@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/dist/authz/mcp-oauth.module.d.ts

@@ -1,12 +0,0 @@
-import { DynamicModule } from '@nestjs/common';
-import type { OAuthUserModuleOptions as AuthUserModuleOptions, OAuthModuleDefaults } from './providers/oauth-provider.interface';
-export declare const DEFAULT_OPTIONS: OAuthModuleDefaults;
-export declare class McpAuthModule {
-    readonly __isMcpAuthModule = true;
-    static forRoot(options: AuthUserModuleOptions): DynamicModule;
-    private static mergeAndValidateOptions;
-    private static validateRequiredOptions;
-    private static validateResolvedOptions;
-    private static createStoreProvider;
-}
-//# sourceMappingURL=mcp-oauth.module.d.ts.map

package/dist/authz/mcp-oauth.module.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-oauth.module.d.ts","sourceRoot":"","sources":["../../src/authz/mcp-oauth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAMvD,OAAO,KAAK,EACV,sBAAsB,IAAI,qBAAqB,EAE/C,mBAAmB,EAEpB,MAAM,sCAAsC,CAAC;AAW9C,eAAO,MAAM,eAAe,EAAE,mBA4C7B,CAAC;AAEF,qBACa,aAAa;IAIxB,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,GAAG,aAAa;IA4J7D,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAkDtC,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAiBtC,OAAO,CAAC,MAAM,CAAC,uBAAuB;IA0BtC,OAAO,CAAC,MAAM,CAAC,mBAAmB;CAoCnC"}

package/dist/authz/mcp-oauth.module.js

@@ -1,271 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var McpAuthModule_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpAuthModule = exports.DEFAULT_OPTIONS = void 0;
-const common_1 = require("@nestjs/common");
-const config_1 = require("@nestjs/config");
-const jwt_1 = require("@nestjs/jwt");
-const passport_1 = require("@nestjs/passport");
-const jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
-const mcp_oauth_controller_1 = require("./mcp-oauth.controller");
-const client_service_1 = require("./services/client.service");
-const jwt_token_service_1 = require("./services/jwt-token.service");
-const oauth_strategy_service_1 = require("./services/oauth-strategy.service");
-const memory_store_service_1 = require("./stores/memory-store.service");
-const normalize_endpoint_1 = require("../mcp/utils/normalize-endpoint");
-const constants_1 = require("./stores/typeorm/constants");
-let authInstanceIdCounter = 0;
-exports.DEFAULT_OPTIONS = {
-    serverUrl: 'http://localhost:3000',
-    resource: 'http://localhost:3000/mcp',
-    jwtIssuer: 'http://localhost:3000',
-    jwtAudience: 'mcp-client',
-    jwtAccessTokenExpiresIn: '1d',
-    jwtRefreshTokenExpiresIn: '30d',
-    enableRefreshTokens: true,
-    cookieMaxAge: 24 * 60 * 60 * 1000,
-    oauthSessionExpiresIn: 10 * 60 * 1000,
-    authCodeExpiresIn: 10 * 60 * 1000,
-    nodeEnv: 'development',
-    apiPrefix: '',
-    endpoints: {
-        wellKnownAuthorizationServerMetadata: '/.well-known/oauth-authorization-server',
-        wellKnownProtectedResourceMetadata: '/.well-known/oauth-protected-resource',
-        register: '/register',
-        authorize: '/authorize',
-        callback: '/callback',
-        token: '/token',
-        revoke: '/revoke',
-    },
-    disableEndpoints: {
-        wellKnownAuthorizationServerMetadata: false,
-        wellKnownProtectedResourceMetadata: false,
-    },
-    protectedResourceMetadata: {
-        scopesSupported: ['offline_access'],
-        bearerMethodsSupported: ['header'],
-        mcpVersionsSupported: ['2025-06-18'],
-    },
-    authorizationServerMetadata: {
-        responseTypesSupported: ['code'],
-        responseModesSupported: ['query'],
-        grantTypesSupported: ['authorization_code', 'refresh_token'],
-        tokenEndpointAuthMethodsSupported: [
-            'client_secret_basic',
-            'client_secret_post',
-            'none',
-        ],
-        scopesSupported: ['offline_access'],
-        codeChallengeMethodsSupported: ['plain', 'S256'],
-    },
-};
-let McpAuthModule = McpAuthModule_1 = class McpAuthModule {
-    constructor() {
-        this.__isMcpAuthModule = true;
-    }
-    static forRoot(options) {
-        const authModuleId = `mcp-auth-module-${authInstanceIdCounter++}`;
-        const resolvedOptions = this.mergeAndValidateOptions(exports.DEFAULT_OPTIONS, options);
-        resolvedOptions.endpoints = prepareEndpoints(resolvedOptions.apiPrefix, exports.DEFAULT_OPTIONS.endpoints, options.endpoints || {});
-        const oauthModuleOptionsToken = `OAUTH_MODULE_OPTIONS_${authModuleId}`;
-        const oauthModuleOptions = {
-            provide: oauthModuleOptionsToken,
-            useValue: resolvedOptions,
-        };
-        const imports = [
-            config_1.ConfigModule,
-            passport_1.PassportModule.register({
-                defaultStrategy: 'jwt',
-                session: false,
-            }),
-            jwt_1.JwtModule.register({
-                secret: resolvedOptions.jwtSecret,
-                signOptions: {
-                    issuer: resolvedOptions.jwtIssuer,
-                    audience: resolvedOptions.jwtAudience,
-                },
-            }),
-        ];
-        const storeConfig = resolvedOptions.storeConfiguration;
-        const isTypeOrmStore = storeConfig?.type === 'typeorm';
-        if (isTypeOrmStore) {
-            const typeormOptions = storeConfig.options;
-            try {
-                const { TypeOrmModule } = require('@nestjs/typeorm');
-                const { OAuthClientEntity, AuthorizationCodeEntity, OAuthSessionEntity, OAuthUserProfileEntity, } = require('./stores/typeorm/entities');
-                imports.push(TypeOrmModule.forRoot({
-                    ...typeormOptions,
-                    name: constants_1.OAUTH_TYPEORM_CONNECTION_NAME,
-                    entities: [
-                        OAuthClientEntity,
-                        AuthorizationCodeEntity,
-                        OAuthSessionEntity,
-                        OAuthUserProfileEntity,
-                    ],
-                }), TypeOrmModule.forFeature([
-                    OAuthClientEntity,
-                    AuthorizationCodeEntity,
-                    OAuthSessionEntity,
-                    OAuthUserProfileEntity,
-                ], constants_1.OAUTH_TYPEORM_CONNECTION_NAME));
-            }
-            catch (err) {
-                throw new Error("To use the TypeORM store, please install '@nestjs/typeorm' and 'typeorm'.");
-            }
-        }
-        const oauthStoreToken = `IOAuthStore_${authModuleId}`;
