@rekog/mcp-nest 1.9.10 → 2.0.0-alpha.0

package/dist/mcp/index.d.ts

@@ -1,10 +1,14 @@
 export * from './decorators';
 export * from './interfaces';
-export * from './mcp.module';
-export * from './services/mcp-registry-discovery.service';
-export * from './services/mcp-executor.service';
-export * from './services/mcp-sse.service';
-export * from './services/mcp-streamable-http.service';
-export * from './services/mcp-dynamic-registry.service';
-export * from './constants/feature-registration.constants';
+export * from './services/tool-authorization.service';
+export * from './filters/mcp-exception.filter';
+export * from './utils/normalize-endpoint';
+export * from './transport/mcp-transport.constants';
+export * from './transport/mcp-context';
+export * from './transport/mcp-server-options.interface';
+export * from './transport/mcp-transport.interface';
+export * from './transport/mcp-http-handler';
+export * from './transport/mcp.strategy';
+export * from './transport/streamable-http.controller';
+export * from './transport/transports';
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,2CAA2C,CAAC;AAC1D,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,uCAAuC,CAAC;AACtD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAG3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,wCAAwC,CAAC;AACvD,cAAc,wBAAwB,CAAC"}

package/dist/mcp/index.js

@@ -16,11 +16,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./decorators"), exports);
 __exportStar(require("./interfaces"), exports);
-__exportStar(require("./mcp.module"), exports);
-__exportStar(require("./services/mcp-registry-discovery.service"), exports);
-__exportStar(require("./services/mcp-executor.service"), exports);
-__exportStar(require("./services/mcp-sse.service"), exports);
-__exportStar(require("./services/mcp-streamable-http.service"), exports);
-__exportStar(require("./services/mcp-dynamic-registry.service"), exports);
-__exportStar(require("./constants/feature-registration.constants"), exports);
+__exportStar(require("./services/tool-authorization.service"), exports);
+__exportStar(require("./filters/mcp-exception.filter"), exports);
+__exportStar(require("./utils/normalize-endpoint"), exports);
+__exportStar(require("./transport/mcp-transport.constants"), exports);
+__exportStar(require("./transport/mcp-context"), exports);
+__exportStar(require("./transport/mcp-server-options.interface"), exports);
+__exportStar(require("./transport/mcp-transport.interface"), exports);
+__exportStar(require("./transport/mcp-http-handler"), exports);
+__exportStar(require("./transport/mcp.strategy"), exports);
+__exportStar(require("./transport/streamable-http.controller"), exports);
+__exportStar(require("./transport/transports"), exports);
 //# sourceMappingURL=index.js.map

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,+CAA6B;AAC7B,+CAA6B;AAC7B,4EAA0D;AAC1D,kEAAgD;AAChD,6DAA2C;AAC3C,yEAAuD;AACvD,0EAAwD;AACxD,6EAA2D","sourcesContent":["export * from './decorators';\nexport * from './interfaces';\nexport * from './mcp.module';\nexport * from './services/mcp-registry-discovery.service';\nexport * from './services/mcp-executor.service';\nexport * from './services/mcp-sse.service';\nexport * from './services/mcp-streamable-http.service';\nexport * from './services/mcp-dynamic-registry.service';\nexport * from './constants/feature-registration.constants';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,+CAA6B;AAC7B,wEAAsD;AACtD,iEAA+C;AAC/C,6DAA2C;AAG3C,sEAAoD;AACpD,0DAAwC;AACxC,2EAAyD;AACzD,sEAAoD;AACpD,+DAA6C;AAC7C,2DAAyC;AACzC,yEAAuD;AACvD,yDAAuC","sourcesContent":["export * from './decorators';\nexport * from './interfaces';\nexport * from './services/tool-authorization.service';\nexport * from './filters/mcp-exception.filter';\nexport * from './utils/normalize-endpoint';\n\n// Microservice transport strategy API\nexport * from './transport/mcp-transport.constants';\nexport * from './transport/mcp-context';\nexport * from './transport/mcp-server-options.interface';\nexport * from './transport/mcp-transport.interface';\nexport * from './transport/mcp-http-handler';\nexport * from './transport/mcp.strategy';\nexport * from './transport/streamable-http.controller';\nexport * from './transport/transports';\n"]}

package/dist/mcp/interfaces/authenticated-user.interface.d.ts

@@ -0,0 +1,9 @@
+export interface AuthenticatedUser {
+    scope?: string;
+    roles?: string[];
+    user_data?: {
+        roles?: string[];
+    } & Record<string, any>;
+    [key: string]: any;
+}
+//# sourceMappingURL=authenticated-user.interface.d.ts.map

package/dist/mcp/interfaces/authenticated-user.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-user.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/authenticated-user.interface.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAEhC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB,SAAS,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEvD,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB"}

package/dist/{authz/interfaces/request-with-user.js → mcp/interfaces/authenticated-user.interface.js}

