken": "^9.0.0",
     "juice": "^11.0.3",
@@ -123,12 +125,14 @@
     "typeorm-transactional": "^0.5.0",
     "undici": "^6.27.0",
     "zod": "^3.25.64",
-    "zod-to-json-schema": "^3.25.0"
+    "zod-to-json-schema": "^3.25.0",
+    "zod-v4": "npm:zod@^4.6.5"
   },
   "peerDependencies": {
     "express": "^5"
   },
   "devDependencies": {
+    "@modelcontextprotocol/client": "^2.0.0",
     "@nestjs/cli": "^11.0.9",
     "@nestjs/schematics": "^11.0.0",
     "@nestjs/testing": "^11.1.2",

package/dist/src/ee/mcp/auth/mcp-auth.exception-filter.d.ts

@@ -1,14 +0,0 @@
-import { ArgumentsHost, ExceptionFilter, UnauthorizedException } from '@nestjs/common';
-import { McpResourceResolverService } from '../../../mcp-resource/mcp-resource-resolver.service';
-import { McpConfigService } from '../config/mcp.config';
-export declare class McpAuthExceptionFilter implements ExceptionFilter {
-    private readonly config;
-    private readonly resourceResolver;
-    private readonly logger;
-    constructor(config: McpConfigService, resourceResolver: McpResourceResolverService);
-    catch(exception: UnauthorizedException, host: ArgumentsHost): void;
-    private getRequestedSessionId;
-    private getChallengeHeader;
-    private isExpectedAnonymousProbe;
-    private getMessage;
-}

package/dist/src/ee/mcp/auth/mcp-auth.exception-filter.js

@@ -1,84 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var McpAuthExceptionFilter_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpAuthExceptionFilter = void 0;
-const common_1 = require("@nestjs/common");
-const mcp_resource_resolver_service_1 = require("../../../mcp-resource/mcp-resource-resolver.service");
-const mcp_config_1 = require("../config/mcp.config");
-let McpAuthExceptionFilter = McpAuthExceptionFilter_1 = class McpAuthExceptionFilter {
-    config;
-    resourceResolver;
-    logger = new common_1.Logger(McpAuthExceptionFilter_1.name);
-    constructor(config, resourceResolver) {
-        this.config = config;
-        this.resourceResolver = resourceResolver;
-    }
-    catch(exception, host) {
-        const http = host.switchToHttp();
-        const request = typeof http.getRequest === 'function' ? http.getRequest() : undefined;
-        const response = http.getResponse();
-        const message = this.getMessage(exception);
-        const metadata = {
-            method: request?.method,
-            url: request?.originalUrl ?? request?.url,
-            requestSessionId: this.getRequestedSessionId(request),
-            accept: request?.headers?.accept,
-            contentType: request?.headers?.['content-type'],
-            hasAuthorization: Boolean(request?.headers?.authorization),
-            message,
-        };
-        if (this.isExpectedAnonymousProbe(request, message)) {
-            this.logger.log('MCP auth rejected', metadata);
-        }
-        else {
-            this.logger.warn('MCP auth rejected', metadata);
-        }
-        response.setHeader('WWW-Authenticate', this.getChallengeHeader(request));
-        response.status(401).json({
-            statusCode: 401,
-            message,
-            error: 'Unauthorized',
-        });
-    }
-    getRequestedSessionId(request) {
-        const header = request?.headers?.['mcp-session-id'];
-        return Array.isArray(header) ? header[0] : header;
-    }
-    getChallengeHeader(request) {
-        const resourceContext = request ? this.resourceResolver.tryResolveRequest(request) : null;
-        const metadataUrl = resourceContext
-            ? `${resourceContext.publicBaseUrl}/.well-known/oauth-protected-resource`
-            : this.config.protectedResourceMetadataUrl;
-        return `Bearer resource_metadata="${metadataUrl}", scope="${this.config.scopes.join(' ')}"`;
-    }
-    isExpectedAnonymousProbe(request, message) {
-        return (request?.method === 'GET' &&
-            (request.originalUrl ?? request.url) === '/mcp' &&
-            !request.headers?.authorization &&
-            message === 'Missing MCP bearer token');
-    }
-    getMessage(exception) {
-        const response = exception.getResponse();
-        if (typeof response === 'object' && response !== null && 'message' in response) {
-            const message = response.message;
-            return Array.isArray(message) ? message.join(', ') : String(message);
-        }
-        return exception.message;
-    }
-};
-exports.McpAuthExceptionFilter = McpAuthExceptionFilter;
-exports.McpAuthExceptionFilter = McpAuthExceptionFilter = McpAuthExceptionFilter_1 = __decorate([
-    (0, common_1.Catch)(common_1.UnauthorizedException),
-    __metadata("design:paramtypes", [mcp_config_1.McpConfigService,
-        mcp_resource_resolver_service_1.McpResourceResolverService])
-], McpAuthExceptionFilter);
-//# sourceMappingURL=mcp-auth.exception-filter.js.map