-        const oauthStoreProvider = this.createStoreProvider(resolvedOptions.storeConfiguration, oauthStoreToken);
-        const oauthStoreAliasProvider = {
-            provide: memory_store_service_1.MemoryStore,
-            useExisting: oauthStoreToken,
-        };
-        const providers = [
-            {
-                provide: 'OAUTH_MODULE_ID',
-                useValue: authModuleId,
-            },
-            oauthModuleOptions,
-            oauthStoreProvider,
-            oauthStoreAliasProvider,
-            {
-                provide: 'OAUTH_MODULE_OPTIONS',
-                useExisting: oauthModuleOptionsToken,
-            },
-            {
-                provide: 'IOAuthStore',
-                useExisting: oauthStoreToken,
-            },
-            oauth_strategy_service_1.OAuthStrategyService,
-            client_service_1.ClientService,
-            jwt_token_service_1.JwtTokenService,
-            jwt_auth_guard_1.McpAuthJwtGuard,
-        ];
-        const OAuthControllerClass = (0, mcp_oauth_controller_1.createMcpOAuthController)(resolvedOptions.endpoints, {
-            disableWellKnownAuthorizationServerMetadata: resolvedOptions.disableEndpoints
-                .wellKnownAuthorizationServerMetadata ?? false,
-            disableWellKnownProtectedResourceMetadata: resolvedOptions.disableEndpoints.wellKnownProtectedResourceMetadata ??
-                false,
-        }, authModuleId);
-        return {
-            module: McpAuthModule_1,
-            imports,
-            controllers: [OAuthControllerClass],
-            providers,
-            exports: [
-                'OAUTH_MODULE_ID',
-                'OAUTH_MODULE_OPTIONS',
-                'IOAuthStore',
-                jwt_token_service_1.JwtTokenService,
-                client_service_1.ClientService,
-                oauth_strategy_service_1.OAuthStrategyService,
-                jwt_auth_guard_1.McpAuthJwtGuard,
-                memory_store_service_1.MemoryStore,
-            ],
-        };
-    }
-    static mergeAndValidateOptions(defaults, options) {
-        this.validateRequiredOptions(options);
-        const resolvedOptions = {
-            ...defaults,
-            ...options,
-            jwtIssuer: options.jwtIssuer || options.serverUrl || exports.DEFAULT_OPTIONS.jwtIssuer,
-            cookieSecure: options.cookieSecure || process.env.NODE_ENV === 'production',
-            protectedResourceMetadata: {
-                ...defaults.protectedResourceMetadata,
-                ...options.protectedResourceMetadata,
-            },
-            authorizationServerMetadata: {
-                ...defaults.authorizationServerMetadata,
-                ...options.authorizationServerMetadata,
-            },
-            disableEndpoints: {
-                ...defaults.disableEndpoints,
-                ...(options.disableEndpoints || {}),
-            },
-        };
-        if (!resolvedOptions.enableRefreshTokens) {
-            resolvedOptions.authorizationServerMetadata.grantTypesSupported =
-                resolvedOptions.authorizationServerMetadata.grantTypesSupported.filter((g) => g !== 'refresh_token');
-            resolvedOptions.protectedResourceMetadata.scopesSupported =
-                resolvedOptions.protectedResourceMetadata.scopesSupported.filter((s) => s !== 'offline_access');
-        }
-        this.validateResolvedOptions(resolvedOptions);
-        return resolvedOptions;
-    }
-    static validateRequiredOptions(options) {
-        const requiredFields = [
-            'provider',
-            'clientId',
-            'clientSecret',
-            'jwtSecret',
-        ];
-        for (const field of requiredFields) {
-            if (!options[field]) {
-                throw new Error(`OAuthModuleOptions: ${String(field)} is required and must be provided by the user`);
-            }
-        }
-    }
-    static validateResolvedOptions(options) {
-        if (options.jwtSecret.length < 32) {
-            throw new Error('OAuthModuleOptions: jwtSecret must be at least 32 characters long');
-        }
-        try {
-            new URL(options.serverUrl);
-            new URL(options.jwtIssuer);
-        }
-        catch {
-            throw new Error('OAuthModuleOptions: serverUrl and jwtIssuer must be valid URLs');
-        }
-        if (!options.provider.name || !options.provider.strategy) {
-            throw new Error('OAuthModuleOptions: provider must have name and strategy');
-        }
-    }
-    static createStoreProvider(storeConfiguration, provideToken) {
-        if (!storeConfiguration || storeConfiguration.type === 'memory') {
-            return {
-                provide: provideToken,
-                useValue: new memory_store_service_1.MemoryStore(),
-            };
-        }
-        if (storeConfiguration.type === 'typeorm') {
-            const { TypeOrmStore, } = require('./stores/typeorm/typeorm-store.service');
-            return {
-                provide: provideToken,
-                useClass: TypeOrmStore,
-            };
-        }
-        if (storeConfiguration.type === 'custom') {
-            return {
-                provide: provideToken,
-                useValue: storeConfiguration.store,
-            };
-        }
-        throw new Error(`Unknown store configuration type: ${storeConfiguration.type}`);
-    }
-};
-exports.McpAuthModule = McpAuthModule;
-exports.McpAuthModule = McpAuthModule = McpAuthModule_1 = __decorate([
-    (0, common_1.Module)({})
-], McpAuthModule);
-function prepareEndpoints(apiPrefix, defaultEndpoints, configuredEndpoints) {
-    const updatedDefaultEndpoints = {
-        wellKnownAuthorizationServerMetadata: defaultEndpoints.wellKnownAuthorizationServerMetadata,
-        wellKnownProtectedResourceMetadata: defaultEndpoints.wellKnownProtectedResourceMetadata,
-        callback: (0, normalize_endpoint_1.normalizeEndpoint)(`/${apiPrefix}/${defaultEndpoints.callback}`),
-        token: (0, normalize_endpoint_1.normalizeEndpoint)(`/${apiPrefix}/${defaultEndpoints.token}`),
-        revoke: (0, normalize_endpoint_1.normalizeEndpoint)(`/${apiPrefix}/${defaultEndpoints.revoke}`),
-        authorize: (0, normalize_endpoint_1.normalizeEndpoint)(`/${apiPrefix}/${defaultEndpoints.authorize}`),
-        register: (0, normalize_endpoint_1.normalizeEndpoint)(`/${apiPrefix}/${defaultEndpoints.register}`),
-    };
-    return {
-        ...updatedDefaultEndpoints,
-        ...configuredEndpoints,
-    };
-}
-//# sourceMappingURL=mcp-oauth.module.js.map