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=request-with-user.js.map
+//# sourceMappingURL=authenticated-user.interface.js.map

package/dist/mcp/interfaces/authenticated-user.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-user.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/authenticated-user.interface.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Minimal shape of an authenticated principal as far as the core per-tool\n * authorization logic is concerned.\n *\n * The core module never authenticates anyone itself — a guard or transport-level\n * auth middleware resolves the user and places it on `req.user`. Per-tool checks\n * (`@ToolScopes()`, `@ToolRoles()`) only read scopes and roles off that object, so\n * core depends on this structural type rather than on any concrete token payload.\n *\n * The auth package's richer `JwtPayload` is structurally compatible with this\n * interface, so no coupling back to `@rekog/mcp-nest-auth` is required.\n */\nexport interface AuthenticatedUser {\n  /** OAuth 2.0 space-delimited scope string. */\n  scope?: string;\n  /** Roles carried directly on the principal. */\n  roles?: string[];\n  /** Provider-specific user data; may carry roles. */\n  user_data?: { roles?: string[] } & Record<string, any>;\n  /** Allow additional, provider-specific claims without widening the read surface. */\n  [key: string]: any;\n}\n"]}

package/dist/mcp/interfaces/dynamic-prompt.interface.d.ts

@@ -1,7 +1,7 @@
 import { ZodObject } from 'zod';
 import { Context } from './mcp-tool.interface';
 import type { PromptArgsRawShape } from '../decorators/prompt.decorator';
-export type DynamicPromptHandler = (args: Record<string, string> | undefined, context: Context, request: any) => Promise<any> | any;
+export type DynamicPromptHandler = (args: Record<string, string> | undefined, context: Context, request: any) => any;
 export interface DynamicPromptDefinition {
     name: string;
     description: string;

package/dist/mcp/interfaces/dynamic-prompt.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-prompt.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-prompt.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACxC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAExB,MAAM,WAAW,uBAAuB;IAEtC,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE3C,OAAO,EAAE,oBAAoB,CAAC;CAC/B"}
+{"version":3,"file":"dynamic-prompt.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-prompt.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAEzE,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACxC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,GAAG,CAAC;AAET,MAAM,WAAW,uBAAuB;IAEtC,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAE3C,OAAO,EAAE,oBAAoB,CAAC;CAC/B"}

package/dist/mcp/interfaces/dynamic-prompt.interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-prompt.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-prompt.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { ZodObject } from 'zod';\nimport { Context } from './mcp-tool.interface';\nimport type { PromptArgsRawShape } from '../decorators/prompt.decorator';\n\nexport type DynamicPromptHandler = (\n  args: Record<string, string> | undefined,\n  context: Context,\n  request: any,\n) => Promise<any> | any;\n\nexport interface DynamicPromptDefinition {\n  /** Unique name for the prompt */\n  name: string;\n  /** Description shown to the LLM */\n  description: string;\n  /** Zod schema describing the prompt arguments */\n  parameters?: ZodObject<PromptArgsRawShape>;\n  /** Handler function that returns the prompt messages */\n  handler: DynamicPromptHandler;\n}\n"]}
+{"version":3,"file":"dynamic-prompt.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-prompt.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { ZodObject } from 'zod';\nimport { Context } from './mcp-tool.interface';\nimport type { PromptArgsRawShape } from '../decorators/prompt.decorator';\n\nexport type DynamicPromptHandler = (\n  args: Record<string, string> | undefined,\n  context: Context,\n  request: any,\n) => any;\n\nexport interface DynamicPromptDefinition {\n  /** Unique name for the prompt */\n  name: string;\n  /** Description shown to the LLM */\n  description: string;\n  /** Zod schema describing the prompt arguments */\n  parameters?: ZodObject<PromptArgsRawShape>;\n  /** Handler function that returns the prompt messages */\n  handler: DynamicPromptHandler;\n}\n"]}

package/dist/mcp/interfaces/dynamic-resource.interface.d.ts

@@ -1,5 +1,5 @@
 import { Context } from './mcp-tool.interface';
-export type DynamicResourceHandler = (params: Record<string, unknown>, context: Context, request: any) => Promise<any> | any;
+export type DynamicResourceHandler = (params: Record<string, unknown>, context: Context, request: any) => any;
 export interface DynamicResourceDefinition {
     uri: string;
     name?: string;

package/dist/mcp/interfaces/dynamic-resource.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-resource.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-resource.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,MAAM,sBAAsB,GAAG,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAExB,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE5B,OAAO,EAAE,sBAAsB,CAAC;CACjC"}
+{"version":3,"file":"dynamic-resource.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-resource.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,MAAM,MAAM,sBAAsB,GAAG,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,GAAG,CAAC;AAET,MAAM,WAAW,yBAAyB;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE5B,OAAO,EAAE,sBAAsB,CAAC;CACjC"}