package/dist/src/ee/mcp/auth/mcp-auth.guard.d.ts

@@ -1,14 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { McpResourceResolverService } from '../../../mcp-resource/mcp-resource-resolver.service';
-import { type McpAuthPort } from './mcp-auth.port';
-export declare class McpAuthGuard implements CanActivate {
-    private readonly auth;
-    private readonly resourceResolver;
-    private readonly logger;
-    private readonly requiredScopes;
-    constructor(auth: McpAuthPort, resourceResolver: McpResourceResolverService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractBearerToken;
-    private getRequestedSessionId;
-    private assertPayload;
-}

package/dist/src/ee/mcp/auth/mcp-auth.guard.js

@@ -1,99 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var McpAuthGuard_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpAuthGuard = void 0;
-const common_1 = require("@nestjs/common");
-const mcp_resource_resolver_service_1 = require("../../../mcp-resource/mcp-resource-resolver.service");
-const mcp_auth_port_1 = require("./mcp-auth.port");
-let McpAuthGuard = McpAuthGuard_1 = class McpAuthGuard {
-    auth;
-    resourceResolver;
-    logger = new common_1.Logger(McpAuthGuard_1.name);
-    requiredScopes = ['mcp:read'];
-    constructor(auth, resourceResolver) {
-        this.auth = auth;
-        this.resourceResolver = resourceResolver;
-    }
-    async canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        const token = this.extractBearerToken(request);
-        const resourceContext = this.resourceResolver.tryResolveRequest(request);
-        if (!resourceContext) {
-            throw new common_1.UnauthorizedException('Invalid MCP resource');
-        }
-        const payload = await this.auth.verifyToken(token, resourceContext.resource, this.requiredScopes);
-        if (!payload) {
-            throw new common_1.UnauthorizedException('Invalid MCP bearer token');
-        }
-        this.assertPayload(payload, resourceContext);
-        this.logger.debug('MCP auth accepted', {
-            method: request.method,
-            url: request.originalUrl ?? request.url,
-            requestSessionId: this.getRequestedSessionId(request),
-            projectId: payload.projectId,
-            clientId: payload.clientId,
-            resource: payload.resource,
-            scopes: payload.scopes,
-            roles: payload.roles,
-        });
-        request.mcpContext = payload;
-        return true;
-    }
-    extractBearerToken(request) {
-        const authorization = request.headers.authorization;
-        const value = Array.isArray(authorization) ? authorization[0] : authorization;
-        if (!value?.startsWith('Bearer ')) {
-            throw new common_1.UnauthorizedException('Missing MCP bearer token');
-        }
-        const token = value.slice('Bearer '.length).trim();
-        if (!token) {
-            throw new common_1.UnauthorizedException('Missing MCP bearer token');
-        }
-        return token;
-    }
-    getRequestedSessionId(request) {
-        const header = request.headers?.['mcp-session-id'];
-        return Array.isArray(header) ? header[0] : header;
-    }
-    assertPayload(payload, resourceContext) {
-        if (payload.authFlow !== 'mcp') {
-            throw new common_1.UnauthorizedException('Invalid MCP auth flow');
-        }
-        if (payload.resource !== resourceContext.resource) {
-            throw new common_1.UnauthorizedException('Invalid MCP resource');
-        }
-        if (resourceContext.kind === 'project' && payload.projectId !== resourceContext.projectId) {
-            throw new common_1.UnauthorizedException('Invalid MCP project context');
-        }
-        if (!payload.projectId) {
-            throw new common_1.UnauthorizedException('Missing MCP project context');
-        }
-        if (!payload.roles.length) {
-            throw new common_1.UnauthorizedException('Missing MCP project roles');
-        }
-        for (const scope of this.requiredScopes) {
-            if (!payload.scopes.includes(scope)) {
-                throw new common_1.UnauthorizedException('Missing MCP scope');
-            }
-        }
-    }
-};
-exports.McpAuthGuard = McpAuthGuard;
-exports.McpAuthGuard = McpAuthGuard = McpAuthGuard_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)(mcp_auth_port_1.MCP_AUTH_PORT)),
-    __metadata("design:paramtypes", [Object, mcp_resource_resolver_service_1.McpResourceResolverService])
-], McpAuthGuard);
-//# sourceMappingURL=mcp-auth.guard.js.map