package/dist/authz/mcp-oauth.module.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-oauth.module.js","sourceRoot":"","sources":["../../src/authz/mcp-oauth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,2CAA8C;AAC9C,qCAAwC;AACxC,+CAAkD;AAClD,4DAA0D;AAC1D,iEAAkE;AAOlE,8DAA0D;AAC1D,oEAA+D;AAC/D,8EAAyE;AACzE,wEAA4D;AAC5D,wEAAoE;AACpE,0DAA2E;AAE3E,IAAI,qBAAqB,GAAG,CAAC,CAAC;AAGjB,QAAA,eAAe,GAAwB;IAClD,SAAS,EAAE,uBAAuB;IAClC,QAAQ,EAAE,2BAA2B;IACrC,SAAS,EAAE,uBAAuB;IAClC,WAAW,EAAE,YAAY;IACzB,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,KAAK;IAC/B,mBAAmB,EAAE,IAAI;IACzB,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,qBAAqB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACrC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;IACjC,OAAO,EAAE,aAAa;IACtB,SAAS,EAAE,EAAE;IACb,SAAS,EAAE;QACT,oCAAoC,EAClC,yCAAyC;QAC3C,kCAAkC,EAAE,uCAAuC;QAC3E,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,SAAS;KAClB;IACD,gBAAgB,EAAE;QAChB,oCAAoC,EAAE,KAAK;QAC3C,kCAAkC,EAAE,KAAK;KAC1C;IACD,yBAAyB,EAAE;QACzB,eAAe,EAAE,CAAC,gBAAgB,CAAC;QACnC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAClC,oBAAoB,EAAE,CAAC,YAAY,CAAC;KACrC;IACD,2BAA2B,EAAE;QAC3B,sBAAsB,EAAE,CAAC,MAAM,CAAC;QAChC,sBAAsB,EAAE,CAAC,OAAO,CAAC;QACjC,mBAAmB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC5D,iCAAiC,EAAE;YACjC,qBAAqB;YACrB,oBAAoB;YACpB,MAAM;SACP;QACD,eAAe,EAAE,CAAC,gBAAgB,CAAC;QACnC,6BAA6B,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;KACjD;CACF,CAAC;AAGK,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAAnB;QAII,sBAAiB,GAAG,IAAI,CAAC;IA+RpC,CAAC;IA7RC,MAAM,CAAC,OAAO,CAAC,OAA8B;QAE3C,MAAM,YAAY,GAAG,mBAAmB,qBAAqB,EAAE,EAAE,CAAC;QAGlE,MAAM,eAAe,GAAG,IAAI,CAAC,uBAAuB,CAClD,uBAAe,EACf,OAAO,CACR,CAAC;QAEF,eAAe,CAAC,SAAS,GAAG,gBAAgB,CAC1C,eAAe,CAAC,SAAS,EACzB,uBAAe,CAAC,SAAS,EACzB,OAAO,CAAC,SAAS,IAAI,EAAE,CACxB,CAAC;QAGF,MAAM,uBAAuB,GAAG,wBAAwB,YAAY,EAAE,CAAC;QACvE,MAAM,kBAAkB,GAAG;YACzB,OAAO,EAAE,uBAAuB;YAChC,QAAQ,EAAE,eAAe;SAC1B,CAAC;QAGF,MAAM,OAAO,GAAG;YACd,qBAAY;YACZ,yBAAc,CAAC,QAAQ,CAAC;gBACtB,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,KAAK;aACf,CAAC;YACF,eAAS,CAAC,QAAQ,CAAC;gBACjB,MAAM,EAAE,eAAe,CAAC,SAAS;gBACjC,WAAW,EAAE;oBACX,MAAM,EAAE,eAAe,CAAC,SAAS;oBACjC,QAAQ,EAAE,eAAe,CAAC,WAAW;iBACtC;aACF,CAAC;SACH,CAAC;QAGF,MAAM,WAAW,GAAG,eAAe,CAAC,kBAAkB,CAAC;QACvD,MAAM,cAAc,GAAG,WAAW,EAAE,IAAI,KAAK,SAAS,CAAC;QACvD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC;YAC3C,IAAI,CAAC;gBAGH,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;gBACrD,MAAM,EACJ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,GAEvB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;gBAEzC,OAAO,CAAC,IAAI,CACV,aAAa,CAAC,OAAO,CAAC;oBACpB,GAAG,cAAc;oBAEjB,IAAI,EAAE,yCAA6B;oBACnC,QAAQ,EAAE;wBACR,iBAAiB;wBACjB,uBAAuB;wBACvB,kBAAkB;wBAClB,sBAAsB;qBACvB;iBACF,CAAC,EACF,aAAa,CAAC,UAAU,CACtB;oBACE,iBAAiB;oBACjB,uBAAuB;oBACvB,kBAAkB;oBAClB,sBAAsB;iBACvB,EACD,yCAA6B,CAC9B,CACF,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,MAAM,eAAe,GAAG,eAAe,YAAY,EAAE,CAAC;QACtD,MAAM,kBAAkB,GAAG,IAAI,CAAC,mBAAmB,CACjD,eAAe,CAAC,kBAAkB,EAClC,eAAe,CAChB,CAAC;QAGF,MAAM,uBAAuB,GAAG;YAC9B,OAAO,EAAE,kCAAW;YACpB,WAAW,EAAE,eAAe;SAC7B,CAAC;QAEF,MAAM,SAAS,GAAU;YACvB;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,QAAQ,EAAE,YAAY;aACvB;YACD,kBAAkB;YAClB,kBAAkB;YAClB,uBAAuB;YAEvB;gBACE,OAAO,EAAE,sBAAsB;gBAC/B,WAAW,EAAE,uBAAuB;aACrC;YACD;gBACE,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,eAAe;aAC7B;YAED,6CAAoB;YACpB,8BAAa;YACb,mCAAe;YACf,gCAAe;SAChB,CAAC;QAKF,MAAM,oBAAoB,GAAG,IAAA,+CAAwB,EACnD,eAAe,CAAC,SAAS,EACzB;YACE,2CAA2C,EACzC,eAAe,CAAC,gBAAgB;iBAC7B,oCAAoC,IAAI,KAAK;YAClD,yCAAyC,EACvC,eAAe,CAAC,gBAAgB,CAAC,kCAAkC;gBACnE,KAAK;SACR,EACD,YAAY,CACb,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,eAAa;YACrB,OAAO;YACP,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,SAAS;YACT,OAAO,EAAE;gBACP,iBAAiB;gBACjB,sBAAsB;gBACtB,aAAa;gBACb,mCAAe;gBACf,8BAAa;gBACb,6CAAoB;gBACpB,gCAAe;gBACf,kCAAW;aACZ;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,uBAAuB,CACpC,QAA6B,EAC7B,OAA8B;QAG9B,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAGtC,MAAM,eAAe,GAAuB;YAC1C,GAAG,QAAQ;YACX,GAAG,OAAO;YAEV,SAAS,EACP,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,uBAAe,CAAC,SAAS;YACrE,YAAY,EACV,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAE/D,yBAAyB,EAAE;gBACzB,GAAG,QAAQ,CAAC,yBAAyB;gBACrC,GAAG,OAAO,CAAC,yBAAyB;aACrC;YAED,2BAA2B,EAAE;gBAC3B,GAAG,QAAQ,CAAC,2BAA2B;gBACvC,GAAG,OAAO,CAAC,2BAA2B;aACvC;YAED,gBAAgB,EAAE;gBAChB,GAAG,QAAQ,CAAC,gBAAgB;gBAC5B,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;aACpC;SACF,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,mBAAmB,EAAE,CAAC;YACzC,eAAe,CAAC,2BAA2B,CAAC,mBAAmB;gBAC7D,eAAe,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,eAAe,CAC7B,CAAC;YACJ,eAAe,CAAC,yBAAyB,CAAC,eAAe;gBACvD,eAAe,CAAC,yBAAyB,CAAC,eAAe,CAAC,MAAM,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAC9B,CAAC;QACN,CAAC;QAGD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;QAE9C,OAAO,eAAe,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAC,OAA8B;QACnE,MAAM,cAAc,GAAoC;YACtD,UAAU;YACV,UAAU;YACV,cAAc;YACd,WAAW;SACZ,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,uBAAuB,CAAC,OAA2B;QAEhE,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAGD,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAGD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAChC,kBAA4D,EAC5D,YAAoB;QAEpB,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAEhE,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,IAAI,kCAAW,EAAE;aAC5B,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAE1C,MAAM,EACJ,YAAY,GAEb,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,YAAY;aACvB,CAAC;QACJ,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAEzC,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,kBAAkB,CAAC,KAAK;aACnC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,KAAK,CACb,qCAAsC,kBAA0B,CAAC,IAAI,EAAE,CACxE,CAAC;IACJ,CAAC;CACF,CAAA;AAnSY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAmSzB;AAED,SAAS,gBAAgB,CACvB,SAAiB,EACjB,gBAA4C,EAC5C,mBAA+C;IAE/C,MAAM,uBAAuB,GAAG;QAC9B,oCAAoC,EAClC,gBAAgB,CAAC,oCAAoC;QACvD,kCAAkC,EAChC,gBAAgB,CAAC,kCAAkC;QACrD,QAAQ,EAAE,IAAA,sCAAiB,EAAC,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QACzE,KAAK,EAAE,IAAA,sCAAiB,EAAC,IAAI,SAAS,IAAI,gBAAgB,CAAC,KAAK,EAAE,CAAC;QACnE,MAAM,EAAE,IAAA,sCAAiB,EAAC,IAAI,SAAS,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACrE,SAAS,EAAE,IAAA,sCAAiB,EAAC,IAAI,SAAS,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAC3E,QAAQ,EAAE,IAAA,sCAAiB,EAAC,IAAI,SAAS,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;KAC5C,CAAC;IAEhC,OAAO;QACL,GAAG,uBAAuB;QAC1B,GAAG,mBAAmB;KACvB,CAAC;AACJ,CAAC","sourcesContent":["import { DynamicModule, Module } from '@nestjs/common';\nimport { ConfigModule } from '@nestjs/config';\nimport { JwtModule } from '@nestjs/jwt';\nimport { PassportModule } from '@nestjs/passport';\nimport { McpAuthJwtGuard } from './guards/jwt-auth.guard';\nimport { createMcpOAuthController } from './mcp-oauth.controller';\nimport type {\n  OAuthUserModuleOptions as AuthUserModuleOptions,\n  OAuthEndpointConfiguration,\n  OAuthModuleDefaults,\n  OAuthModuleOptions,\n} from './providers/oauth-provider.interface';\nimport { ClientService } from './services/client.service';\nimport { JwtTokenService } from './services/jwt-token.service';\nimport { OAuthStrategyService } from './services/oauth-strategy.service';\nimport { MemoryStore } from './stores/memory-store.service';\nimport { normalizeEndpoint } from '../mcp/utils/normalize-endpoint';\nimport { OAUTH_TYPEORM_CONNECTION_NAME } from './stores/typeorm/constants';\n\nlet authInstanceIdCounter = 0;\n\n// Default configuration values\nexport const DEFAULT_OPTIONS: OAuthModuleDefaults = {\n  serverUrl: 'http://localhost:3000',\n  resource: 'http://localhost:3000/mcp',\n  jwtIssuer: 'http://localhost:3000',\n  jwtAudience: 'mcp-client',\n  jwtAccessTokenExpiresIn: '1d',\n  jwtRefreshTokenExpiresIn: '30d',\n  enableRefreshTokens: true,\n  cookieMaxAge: 24 * 60 * 60 * 1000, // 24 hours\n  oauthSessionExpiresIn: 10 * 60 * 1000, // 10 minutes\n  authCodeExpiresIn: 10 * 60 * 1000, // 10 minutes\n  nodeEnv: 'development',\n  apiPrefix: '',\n  endpoints: {\n    wellKnownAuthorizationServerMetadata:\n      '/.well-known/oauth-authorization-server',\n    wellKnownProtectedResourceMetadata: '/.well-known/oauth-protected-resource',\n    register: '/register',\n    authorize: '/authorize',\n    callback: '/callback',\n    token: '/token',\n    revoke: '/revoke',\n  },\n  disableEndpoints: {\n    wellKnownAuthorizationServerMetadata: false,\n    wellKnownProtectedResourceMetadata: false,\n  },\n  protectedResourceMetadata: {\n    scopesSupported: ['offline_access'],\n    bearerMethodsSupported: ['header'],\n    mcpVersionsSupported: ['2025-06-18'],\n  },\n  authorizationServerMetadata: {\n    responseTypesSupported: ['code'],\n    responseModesSupported: ['query'],\n    grantTypesSupported: ['authorization_code', 'refresh_token'],\n    tokenEndpointAuthMethodsSupported: [\n      'client_secret_basic',\n      'client_secret_post',\n      'none',\n    ],\n    scopesSupported: ['offline_access'],\n    codeChallengeMethodsSupported: ['plain', 'S256'],\n  },\n};\n\n@Module({})\nexport class McpAuthModule {\n  /**\n   * To avoid import circular dependency issues, we use a marker property.\n   */\n  readonly __isMcpAuthModule = true;\n\n  static forRoot(options: AuthUserModuleOptions): DynamicModule {\n    // Create a unique instance ID for this auth module\n    const authModuleId = `mcp-auth-module-${authInstanceIdCounter++}`;\n\n    // Merge user options with defaults and validate\n    const resolvedOptions = this.mergeAndValidateOptions(\n      DEFAULT_OPTIONS,\n      options,\n    );\n\n    resolvedOptions.endpoints = prepareEndpoints(\n      resolvedOptions.apiPrefix,\n      DEFAULT_OPTIONS.endpoints,\n      options.endpoints || {},\n    );\n\n    // Use instance-scoped token for OAuth options\n    const oauthModuleOptionsToken = `OAUTH_MODULE_OPTIONS_${authModuleId}`;\n    const oauthModuleOptions = {\n      provide: oauthModuleOptionsToken,\n      useValue: resolvedOptions,\n    };\n\n    // Determine imports based on configuration\n    const imports = [\n      ConfigModule,\n      PassportModule.register({\n        defaultStrategy: 'jwt',\n        session: false,\n      }),\n      JwtModule.register({\n        secret: resolvedOptions.jwtSecret,\n        signOptions: {\n          issuer: resolvedOptions.jwtIssuer,\n          audience: resolvedOptions.jwtAudience,\n        },\n      }),\n    ];\n\n    // Add TypeORM configuration if using TypeORM store\n    const storeConfig = resolvedOptions.storeConfiguration;\n    const isTypeOrmStore = storeConfig?.type === 'typeorm';\n    if (isTypeOrmStore) {\n      const typeormOptions = storeConfig.options;\n      try {\n        // Require TypeORM-related modules only when needed\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n        const { TypeOrmModule } = require('@nestjs/typeorm');\n        const {\n          OAuthClientEntity,\n          AuthorizationCodeEntity,\n          OAuthSessionEntity,\n          OAuthUserProfileEntity,\n          // eslint-disable-next-line @typescript-eslint/no-require-imports\n        } = require('./stores/typeorm/entities');\n\n        imports.push(\n          TypeOrmModule.forRoot({\n            ...typeormOptions,\n            // Use a unique connection name for the OAuth store to avoid clashes\n            name: OAUTH_TYPEORM_CONNECTION_NAME,\n            entities: [\n              OAuthClientEntity,\n              AuthorizationCodeEntity,\n              OAuthSessionEntity,\n              OAuthUserProfileEntity,\n            ],\n          }),\n          TypeOrmModule.forFeature(\n            [\n              OAuthClientEntity,\n              AuthorizationCodeEntity,\n              OAuthSessionEntity,\n              OAuthUserProfileEntity,\n            ],\n            OAUTH_TYPEORM_CONNECTION_NAME,\n          ),\n        );\n      } catch (err) {\n        throw new Error(\n          \"To use the TypeORM store, please install '@nestjs/typeorm' and 'typeorm'.