package/dist/mcp/interfaces/dynamic-resource.interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-resource.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-resource.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { Context } from './mcp-tool.interface';\n\nexport type DynamicResourceHandler = (\n  params: Record<string, unknown>,\n  context: Context,\n  request: any,\n) => Promise<any> | any;\n\nexport interface DynamicResourceDefinition {\n  /** URI that uniquely identifies this resource */\n  uri: string;\n  /** Human-readable name (defaults to uri if omitted) */\n  name?: string;\n  /** Optional description shown to the LLM */\n  description?: string;\n  /** Optional MIME type of the resource content */\n  mimeType?: string;\n  /** Additional metadata */\n  _meta?: Record<string, any>;\n  /** Handler function that returns the resource content */\n  handler: DynamicResourceHandler;\n}\n"]}
+{"version":3,"file":"dynamic-resource.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-resource.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { Context } from './mcp-tool.interface';\n\nexport type DynamicResourceHandler = (\n  params: Record<string, unknown>,\n  context: Context,\n  request: any,\n) => any;\n\nexport interface DynamicResourceDefinition {\n  /** URI that uniquely identifies this resource */\n  uri: string;\n  /** Human-readable name (defaults to uri if omitted) */\n  name?: string;\n  /** Optional description shown to the LLM */\n  description?: string;\n  /** Optional MIME type of the resource content */\n  mimeType?: string;\n  /** Additional metadata */\n  _meta?: Record<string, any>;\n  /** Handler function that returns the resource content */\n  handler: DynamicResourceHandler;\n}\n"]}

package/dist/mcp/interfaces/dynamic-tool.interface.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { Context } from './mcp-tool.interface';
 import { ToolAnnotations } from '../decorators/tool.decorator';
-export type DynamicToolHandler = (args: Record<string, unknown>, context: Context, request: any) => Promise<any> | any;
+export type DynamicToolHandler = (args: Record<string, unknown>, context: Context, request: any) => any;
 export interface DynamicToolDefinition {
     name: string;
     description: string;

package/dist/mcp/interfaces/dynamic-tool.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-tool.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-tool.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAM/D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAmBxB,MAAM,WAAW,qBAAqB;IAEpC,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAEvB,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAEzB,WAAW,CAAC,EAAE,eAAe,CAAC;IAE9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE5B,OAAO,EAAE,kBAAkB,CAAC;IAE5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}
+{"version":3,"file":"dynamic-tool.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-tool.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAM/D,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,GAAG,KACT,GAAG,CAAC;AAmBT,MAAM,WAAW,qBAAqB;IAEpC,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAEvB,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAEzB,WAAW,CAAC,EAAE,eAAe,CAAC;IAE9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE5B,OAAO,EAAE,kBAAkB,CAAC;IAE5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B"}

package/dist/mcp/interfaces/dynamic-tool.interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-tool.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-tool.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { z } from 'zod';\nimport { Context } from './mcp-tool.interface';\nimport { ToolAnnotations } from '../decorators/tool.decorator';\n\n/**\n * Handler function signature for dynamically registered tools.\n * Receives the same arguments as decorator-based tools.\n */\nexport type DynamicToolHandler = (\n  args: Record<string, unknown>,\n  context: Context,\n  request: any,\n) => Promise<any> | any;\n\n/**\n * Definition for a dynamically registered tool.\n * Use this with McpRegistryService.registerTool() to register tools at runtime.\n *\n * @example\n * ```typescript\n * registry.registerTool({\n *   name: 'search-knowledge',\n *   description: 'Search the knowledge base',\n *   parameters: z.object({ query: z.string() }),\n *   handler: async (args, context) => {\n *     const results = await searchService.search(args.query);\n *     return { content: [{ type: 'text', text: JSON.stringify(results) }] };\n *   },\n * });\n * ```\n */\nexport interface DynamicToolDefinition {\n  /** Unique name for the tool */\n  name: string;\n  /** Description shown to the LLM */\n  description: string;\n  /** Zod schema for input validation */\n  parameters?: z.ZodType;\n  /** Zod schema for output validation */\n  outputSchema?: z.ZodType;\n  /** MCP tool annotations */\n  annotations?: ToolAnnotations;\n  /** Additional metadata */\n  _meta?: Record<string, any>;\n  /** Handler function that executes the tool */\n  handler: DynamicToolHandler;\n  /** Mark as public (accessible without authentication) */\n  isPublic?: boolean;\n  /** Required OAuth scopes */\n  requiredScopes?: string[];\n  /** Required user roles */\n  requiredRoles?: string[];\n}\n"]}
+{"version":3,"file":"dynamic-tool.interface.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/dynamic-tool.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { z } from 'zod';\nimport { Context } from './mcp-tool.interface';\nimport { ToolAnnotations } from '../decorators/tool.decorator';\n\n/**\n * Handler function signature for dynamically registered tools.\n * Receives the same arguments as decorator-based tools.\n */\nexport type DynamicToolHandler = (\n  args: Record<string, unknown>,\n  context: Context,\n  request: any,\n) => any;\n\n/**\n * Definition for a dynamically registered tool.\n * Use this with `McpStrategy.registerTool()` to register tools at runtime.\n *\n * @example\n * ```typescript\n * registry.registerTool({\n *   name: 'search-knowledge',\n *   description: 'Search the knowledge base',\n *   parameters: z.object({ query: z.string() }),\n *   handler: async (args, context) => {\n *     const results = await searchService.search(args.query);\n *     return { content: [{ type: 'text', text: JSON.stringify(results) }] };\n *   },\n * });\n * ```\n */\nexport interface DynamicToolDefinition {\n  /** Unique name for the tool */\n  name: string;\n  /** Description shown to the LLM */\n  description: string;\n  /** Zod schema for input validation */\n  parameters?: z.ZodType;\n  /** Zod schema for output validation */\n  outputSchema?: z.ZodType;\n  /** MCP tool annotations */\n  annotations?: ToolAnnotations;\n  /** Additional metadata */\n  _meta?: Record<string, any>;\n  /** Handler function that executes the tool */\n  handler: DynamicToolHandler;\n  /** Mark as public (accessible without authentication) */\n  isPublic?: boolean;\n  /** Required OAuth scopes */\n  requiredScopes?: string[];\n  /** Required user roles */\n  requiredRoles?: string[];\n}\n"]}