package/dist/src/ee/mcp/controllers/mcp-transport.controller.d.ts

@@ -1,17 +0,0 @@
-import type { Response } from 'express';
-import { ClsContextService } from '../../../common/logger/cls-context.service';
-import type { McpAuthenticatedRequest } from '../auth/mcp-auth-context';
-import { McpStreamableHttpTransportHandler } from '../sdk/mcp-streamable-http-transport.handler';
-export declare const MCP_REQUEST_SOCKET_TIMEOUT_MS: number;
-export declare class McpTransportController {
-    private readonly transportHandler;
-    private readonly clsContextService;
-    private readonly logger;
-    constructor(transportHandler: McpStreamableHttpTransportHandler, clsContextService: ClsContextService);
-    handleMcp(request: McpAuthenticatedRequest, response: Response, body: unknown): Promise<void>;
-    private firstHeader;
-    private getRequestedSessionId;
-    private isExpectedStandaloneSseRejection;
-    private getJsonRpcSummary;
-    private toLoggableJsonRpcId;
-}

package/dist/src/ee/mcp/controllers/mcp-transport.controller.js

@@ -1,134 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var McpTransportController_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpTransportController = exports.MCP_REQUEST_SOCKET_TIMEOUT_MS = void 0;
-const common_1 = require("@nestjs/common");
-const node_crypto_1 = require("node:crypto");
-const cls_context_service_1 = require("../../../common/logger/cls-context.service");
-const mcp_auth_exception_filter_1 = require("../auth/mcp-auth.exception-filter");
-const mcp_auth_guard_1 = require("../auth/mcp-auth.guard");
-const mcp_log_context_1 = require("../observability/mcp-log-context");
-const mcp_streamable_http_transport_handler_1 = require("../sdk/mcp-streamable-http-transport.handler");
-exports.MCP_REQUEST_SOCKET_TIMEOUT_MS = 4 * 60_000;
-let McpTransportController = McpTransportController_1 = class McpTransportController {
-    transportHandler;
-    clsContextService;
-    logger = new common_1.Logger(McpTransportController_1.name);
-    constructor(transportHandler, clsContextService) {
-        this.transportHandler = transportHandler;
-        this.clsContextService = clsContextService;
-    }
-    async handleMcp(request, response, body) {
-        if (typeof request.setTimeout === 'function') {
-            request.setTimeout(exports.MCP_REQUEST_SOCKET_TIMEOUT_MS);
-        }
-        const requestId = (0, node_crypto_1.randomUUID)();
-        const requestSessionId = this.getRequestedSessionId(request);
-        await this.clsContextService.runWithContext(mcp_log_context_1.MCP_LOG_CONTEXT_KEY, {
-            projectId: request.mcpContext.projectId,
-            userId: request.mcpContext.userId,
-            clientId: request.mcpContext.clientId,
-            sessionId: requestSessionId,
-            requestId,
-            protocolVersion: this.firstHeader(request, 'mcp-protocol-version'),
-            userAgent: this.firstHeader(request, 'user-agent'),
-            clientVendor: this.firstHeader(request, 'x-anthropic-client'),
-            traceparent: this.firstHeader(request, 'traceparent'),
-        }, async () => {
-            const startedAt = Date.now();
-            const rpc = this.getJsonRpcSummary(body);
-            this.logger.debug('MCP request received', {
-                method: request.method,
-                url: request.originalUrl ?? request.url,
-                requestSessionId,
-                accept: request.headers?.accept,