\",\n        );\n      }\n    }\n\n    // Create store provider based on configuration with instance-scoped token\n    const oauthStoreToken = `IOAuthStore_${authModuleId}`;\n    const oauthStoreProvider = this.createStoreProvider(\n      resolvedOptions.storeConfiguration,\n      oauthStoreToken,\n    );\n\n    // Create alias for compatibility with injection\n    const oauthStoreAliasProvider = {\n      provide: MemoryStore,\n      useExisting: oauthStoreToken,\n    };\n\n    const providers: any[] = [\n      {\n        provide: 'OAUTH_MODULE_ID',\n        useValue: authModuleId,\n      },\n      oauthModuleOptions,\n      oauthStoreProvider,\n      oauthStoreAliasProvider,\n      // Provide backward-compatible tokens as aliases\n      {\n        provide: 'OAUTH_MODULE_OPTIONS',\n        useExisting: oauthModuleOptionsToken,\n      },\n      {\n        provide: 'IOAuthStore',\n        useExisting: oauthStoreToken,\n      },\n      // Provide services using their class tokens\n      OAuthStrategyService,\n      ClientService,\n      JwtTokenService,\n      McpAuthJwtGuard,\n    ];\n\n    // No additional providers needed for TypeORM store - provider is created dynamically\n\n    // Create controller with apiPrefix, passing the instance-scoped tokens\n    const OAuthControllerClass = createMcpOAuthController(\n      resolvedOptions.endpoints,\n      {\n        disableWellKnownAuthorizationServerMetadata:\n          resolvedOptions.disableEndpoints\n            .wellKnownAuthorizationServerMetadata ?? false,\n        disableWellKnownProtectedResourceMetadata:\n          resolvedOptions.disableEndpoints.wellKnownProtectedResourceMetadata ??\n          false,\n      },\n      authModuleId,\n    );\n\n    return {\n      module: McpAuthModule,\n      imports,\n      controllers: [OAuthControllerClass],\n      providers,\n      exports: [\n        'OAUTH_MODULE_ID',\n        'OAUTH_MODULE_OPTIONS',\n        'IOAuthStore',\n        JwtTokenService,\n        ClientService,\n        OAuthStrategyService,\n        McpAuthJwtGuard,\n        MemoryStore,\n      ],\n    };\n  }\n\n  private static mergeAndValidateOptions(\n    defaults: OAuthModuleDefaults,\n    options: AuthUserModuleOptions,\n  ): OAuthModuleOptions {\n    // Validate required options first\n    this.validateRequiredOptions(options);\n\n    // Merge with defaults\n    const resolvedOptions: OAuthModuleOptions = {\n      ...defaults,\n      ...options,\n      // Ensure jwtIssuer defaults to serverUrl if not provided\n      jwtIssuer:\n        options.jwtIssuer || options.serverUrl || DEFAULT_OPTIONS.jwtIssuer,\n      cookieSecure:\n        options.cookieSecure || process.env.NODE_ENV === 'production',\n      // Merge protectedResourceMetadata with defaults\n      protectedResourceMetadata: {\n        ...defaults.protectedResourceMetadata,\n        ...options.protectedResourceMetadata,\n      },\n      // Merge authorizationServerMetadata with defaults\n      authorizationServerMetadata: {\n        ...defaults.authorizationServerMetadata,\n        ...options.authorizationServerMetadata,\n      },\n      // Merge disableEndpoints with defaults\n      disableEndpoints: {\n        ...defaults.disableEndpoints,\n        ...(options.disableEndpoints || {}),\n      },\n    };\n\n    if (!resolvedOptions.enableRefreshTokens) {\n      resolvedOptions.authorizationServerMetadata.grantTypesSupported =\n        resolvedOptions.authorizationServerMetadata.grantTypesSupported.filter(\n          (g) => g !== 'refresh_token',\n        );\n      resolvedOptions.protectedResourceMetadata.scopesSupported =\n        resolvedOptions.protectedResourceMetadata.scopesSupported.filter(\n          (s) => s !== 'offline_access',\n        );\n    }\n\n    // Final validation of resolved options\n    this.validateResolvedOptions(resolvedOptions);\n\n    return resolvedOptions;\n  }\n\n  private static validateRequiredOptions(options: AuthUserModuleOptions): void {\n    const requiredFields: (keyof AuthUserModuleOptions)[] = [\n      'provider',\n      'clientId',\n      'clientSecret',\n      'jwtSecret',\n    ];\n\n    for (const field of requiredFields) {\n      if (!options[field]) {\n        throw new Error(\n          `OAuthModuleOptions: ${String(field)} is required and must be provided by the user`,\n        );\n      }\n    }\n  }\n\n  private static validateResolvedOptions(options: OAuthModuleOptions): void {\n    // Validate JWT secret is strong enough\n    if (options.jwtSecret.length < 32) {\n      throw new Error(\n        'OAuthModuleOptions: jwtSecret must be at least 32 characters long',\n      );\n    }\n\n    // Validate URLs are proper format\n    try {\n      new URL(options.serverUrl);\n      new URL(options.jwtIssuer);\n    } catch {\n      throw new Error(\n        'OAuthModuleOptions: serverUrl and jwtIssuer must be valid URLs',\n      );\n    }\n\n    // Validate provider configuration\n    if (!options.provider.name || !options.provider.strategy) {\n      throw new Error(\n        'OAuthModuleOptions: provider must have name and strategy',\n      );\n    }\n  }\n\n  private static createStoreProvider(\n    storeConfiguration: OAuthModuleOptions['storeConfiguration'],\n    provideToken: string,\n  ) {\n    if (!storeConfiguration || storeConfiguration.type === 'memory') {\n      // Default memory store\n      return {\n        provide: provideToken,\n        useValue: new MemoryStore(),\n      };\n    }\n\n    if (storeConfiguration.type === 'typeorm') {\n      // TypeORM store\n      const {\n        TypeOrmStore,\n        // eslint-disable-next-line @typescript-eslint/no-require-imports\n      } = require('./stores/typeorm/typeorm-store.service');\n      return {\n        provide: provideToken,\n        useClass: TypeOrmStore,\n      };\n    }\n\n    if (storeConfiguration.type === 'custom') {\n      // Custom store\n      return {\n        provide: provideToken,\n        useValue: storeConfiguration.store,\n      };\n    }\n\n    throw new Error(\n      `Unknown store configuration type: ${(storeConfiguration as any).type}`,\n    );\n  }\n}\n\nfunction prepareEndpoints(\n  apiPrefix: string,\n  defaultEndpoints: OAuthEndpointConfiguration,\n  configuredEndpoints: OAuthEndpointConfiguration,\n) {\n  const updatedDefaultEndpoints = {\n    wellKnownAuthorizationServerMetadata:\n      defaultEndpoints.wellKnownAuthorizationServerMetadata,\n    wellKnownProtectedResourceMetadata:\n      defaultEndpoints.wellKnownProtectedResourceMetadata,\n    callback: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.callback}`),\n    token: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.token}`),\n    revoke: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.revoke}`),\n    authorize: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.authorize}`),\n    register: normalizeEndpoint(`/${apiPrefix}/${defaultEndpoints.register}`),\n  } as OAuthEndpointConfiguration;\n\n  return {\n    ...updatedDefaultEndpoints,\n    ...configuredEndpoints,\n  };\n}\n"]}