package/dist/mcp/interfaces/index.d.ts

@@ -1,7 +1,7 @@
-export { McpTransportType } from './mcp-options.interface';
-export type { McpOptions, McpAsyncOptions, McpOptionsFactory, McpModuleAsyncOptions, } from './mcp-options.interface';
+export type { Icon } from '@modelcontextprotocol/sdk/types.js';
 export type { Literal, SerializableValue, McpRequestSchema, McpRequest, Context, } from './mcp-tool.interface';
 export type { HttpRequest } from './http-adapter.interface';
+export type { AuthenticatedUser } from './authenticated-user.interface';
 export type { DynamicToolDefinition, DynamicToolHandler, } from './dynamic-tool.interface';
 export type { DynamicResourceDefinition, DynamicResourceHandler, } from './dynamic-resource.interface';
 export type { DynamicPromptDefinition, DynamicPromptHandler, } from './dynamic-prompt.interface';

package/dist/mcp/interfaces/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,OAAO,EACP,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,OAAO,GACR,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/interfaces/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAE/D,YAAY,EACV,OAAO,EACP,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,OAAO,GACR,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,YAAY,EACV,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/mcp/interfaces/index.js

@@ -1,6 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpTransportType = void 0;
-var mcp_options_interface_1 = require("./mcp-options.interface");
-Object.defineProperty(exports, "McpTransportType", { enumerable: true, get: function () { return mcp_options_interface_1.McpTransportType; } });
 //# sourceMappingURL=index.js.map

package/dist/mcp/interfaces/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/index.ts"],"names":[],"mappings":";;;AAAA,iEAA2D;AAAlD,yHAAA,gBAAgB,OAAA","sourcesContent":["export { McpTransportType } from './mcp-options.interface';\nexport type {\n  McpOptions,\n  McpAsyncOptions,\n  McpOptionsFactory,\n  McpModuleAsyncOptions,\n} from './mcp-options.interface';\n\nexport type {\n  Literal,\n  SerializableValue,\n  McpRequestSchema,\n  McpRequest,\n  Context,\n} from './mcp-tool.interface';\n\nexport type { HttpRequest } from './http-adapter.interface';\n\nexport type {\n  DynamicToolDefinition,\n  DynamicToolHandler,\n} from './dynamic-tool.interface';\n\nexport type {\n  DynamicResourceDefinition,\n  DynamicResourceHandler,\n} from './dynamic-resource.interface';\n\nexport type {\n  DynamicPromptDefinition,\n  DynamicPromptHandler,\n} from './dynamic-prompt.interface';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/interfaces/index.ts"],"names":[],"mappings":"","sourcesContent":["export type { Icon } from '@modelcontextprotocol/sdk/types.js';\n\nexport type {\n  Literal,\n  SerializableValue,\n  McpRequestSchema,\n  McpRequest,\n  Context,\n} from './mcp-tool.interface';\n\nexport type { HttpRequest } from './http-adapter.interface';\n\nexport type { AuthenticatedUser } from './authenticated-user.interface';\n\nexport type {\n  DynamicToolDefinition,\n  DynamicToolHandler,\n} from './dynamic-tool.interface';\n\nexport type {\n  DynamicResourceDefinition,\n  DynamicResourceHandler,\n} from './dynamic-resource.interface';\n\nexport type {\n  DynamicPromptDefinition,\n  DynamicPromptHandler,\n} from './dynamic-prompt.interface';\n"]}

package/dist/mcp/services/tool-authorization.service.d.ts

@@ -1,10 +1,12 @@
-import { DiscoveredCapability } from './mcp-registry-discovery.service';
 import { ToolMetadata, SecurityScheme } from '../decorators/tool.decorator';
-import { JwtPayload } from '../../authz/services/jwt-token.service';
+import { AuthenticatedUser } from '../interfaces/authenticated-user.interface';
+export interface AuthorizableTool {
+    metadata: ToolMetadata;
+}
 export declare class ToolAuthorizationService {
-    generateSecuritySchemes(tool: DiscoveredCapability<ToolMetadata>, moduleHasGuards: boolean): SecurityScheme[];
-    canAccessTool(user: JwtPayload | undefined, tool: DiscoveredCapability<ToolMetadata>, moduleHasGuards: boolean, allowUnauthenticatedAccess?: boolean): boolean;
-    validateToolAccess(user: JwtPayload | undefined, tool: DiscoveredCapability<ToolMetadata>, moduleHasGuards: boolean, allowUnauthenticatedAccess?: boolean): void;
+    generateSecuritySchemes(tool: AuthorizableTool, freemiumMode: boolean): SecurityScheme[];
+    canAccessTool(user: AuthenticatedUser | undefined, tool: AuthorizableTool, allowUnauthenticatedAccess?: boolean): boolean;
+    validateToolAccess(user: AuthenticatedUser | undefined, tool: AuthorizableTool, allowUnauthenticatedAccess?: boolean): void;
     private hasRequiredScopes;
     private hasRequiredRoles;
 }