-                contentType: request.headers?.['content-type'],
-                rpc,
-                projectId: request.mcpContext.projectId,
-                clientId: request.mcpContext.clientId,
-            });
-            if (typeof response.once === 'function') {
-                response.once('finish', () => {
-                    const metadata = {
-                        statusCode: response.statusCode,
-                        durationMs: Date.now() - startedAt,
-                        contentType: response.getHeader('content-type'),
-                        requestSessionId,
-                        responseSessionId: response.getHeader('mcp-session-id'),
-                        rpc,
-                        projectId: request.mcpContext.projectId,
-                        userId: request.mcpContext.userId,
-                        clientId: request.mcpContext.clientId,
-                        requestId,
-                    };
-                    if (response.statusCode >= 400 &&
-                        !this.isExpectedStandaloneSseRejection(request, response)) {
-                        this.logger.warn('MCP response finished with error status', metadata);
-                        return;
-                    }
-                    this.logger.debug('MCP response finished', metadata);
-                });
-            }
-            await this.transportHandler.handleRequest(request, response, body, request.mcpContext);
-        });
-    }
-    firstHeader(request, name) {
-        const header = request.headers?.[name];
-        return Array.isArray(header) ? header[0] : header;
-    }
-    getRequestedSessionId(request) {
-        return this.firstHeader(request, 'mcp-session-id');
-    }
-    isExpectedStandaloneSseRejection(request, response) {
-        return request.method === 'GET' && response.statusCode === 405;
-    }
-    getJsonRpcSummary(body) {
-        if (Array.isArray(body)) {
-            return body.map(item => this.getJsonRpcSummary(item));
-        }
-        if (!body || typeof body !== 'object') {
-            return typeof body;
-        }
-        const message = body;
-        return {
-            id: this.toLoggableJsonRpcId(message.id),
-            method: typeof message.method === 'string' ? message.method : undefined,
-        };
-    }
-    toLoggableJsonRpcId(id) {
-        if (typeof id === 'string' || typeof id === 'number' || id === null || id === undefined) {
-            return id;
-        }
-        return '<non-scalar>';
-    }
-};
-exports.McpTransportController = McpTransportController;
-__decorate([
-    (0, common_1.All)('/mcp'),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)()),
-    __param(2, (0, common_1.Body)()),
-    __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object, Object, Object]),
-    __metadata("design:returntype", Promise)
-], McpTransportController.prototype, "handleMcp", null);
-exports.McpTransportController = McpTransportController = McpTransportController_1 = __decorate([
-    (0, common_1.Controller)(),
-    (0, common_1.UseGuards)(mcp_auth_guard_1.McpAuthGuard),
-    (0, common_1.UseFilters)(mcp_auth_exception_filter_1.McpAuthExceptionFilter),
-    __metadata("design:paramtypes", [mcp_streamable_http_transport_handler_1.McpStreamableHttpTransportHandler,
-        cls_context_service_1.ClsContextService])
-], McpTransportController);
-//# sourceMappingURL=mcp-transport.controller.js.map