package/dist/authz/providers/azure-ad.provider.d.ts

@@ -1,3 +0,0 @@
-import { OAuthProviderConfig } from './oauth-provider.interface';
-export declare const AzureADOAuthProvider: OAuthProviderConfig;
-//# sourceMappingURL=azure-ad.provider.d.ts.map

package/dist/authz/providers/azure-ad.provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"azure-ad.provider.d.ts","sourceRoot":"","sources":["../../../src/authz/providers/azure-ad.provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,eAAO,MAAM,oBAAoB,EAAE,mBAmClC,CAAC"}

package/dist/authz/providers/azure-ad.provider.js

@@ -1,37 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AzureADOAuthProvider = void 0;
-const passport_azure_ad_oauth2_1 = require("passport-azure-ad-oauth2");
-const normalize_endpoint_1 = require("../../mcp/utils/normalize-endpoint");
-exports.AzureADOAuthProvider = {
-    name: 'azure-ad',
-    displayName: 'Microsoft Azure AD',
-    strategy: passport_azure_ad_oauth2_1.Strategy,
-    strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-        clientID: clientId,
-        clientSecret: clientSecret,
-        callbackURL: (0, normalize_endpoint_1.normalizeEndpoint)(`${serverUrl}/${callbackPath}`),
-        tenant: 'common',
-        resource: 'https://graph.microsoft.com/',
-    }),
-    scope: ['openid', 'profile', 'email', 'User.Read'],
-    profileMapper: (profile) => {
-        const azureProfile = profile._json || profile;
-        return {
-            id: azureProfile.id || azureProfile.oid || profile.id,
-            username: azureProfile.preferred_username ||
-                azureProfile.userPrincipalName ||
-                azureProfile.mail ||
-                azureProfile.email ||
-                profile.username,
-            email: azureProfile.mail ||
-                azureProfile.userPrincipalName ||
-                azureProfile.email ||
-                profile.emails?.[0]?.value,
-            displayName: azureProfile.displayName || azureProfile.name || profile.displayName,
-            avatarUrl: azureProfile.photo || profile.photos?.[0]?.value,
-            raw: profile,
-        };
-    },
-};
-//# sourceMappingURL=azure-ad.provider.js.map

package/dist/authz/providers/azure-ad.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"azure-ad.provider.js","sourceRoot":"","sources":["../../../src/authz/providers/azure-ad.provider.ts"],"names":[],"mappings":";;;AAAA,uEAAoD;AACpD,2EAAuE;AAG1D,QAAA,oBAAoB,GAAwB;IACvD,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,oBAAoB;IACjC,QAAQ,EAAE,mCAAQ;IAClB,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,IAAA,sCAAiB,EAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9D,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,8BAA8B;KACzC,CAAC;IACF,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;IAClD,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE;QAEzB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC;QAE9C,OAAO;YACL,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,YAAY,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE;YACrD,QAAQ,EACN,YAAY,CAAC,kBAAkB;gBAC/B,YAAY,CAAC,iBAAiB;gBAC9B,YAAY,CAAC,IAAI;gBACjB,YAAY,CAAC,KAAK;gBAClB,OAAO,CAAC,QAAQ;YAClB,KAAK,EACH,YAAY,CAAC,IAAI;gBACjB,YAAY,CAAC,iBAAiB;gBAC9B,YAAY,CAAC,KAAK;gBAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;YAC5B,WAAW,EACT,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW;YACtE,SAAS,EAAE,YAAY,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;YAC3D,GAAG,EAAE,OAAO;SACb,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["import { Strategy } from 'passport-azure-ad-oauth2';\nimport { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';\nimport { OAuthProviderConfig } from './oauth-provider.interface';\n\nexport const AzureADOAuthProvider: OAuthProviderConfig = {\n  name: 'azure-ad',\n  displayName: 'Microsoft Azure AD',\n  strategy: Strategy,\n  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({\n    clientID: clientId,\n    clientSecret: clientSecret,\n    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),\n    tenant: 'common', // Can be overridden via custom configuration\n    resource: 'https://graph.microsoft.com/', // Microsoft Graph API\n  }),\n  scope: ['openid', 'profile', 'email', 'User.Read'],\n  profileMapper: (profile) => {\n    // Azure AD profile structure from Microsoft Graph\n    const azureProfile = profile._json || profile;\n\n    return {\n      id: azureProfile.id || azureProfile.oid || profile.id,\n      username:\n        azureProfile.preferred_username ||\n        azureProfile.userPrincipalName ||\n        azureProfile.mail ||\n        azureProfile.email ||\n        profile.username,\n      email:\n        azureProfile.mail ||\n        azureProfile.userPrincipalName ||\n        azureProfile.email ||\n        profile.emails?.[0]?.value,\n      displayName:\n        azureProfile.displayName || azureProfile.name || profile.displayName,\n      avatarUrl: azureProfile.photo || profile.photos?.[0]?.value,\n      raw: profile,\n    };\n  },\n};\n"]}

package/dist/authz/providers/github.provider.d.ts

@@ -1,3 +0,0 @@
-import { OAuthProviderConfig } from './oauth-provider.interface';
-export declare const GitHubOAuthProvider: OAuthProviderConfig;
-//# sourceMappingURL=github.provider.d.ts.map

package/dist/authz/providers/github.provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"github.provider.d.ts","sourceRoot":"","sources":["../../../src/authz/providers/github.provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,eAAO,MAAM,mBAAmB,EAAE,mBAiBjC,CAAC"}

package/dist/authz/providers/github.provider.js

@@ -1,24 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GitHubOAuthProvider = void 0;
-const normalize_endpoint_1 = require("../../mcp/utils/normalize-endpoint");
-const passport_github_1 = require("passport-github");
-exports.GitHubOAuthProvider = {
-    name: 'github',
-    strategy: passport_github_1.Strategy,
-    strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-        clientID: clientId,
-        clientSecret: clientSecret,
-        callbackURL: (0, normalize_endpoint_1.normalizeEndpoint)(`${serverUrl}/${callbackPath}`),
-    }),
-    scope: ['user:email'],
-    profileMapper: (profile) => ({
-        id: profile.id,
-        username: profile.username || profile.login,
-        email: profile.emails?.[0]?.value,
-        displayName: profile.displayName || profile.name,
-        avatarUrl: profile.photos?.[0]?.value || profile.avatar_url,
-        raw: profile,
-    }),
-};
-//# sourceMappingURL=github.provider.js.map

package/dist/authz/providers/github.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github.provider.js","sourceRoot":"","sources":["../../../src/authz/providers/github.provider.ts"],"names":[],"mappings":";;;AAAA,2EAAuE;AAEvE,qDAA2C;AAE9B,QAAA,mBAAmB,GAAwB;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,0BAAQ;IAClB,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,IAAA,sCAAiB,EAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;KAC/D,CAAC;IACF,KAAK,EAAE,CAAC,YAAY,CAAC;IACrB,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK;QAC3C,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;QACjC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI;QAChD,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,OAAO,CAAC,UAAU;QAC3D,GAAG,EAAE,OAAO;KACb,CAAC;CACH,CAAC","sourcesContent":["import { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';\nimport { OAuthProviderConfig } from './oauth-provider.interface';\nimport { Strategy } from 'passport-github';\n\nexport const GitHubOAuthProvider: OAuthProviderConfig = {\n  name: 'github',\n  strategy: Strategy,\n  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({\n    clientID: clientId,\n    clientSecret: clientSecret,\n    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),\n  }),\n  scope: ['user:email'],\n  profileMapper: (profile) => ({\n    id: profile.id,\n    username: profile.username || profile.login,\n    email: profile.emails?.[0]?.value,\n    displayName: profile.displayName || profile.name,\n    avatarUrl: profile.photos?.[0]?.value || profile.avatar_url,\n    raw: profile,\n  }),\n};\n"]}

package/dist/authz/providers/google.provider.d.ts

@@ -1,3 +0,0 @@
-import { OAuthProviderConfig } from './oauth-provider.interface';
-export declare const GoogleOAuthProvider: OAuthProviderConfig;
-//# sourceMappingURL=google.provider.d.ts.map

package/dist/authz/providers/google.provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"google.provider.d.ts","sourceRoot":"","sources":["../../../src/authz/providers/google.provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,eAAO,MAAM,mBAAmB,EAAE,mBAkBjC,CAAC"}

package/dist/authz/providers/google.provider.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GoogleOAuthProvider = void 0;
-const passport_google_oauth20_1 = require("passport-google-oauth20");
-const normalize_endpoint_1 = require("../../mcp/utils/normalize-endpoint");
-exports.GoogleOAuthProvider = {
-    name: 'google',
-    strategy: passport_google_oauth20_1.Strategy,
-    strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({
-        clientID: clientId,
-        clientSecret: clientSecret,
-        callbackURL: (0, normalize_endpoint_1.normalizeEndpoint)(`${serverUrl}/${callbackPath}`),
-        scope: ['profile', 'email'],
-    }),
-    scope: ['profile', 'email'],
-    profileMapper: (profile) => ({
-        id: profile.id,
-        username: profile.emails?.[0]?.value?.split('@')[0] || profile.id,
-        email: profile.emails?.[0]?.value,
-        displayName: profile.displayName,
-        avatarUrl: profile.photos?.[0]?.value,
-        raw: profile,
-    }),
-};
-//# sourceMappingURL=google.provider.js.map