package/dist/mcp/services/tool-authorization.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-authorization.service.d.ts","sourceRoot":"","sources":["../../../src/mcp/services/tool-authorization.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,wCAAwC,CAAC;AAKpE,qBACa,wBAAwB;IAQnC,uBAAuB,CACrB,IAAI,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACxC,eAAe,EAAE,OAAO,GACvB,cAAc,EAAE;IAmCnB,aAAa,CACX,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,IAAI,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACxC,eAAe,EAAE,OAAO,EACxB,0BAA0B,GAAE,OAAe,GAC1C,OAAO;IAuEV,kBAAkB,CAChB,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,IAAI,EAAE,oBAAoB,CAAC,YAAY,CAAC,EACxC,eAAe,EAAE,OAAO,EACxB,0BAA0B,GAAE,OAAe,GAC1C,IAAI;IAiFP,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,gBAAgB;CAwBzB"}
+{"version":3,"file":"tool-authorization.service.d.ts","sourceRoot":"","sources":["../../../src/mcp/services/tool-authorization.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAG/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;CACxB;AAeD,qBACa,wBAAwB;IAYnC,uBAAuB,CACrB,IAAI,EAAE,gBAAgB,EACtB,YAAY,EAAE,OAAO,GACpB,cAAc,EAAE;IAsCnB,aAAa,CACX,IAAI,EAAE,iBAAiB,GAAG,SAAS,EACnC,IAAI,EAAE,gBAAgB,EACtB,0BAA0B,GAAE,OAAe,GAC1C,OAAO;IAuDV,kBAAkB,CAChB,IAAI,EAAE,iBAAiB,GAAG,SAAS,EACnC,IAAI,EAAE,gBAAgB,EACtB,0BAA0B,GAAE,OAAe,GAC1C,IAAI;IA0DP,OAAO,CAAC,iBAAiB;IA8BzB,OAAO,CAAC,gBAAgB;CAwBzB"}

package/dist/mcp/services/tool-authorization.service.js

@@ -10,7 +10,7 @@ exports.ToolAuthorizationService = void 0;
 const common_1 = require("@nestjs/common");
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 let ToolAuthorizationService = class ToolAuthorizationService {
-    generateSecuritySchemes(tool, moduleHasGuards) {
+    generateSecuritySchemes(tool, freemiumMode) {
         const metadata = tool.metadata;
         const schemes = [];
         if (metadata.isPublic) {
@@ -19,7 +19,10 @@ let ToolAuthorizationService = class ToolAuthorizationService {
         if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {
             schemes.push({ type: 'oauth2', scopes: metadata.requiredScopes });
         }
-        else if (moduleHasGuards && !metadata.isPublic) {
+        else if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {
+            schemes.push({ type: 'oauth2' });
+        }
+        else if (freemiumMode && !metadata.isPublic) {
             schemes.push({ type: 'oauth2' });
         }
         if (schemes.length === 0) {
@@ -27,7 +30,7 @@ let ToolAuthorizationService = class ToolAuthorizationService {
         }
         return schemes;
     }
-    canAccessTool(user, tool, moduleHasGuards, allowUnauthenticatedAccess = false) {
+    canAccessTool(user, tool, allowUnauthenticatedAccess = false) {
         const metadata = tool.metadata;
         if (metadata.isPublic) {
             return true;
@@ -47,12 +50,12 @@ let ToolAuthorizationService = class ToolAuthorizationService {
                 return false;
             }
         }
-        if (allowUnauthenticatedAccess && moduleHasGuards && !user) {
+        if (allowUnauthenticatedAccess && !user) {
             return false;
         }
         return true;
     }
-    validateToolAccess(user, tool, moduleHasGuards, allowUnauthenticatedAccess = false) {
+    validateToolAccess(user, tool, allowUnauthenticatedAccess = false) {
         const metadata = tool.metadata;
         const toolName = metadata.name;
         if (metadata.isPublic) {
@@ -73,7 +76,7 @@ let ToolAuthorizationService = class ToolAuthorizationService {
                 throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, `Tool '${toolName}' requires roles: ${metadata.requiredRoles.join(', ')}`);
             }
         }
-        if (allowUnauthenticatedAccess && moduleHasGuards && !user) {
+        if (allowUnauthenticatedAccess && !user) {
             throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidRequest, `Tool '${toolName}' requires authentication`);
         }
     }