package/dist/authz/providers/google.provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"google.provider.js","sourceRoot":"","sources":["../../../src/authz/providers/google.provider.ts"],"names":[],"mappings":";;;AAAA,qEAAmD;AACnD,2EAAuE;AAG1D,QAAA,mBAAmB,GAAwB;IACtD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,kCAAQ;IAClB,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACzE,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;QAC1B,WAAW,EAAE,IAAA,sCAAiB,EAAC,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;QAC9D,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE;QACjE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;QACjC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;QACrC,GAAG,EAAE,OAAO;KACb,CAAC;CACH,CAAC","sourcesContent":["import { Strategy } from 'passport-google-oauth20';\nimport { normalizeEndpoint } from '../../mcp/utils/normalize-endpoint';\nimport { OAuthProviderConfig } from './oauth-provider.interface';\n\nexport const GoogleOAuthProvider: OAuthProviderConfig = {\n  name: 'google',\n  strategy: Strategy,\n  strategyOptions: ({ serverUrl, clientId, clientSecret, callbackPath }) => ({\n    clientID: clientId,\n    clientSecret: clientSecret,\n    callbackURL: normalizeEndpoint(`${serverUrl}/${callbackPath}`),\n    scope: ['profile', 'email'],\n  }),\n  scope: ['profile', 'email'],\n  profileMapper: (profile) => ({\n    id: profile.id,\n    username: profile.emails?.[0]?.value?.split('@')[0] || profile.id,\n    email: profile.emails?.[0]?.value,\n    displayName: profile.displayName,\n    avatarUrl: profile.photos?.[0]?.value,\n    raw: profile,\n  }),\n};\n"]}

package/dist/authz/providers/oauth-provider.interface.d.ts

@@ -1,107 +0,0 @@
-import type { IOAuthStore } from '../stores/oauth-store.interface';
-import type { OAuthSession, OAuthUserProfile } from '../interfaces/oauth-common.interface';
-export type { OAuthSession, OAuthUserProfile };
-type TypeOrmModuleOptions = Record<string, unknown>;
-export interface OAuthProviderConfig {
-    name: string;
-    displayName?: string;
-    strategy: any;
-    strategyOptions: (options: {
-        serverUrl: string;
-        clientId: string;
-        clientSecret: string;
-        callbackPath?: string;
-    }) => any;
-    scope?: string[];
-    profileMapper: (profile: any) => OAuthUserProfile;
-}
-export type StoreConfiguration = {
-    type: 'typeorm';
-    options: TypeOrmModuleOptions;
-} | {
-    type: 'custom';
-    store: IOAuthStore;
-} | {
-    type: 'memory';
-} | undefined;
-export interface OAuthEndpointConfiguration {
-    wellKnownAuthorizationServerMetadata?: string;
-    wellKnownProtectedResourceMetadata?: string | string[];
-    register?: string;
-    authorize?: string;
-    callback?: string;
-    token?: string;
-    revoke?: string;
-}
-export interface OAuthEndpointDisableOptions {
-    wellKnownAuthorizationServerMetadata?: boolean;
-    wellKnownProtectedResourceMetadata?: boolean;
-}
-export interface OAuthUserModuleOptions {
-    provider: OAuthProviderConfig;
-    clientId: string;
-    clientSecret: string;
-    jwtSecret: string;
-    serverUrl?: string;
-    resource?: string;
-    jwtIssuer?: string;
-    jwtAudience?: string;
-    jwtAccessTokenExpiresIn?: string;
-    jwtRefreshTokenExpiresIn?: string;
-    enableRefreshTokens?: boolean;
-    cookieSecure?: boolean;
-    cookieMaxAge?: number;
-    oauthSessionExpiresIn?: number;
-    authCodeExpiresIn?: number;
-    protectedResourceMetadata?: {
-        scopesSupported?: string[];
-        bearerMethodsSupported?: string[];
-        mcpVersionsSupported?: string[];
-    };
-    authorizationServerMetadata?: {
-        responseTypesSupported?: string[];
-        responseModesSupported?: string[];
-        grantTypesSupported?: string[];
-        tokenEndpointAuthMethodsSupported?: string[];
-        scopesSupported?: string[];
-        codeChallengeMethodsSupported?: string[];
-    };
-    storeConfiguration?: StoreConfiguration;
-    apiPrefix?: string;
-    endpoints?: OAuthEndpointConfiguration;
-    disableEndpoints?: OAuthEndpointDisableOptions;
-}
-export interface OAuthModuleDefaults {
-    serverUrl: string;
-    resource: string;
-    jwtIssuer: string;
-    jwtAudience: string;
-    jwtAccessTokenExpiresIn: string;
-    jwtRefreshTokenExpiresIn: string;
-    enableRefreshTokens: boolean;
-    cookieMaxAge: number;
-    oauthSessionExpiresIn: number;
-    authCodeExpiresIn: number;
-    nodeEnv: string;
-    apiPrefix: string;
-    endpoints: OAuthEndpointConfiguration;
-    disableEndpoints: OAuthEndpointDisableOptions;
-    protectedResourceMetadata: {
-        scopesSupported: string[];
-        bearerMethodsSupported: string[];
-        mcpVersionsSupported: string[];
-    };
-    authorizationServerMetadata: {
-        responseTypesSupported: string[];
-        responseModesSupported: string[];
-        grantTypesSupported: string[];
-        tokenEndpointAuthMethodsSupported: string[];
-        scopesSupported: string[];
-        codeChallengeMethodsSupported: string[];
-    };
-}
-export type OAuthModuleOptions = Required<Pick<OAuthUserModuleOptions, 'provider' | 'clientId' | 'clientSecret' | 'jwtSecret'>> & Required<OAuthModuleDefaults> & {
-    cookieSecure: boolean;
-    storeConfiguration?: StoreConfiguration;
-};
-//# sourceMappingURL=oauth-provider.interface.d.ts.map

package/dist/authz/providers/oauth-provider.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider.interface.d.ts","sourceRoot":"","sources":["../../../src/authz/providers/oauth-provider.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EACjB,MAAM,sCAAsC,CAAC;AAG9C,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAM/C,KAAK,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,GAAG,CAAC;IACd,eAAe,EAAE,CAAC,OAAO,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,KAAK,GAAG,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,gBAAgB,CAAC;CACnD;AAGD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB,SAAS,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,oCAAoC,CAAC,EAAE,MAAM,CAAC;IAC9C,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,oCAAoC,CAAC,EAAE,OAAO,CAAC;IAC/C,kCAAkC,CAAC,EAAE,OAAO,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,mBAAmB,CAAC;IAG9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,SAAS,EAAE,MAAM,CAAC;IAGlB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAG9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAG3B,yBAAyB,CAAC,EAAE;QAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;QAClC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;KACjC,CAAC;IAGF,2BAA2B,CAAC,EAAE;QAC5B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;QAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;QAClC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/B,iCAAiC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;KAC1C,CAAC;IAGF,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,0BAA0B,CAAC;IACtC,gBAAgB,EAAE,2BAA2B,CAAC;IAC9C,yBAAyB,EAAE;QACzB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,oBAAoB,EAAE,MAAM,EAAE,CAAC;KAChC,CAAC;IACF,2BAA2B,EAAE;QAC3B,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,sBAAsB,EAAE,MAAM,EAAE,CAAC;QACjC,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,iCAAiC,EAAE,MAAM,EAAE,CAAC;QAC5C,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,6BAA6B,EAAE,MAAM,EAAE,CAAC;KACzC,CAAC;CACH;AAGD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CACvC,IAAI,CACF,sBAAsB,EACtB,UAAU,GAAG,UAAU,GAAG,cAAc,GAAG,WAAW,CACvD,CACF,GACC,QAAQ,CAAC,mBAAmB,CAAC,GAAG;IAE9B,YAAY,EAAE,OAAO,CAAC;IACtB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC,CAAC"}

package/dist/authz/providers/oauth-provider.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-provider.interface.js","sourceRoot":"","sources":["../../../src/authz/providers/oauth-provider.interface.ts"],"names":[],"mappings":"","sourcesContent":["import type { IOAuthStore } from '../stores/oauth-store.interface';\nimport type {\n  OAuthSession,\n  OAuthUserProfile,\n} from '../interfaces/oauth-common.interface';\n\n// Re-export common interfaces\nexport type { OAuthSession, OAuthUserProfile };\n\n// Define a minimal placeholder for TypeORM options so the type remains\n// available without requiring the optional `@nestjs/typeorm` package.\n// Consumers who use the TypeORM store should install the package to get\n// the full type definitions.\ntype TypeOrmModuleOptions = Record<string, unknown>;\n\nexport interface OAuthProviderConfig {\n  name: string;\n  displayName?: string;\n  strategy: any; // Passport Strategy constructor\n  strategyOptions: (options: {\n    serverUrl: string;\n    clientId: string;\n    clientSecret: string;\n    callbackPath?: string; // Optional custom callback path\n  }) => any;\n  scope?: string[];\n  profileMapper: (profile: any) => OAuthUserProfile;\n}\n\n// Store configuration union type\nexport type StoreConfiguration =\n  | { type: 'typeorm'; options: TypeOrmModuleOptions }\n  | { type: 'custom'; store: IOAuthStore }\n  | { type: 'memory' }\n  | undefined; // Default to memory store\n\nexport interface OAuthEndpointConfiguration {\n  wellKnownAuthorizationServerMetadata?: string; // Default: '/.well-known/oauth-authorization-server'\n  wellKnownProtectedResourceMetadata?: string | string[]; // Default: '/.well-known/oauth-protected-resource'\n  register?: string; // Default: '/register'\n  authorize?: string; // Default: '/authorize'\n  callback?: string; // Default: '/callback'\n  token?: string; // Default: '/token'\n  revoke?: string; // Default: '/revoke'\n}\n\nexport interface OAuthEndpointDisableOptions {\n  wellKnownAuthorizationServerMetadata?: boolean;\n  wellKnownProtectedResourceMetadata?: boolean;\n}\n\nexport interface OAuthUserModuleOptions {\n  provider: OAuthProviderConfig;\n\n  // Required OAuth Provider Credentials\n  clientId: string;\n  clientSecret: string;\n\n  // Required JWT Configuration\n  jwtSecret: string;\n\n  // Server Configuration\n  serverUrl?: string;\n  resource?: string; // should be the endpoint clients connect to, e.g.: 'https://localhost:3000/mcp'\n  // JWT Configuration\n  jwtIssuer?: string;\n  jwtAudience?: string;\n  jwtAccessTokenExpiresIn?: string;\n  jwtRefreshTokenExpiresIn?: string;\n  enableRefreshTokens?: boolean;\n\n  // Cookie Configuration\n  cookieSecure?: boolean;\n  cookieMaxAge?: number;\n\n  // OAuth Session Configuration\n  oauthSessionExpiresIn?: number; // in milliseconds\n  authCodeExpiresIn?: number; // in milliseconds\n\n  // Protected Resource Metadata Configuration\n  protectedResourceMetadata?: {\n    scopesSupported?: string[];\n    bearerMethodsSupported?: string[];\n    mcpVersionsSupported?: string[];\n  };\n\n  // Authorization Server Metadata Configuration\n  authorizationServerMetadata?: {\n    responseTypesSupported?: string[];\n    responseModesSupported?: string[];\n    grantTypesSupported?: string[];\n    tokenEndpointAuthMethodsSupported?: string[];\n    scopesSupported?: string[];\n    codeChallengeMethodsSupported?: string[];\n  };\n\n  // Storage Configuration - single property for all storage options\n  storeConfiguration?: StoreConfiguration;\n  apiPrefix?: string;\n\n  // Endpoint Configuration\n  endpoints?: OAuthEndpointConfiguration;\n  disableEndpoints?: OAuthEndpointDisableOptions;\n}\n\nexport interface OAuthModuleDefaults {\n  serverUrl: string;\n  resource: string; // Default resource URL\n  jwtIssuer: string;\n  jwtAudience: string;\n  jwtAccessTokenExpiresIn: string;\n  jwtRefreshTokenExpiresIn: string;\n  enableRefreshTokens: boolean;\n  cookieMaxAge: number;\n  oauthSessionExpiresIn: number;\n  authCodeExpiresIn: number;\n  nodeEnv: string;\n  apiPrefix: string;\n  endpoints: OAuthEndpointConfiguration;\n  disableEndpoints: OAuthEndpointDisableOptions;\n  protectedResourceMetadata: {\n    scopesSupported: string[];\n    bearerMethodsSupported: string[];\n    mcpVersionsSupported: string[];\n  };\n  authorizationServerMetadata: {\n    responseTypesSupported: string[];\n    responseModesSupported: string[];\n    grantTypesSupported: string[];\n    tokenEndpointAuthMethodsSupported: string[];\n    scopesSupported: string[];\n    codeChallengeMethodsSupported: string[];\n  };\n}\n\n// Resolved options after merging with defaults\nexport type OAuthModuleOptions = Required<\n  Pick<\n    OAuthUserModuleOptions,\n    'provider' | 'clientId' | 'clientSecret' | 'jwtSecret'\n  >\n> &\n  Required<OAuthModuleDefaults> & {\n    // Optional fields that may remain undefined\n    cookieSecure: boolean;\n    storeConfiguration?: StoreConfiguration;\n  };\n"]}

package/dist/authz/services/client.service.d.ts

@@ -1,12 +0,0 @@
-import type { ClientRegistrationDto, IOAuthStore, OAuthClient } from '../stores/oauth-store.interface';
-import type { OAuthModuleOptions } from '../providers/oauth-provider.interface';
-export declare class ClientService {
-    private readonly store;
-    private readonly options;
-    constructor(store: IOAuthStore, options: OAuthModuleOptions);
-    registerClient(registrationDto: ClientRegistrationDto): Promise<OAuthClient>;
-    protected preRegistrationChecks(_dto: ClientRegistrationDto): Promise<void>;
-    getClient(clientId: string): Promise<OAuthClient | null>;
-    validateRedirectUri(clientId: string, redirectUri: string): Promise<boolean>;
-}
-//# sourceMappingURL=client.service.d.ts.map

package/dist/authz/services/client.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.service.d.ts","sourceRoot":"","sources":["../../../src/authz/services/client.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACX,WAAW,EACZ,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,qBACa,aAAa;IAEC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAE7C,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFgB,KAAK,EAAE,WAAW,EAEzC,OAAO,EAAE,kBAAkB;IAUxC,cAAc,CAClB,eAAe,EAAE,qBAAqB,GACrC,OAAO,CAAC,WAAW,CAAC;cAuEP,qBAAqB,CACnC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIV,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAcxD,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;CAIpB"}