package/dist/mcp/services/tool-authorization.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-authorization.service.js","sourceRoot":"","sources":["../../../src/mcp/services/tool-authorization.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAC5C,iEAAyE;AASlE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAQnC,uBAAuB,CACrB,IAAwC,EACxC,eAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAqB,EAAE,CAAC;QAGrC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;QACpE,CAAC;aAEI,IAAI,eAAe,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAGD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAWD,aAAa,CACX,IAA4B,EAC5B,IAAwC,EACxC,eAAwB,EACxB,6BAAsC,KAAK;QAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAG/B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,uBAAuB,GAC3B,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAGD,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAoBD,IAAI,0BAA0B,IAAI,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;YAG3D,OAAO,KAAK,CAAC;QACf,CAAC;QAMD,OAAO,IAAI,CAAC;IACd,CAAC;IAWD,kBAAkB,CAChB,IAA4B,EAC5B,IAAwC,EACxC,eAAwB,EACxB,6BAAsC,KAAK;QAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAG/B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAGD,MAAM,uBAAuB,GAC3B,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,2BAA2B,CAC7C,CAAC;QACJ,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,sBAAsB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,qBAAqB,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QAoBD,IAAI,0BAA0B,IAAI,eAAe,IAAI,CAAC,IAAI,EAAE,CAAC;YAG3D,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,2BAA2B,CAC7C,CAAC;QACJ,CAAC;IAMH,CAAC;IASO,iBAAiB,CACvB,IAA4B,EAC5B,cAAwB;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,UAAU,GAAa,EAAE,CAAC;QAE9B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAEf,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAK,IAAY,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAE,IAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAEvE,UAAU,GAAI,IAAY,CAAC,MAAM,CAAC;QACpC,CAAC;QAGD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IASO,gBAAgB,CACtB,IAA4B,EAC5B,aAAuB;QAEvB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,SAAS,GAAa,EAAE,CAAC;QAE7B,IAAK,IAAY,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAE,IAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,SAAS,GAAI,IAAY,CAAC,KAAK,CAAC;QAClC,CAAC;aAAM,IACL,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS,CAAC,KAAK;YACpB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACnC,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACnC,CAAC;QAGD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AAtQY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CAsQpC","sourcesContent":["import { Injectable } from '@nestjs/common';\nimport { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';\nimport { DiscoveredCapability } from './mcp-registry-discovery.service';\nimport { ToolMetadata, SecurityScheme } from '../decorators/tool.decorator';\nimport { JwtPayload } from '../../authz/services/jwt-token.service';\n\n/**\n * Service responsible for tool-level authorization logic\n */\n@Injectable()\nexport class ToolAuthorizationService {\n  /**\n   * Generate security schemes for a tool based on its metadata and module configuration\n   *\n   * @param tool - The discovered tool\n   * @param moduleHasGuards - Whether the module has guards configured\n   * @returns Array of security schemes for the tool\n   */\n  generateSecuritySchemes(\n    tool: DiscoveredCapability<ToolMetadata>,\n    moduleHasGuards: boolean,\n  ): SecurityScheme[] {\n    const metadata = tool.metadata;\n    const schemes: SecurityScheme[] = [];\n\n    // If tool is marked as @PublicTool(), it can be accessed without auth\n    if (metadata.isPublic) {\n      schemes.push({ type: 'noauth' });\n    }\n\n    // If tool has required scopes, add oauth2 scheme with those scopes\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      schemes.push({ type: 'oauth2', scopes: metadata.requiredScopes });\n    }\n    // Else if module has guards and tool is not public, require oauth2\n    else if (moduleHasGuards && !metadata.isPublic) {\n      schemes.push({ type: 'oauth2' });\n    }\n\n    // If no schemes were added, tool is accessible without authentication\n    if (schemes.length === 0) {\n      schemes.push({ type: 'noauth' });\n    }\n\n    return schemes;\n  }\n\n  /**\n   * Check if a user can access a tool based on security requirements\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param tool - The discovered tool\n   * @param moduleHasGuards - Whether the module has guards configured\n   * @param allowUnauthenticatedAccess - Whether unauthenticated access is allowed (freemium mode)\n   * @returns true if user can access the tool, false otherwise\n   */\n  canAccessTool(\n    user: JwtPayload | undefined,\n    tool: DiscoveredCapability<ToolMetadata>,\n    moduleHasGuards: boolean,\n    allowUnauthenticatedAccess: boolean = false,\n  ): boolean {\n    const metadata = tool.metadata;\n\n    // If tool is public, always allow access\n    if (metadata.isPublic) {\n      return true;\n    }\n\n    // If tool has specific scope/role requirements, user MUST be authenticated\n    const hasSpecificRequirements =\n      (metadata.requiredScopes && metadata.requiredScopes.length > 0) ||\n      (metadata.requiredRoles && metadata.requiredRoles.length > 0);\n\n    if (hasSpecificRequirements && !user) {\n      return false;\n    }\n\n    // If tool has specific scopes, validate them\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      if (!this.hasRequiredScopes(user, metadata.requiredScopes)) {\n        return false;\n      }\n    }\n\n    // If tool has specific roles, validate them\n    if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {\n      if (!this.hasRequiredRoles(user, metadata.requiredRoles)) {\n        return false;\n      }\n    }\n\n    // At this point:\n    // - Tool is not public\n    // - Tool has no specific scope/role requirements (or they passed)\n    //\n    // Decision logic based on allowUnauthenticatedAccess:\n    //\n    // allowUnauthenticatedAccess = false (default, standard auth mode):\n    // - Guards are expected to fully authorize requests (via JWT, API keys, etc)\n    // - If guard let request through AND there's no user object:\n    //   * Guard used non-JWT auth mechanism (API key, IP whitelist, etc)\n    //   * Trust the guard's decision to authorize\n    // - If no guards configured, allow access (no auth required)\n    //\n    // allowUnauthenticatedAccess = true (freemium mode):\n    // - Guards may let unauthenticated requests through for per-tool auth\n    // - Only @PublicTool or tools with specific scopes/roles accessible\n    // - Tools without decorators require authentication (user must be present)\n    //\n    if (allowUnauthenticatedAccess && moduleHasGuards && !user) {\n      // Freemium mode: unauthenticated access only for @PublicTool or specific scopes\n      // This tool has no decorators, so it requires authentication\n      return false;\n    }\n\n    // Standard mode: If we're here, either:\n    // - No guards (open access)\n    // - Guards authorized it (trust guard decision, even without user object)\n    // - User is present and passed all checks\n    return true;\n  }\n\n  /**\n   * Validate that a user can access a tool, throwing an error if not authorized\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param tool - The discovered tool\n   * @param moduleHasGuards - Whether the module has guards configured\n   * @param allowUnauthenticatedAccess - Whether unauthenticated access is allowed (freemium mode)\n   * @throws McpError if user is not authorized to access the tool\n   */\n  validateToolAccess(\n    user: JwtPayload | undefined,\n    tool: DiscoveredCapability<ToolMetadata>,\n    moduleHasGuards: boolean,\n    allowUnauthenticatedAccess: boolean = false,\n  ): void {\n    const metadata = tool.metadata;\n    const toolName = metadata.name;\n\n    // If tool is public, allow access\n    if (metadata.isPublic) {\n      return;\n    }\n\n    // Check if tool has specific scope/role requirements\n    const hasSpecificRequirements =\n      (metadata.requiredScopes && metadata.requiredScopes.length > 0) ||\n      (metadata.requiredRoles && metadata.requiredRoles.length > 0);\n\n    if (hasSpecificRequirements && !user) {\n      throw new McpError(\n        ErrorCode.InvalidRequest,\n        `Tool '${toolName}' requires authentication`,\n      );\n    }\n\n    // Validate scopes if required\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      if (!this.hasRequiredScopes(user, metadata.requiredScopes)) {\n        throw new McpError(\n          ErrorCode.InvalidRequest,\n          `Tool '${toolName}' requires scopes: ${metadata.requiredScopes.join(', ')}`,\n        );\n      }\n    }\n\n    // Validate roles if required\n    if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {\n      if (!this.hasRequiredRoles(user, metadata.requiredRoles)) {\n        throw new McpError(\n          ErrorCode.InvalidRequest,\n          `Tool '${toolName}' requires roles: ${metadata.requiredRoles.join(', ')}`,\n        );\n      }\n    }\n\n    // At this point:\n    // - Tool is not public\n    // - Tool has no specific scope/role requirements (or they passed)\n    //\n    // Decision logic based on allowUnauthenticatedAccess:\n    //\n    // allowUnauthenticatedAccess = false (default, standard auth mode):\n    // - Guards are expected to fully authorize requests (via JWT, API keys, etc)\n    // - If guard let request through AND there's no user object:\n    //   * Guard used non-JWT auth mechanism (API key, IP whitelist, etc)\n    //   * Trust the guard's decision to authorize\n    // - If no guards configured, allow access (no auth required)\n    //\n    // allowUnauthenticatedAccess = true (freemium mode):\n    // - Guards may let unauthenticated requests through for per-tool auth\n    // - Only @PublicTool or tools with specific scopes/roles accessible\n    // - Tools without decorators require authentication (user must be present)\n    //\n    if (allowUnauthenticatedAccess && moduleHasGuards && !user) {\n      // Freemium mode: unauthenticated access only for @PublicTool or specific scopes\n      // This tool has no decorators, so it requires authentication\n      throw new McpError(\n        ErrorCode.InvalidRequest,\n        `Tool '${toolName}' requires authentication`,\n      );\n    }\n\n    // Standard mode: If we're here, either:\n    // - No guards (open access)\n    // - Guards authorized it (trust guard decision, even without user object)\n    // - User is present and passed all checks\n  }\n\n  /**\n   * Check if user has all required scopes\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param requiredScopes - Array of required scope strings\n   * @returns true if user has all required scopes\n   */\n  private hasRequiredScopes(\n    user: JwtPayload | undefined,\n    requiredScopes: string[],\n  ): boolean {\n    if (!user) {\n      return false;\n    }\n\n    // Get user scopes - could be in 'scope' (space-delimited string) or 'scopes' (array)\n    let userScopes: string[] = [];\n\n    if (user.scope) {\n      // OAuth 2.0 standard: space-delimited string\n      userScopes = user.scope.split(' ').filter((s) => s.length > 0);\n    } else if ((user as any).scopes && Array.isArray((user as any).scopes)) {\n      // Alternative: array of scopes\n      userScopes = (user as any).scopes;\n    }\n\n    // Check if user has ALL required scopes\n    return requiredScopes.every((required) => userScopes.includes(required));\n  }\n\n  /**\n   * Check if user has all required roles\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param requiredRoles - Array of required role strings\n   * @returns true if user has all required roles\n   */\n  private hasRequiredRoles(\n    user: JwtPayload | undefined,\n    requiredRoles: string[],\n  ): boolean {\n    if (!user) {\n      return false;\n    }\n\n    // Get user roles from user data\n    let userRoles: string[] = [];\n\n    if ((user as any).roles && Array.isArray((user as any).roles)) {\n      userRoles = (user as any).roles;\n    } else if (\n      user.user_data &&\n      user.user_data.roles &&\n      Array.isArray(user.user_data.roles)\n    ) {\n      userRoles = user.user_data.roles;\n    }\n\n    // Check if user has ALL required roles\n    return requiredRoles.every((required) => userRoles.includes(required));\n  }\n}\n"]}
+{"version":3,"file":"tool-authorization.service.js","sourceRoot":"","sources":["../../../src/mcp/services/tool-authorization.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAC5C,iEAAyE;AAuBlE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAYnC,uBAAuB,CACrB,IAAsB,EACtB,YAAqB;QAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,OAAO,GAAqB,EAAE,CAAC;QAGrC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;QACpE,CAAC;aAEI,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;aAEI,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAGD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAUD,aAAa,CACX,IAAmC,EACnC,IAAsB,EACtB,6BAAsC,KAAK;QAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAG/B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,uBAAuB,GAC3B,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAGD,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAWD,IAAI,0BAA0B,IAAI,CAAC,IAAI,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAUD,kBAAkB,CAChB,IAAmC,EACnC,IAAsB,EACtB,6BAAsC,KAAK;QAE3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;QAG/B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAGD,MAAM,uBAAuB,GAC3B,CAAC,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,CAAC,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEhE,IAAI,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,2BAA2B,CAC7C,CAAC;QACJ,CAAC;QAGD,IAAI,QAAQ,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,sBAAsB,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;YACJ,CAAC;QACH,CAAC;QAGD,IAAI,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,qBAAqB,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QAID,IAAI,0BAA0B,IAAI,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAQ,CAChB,oBAAS,CAAC,cAAc,EACxB,SAAS,QAAQ,2BAA2B,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IASO,iBAAiB,CACvB,IAAmC,EACnC,cAAwB;QAExB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,UAAU,GAAa,EAAE,CAAC;QAE9B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAEf,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,IAAK,IAAY,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAE,IAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAEvE,UAAU,GAAI,IAAY,CAAC,MAAM,CAAC;QACpC,CAAC;QAGD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3E,CAAC;IASO,gBAAgB,CACtB,IAAmC,EACnC,aAAuB;QAEvB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,SAAS,GAAa,EAAE,CAAC;QAE7B,IAAK,IAAY,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAE,IAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,SAAS,GAAI,IAAY,CAAC,KAAK,CAAC;QAClC,CAAC;aAAM,IACL,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS,CAAC,KAAK;YACpB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EACnC,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACnC,CAAC;QAGD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AApOY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CAoOpC","sourcesContent":["import { Injectable } from '@nestjs/common';\nimport { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';\nimport { ToolMetadata, SecurityScheme } from '../decorators/tool.decorator';\nimport { AuthenticatedUser } from '../interfaces/authenticated-user.interface';\n\n/** Minimal shape the authorization logic needs: a capability carrying tool metadata. */\nexport interface AuthorizableTool {\n  metadata: ToolMetadata;\n}\n\n/**\n * Per-tool authorization.\n *\n * This service powers `tools/list` filtering and the `tools/call` access check\n * based purely on the per-tool decorators (`@PublicTool()`, `@ToolScopes()`,\n * `@ToolRoles()`) and the user resolved off the raw request (`req.user`, set by\n * a guard or by transport-level auth middleware).\n *\n * It is intentionally NOT an authentication mechanism: real enforcement is the\n * job of standard NestJS `@UseGuards()` (which run inside the RPC pipeline at\n * call time) and/or auth middleware on the HTTP routes. This service only\n * decides which tools a *known* principal may see and invoke.\n */\n@Injectable()\nexport class ToolAuthorizationService {\n  /**\n   * Generate security schemes for a tool, advertised to clients (e.g. ChatGPT)\n   * via the OpenAI `securitySchemes` spec so they know which tools need auth.\n   *\n   * @param tool - The discovered tool\n   * @param freemiumMode - Whether the server runs in freemium mode\n   *   (`allowUnauthenticatedAccess`). In freemium mode an undecorated,\n   *   non-public tool still requires authentication, so it is advertised as\n   *   `oauth2`.\n   * @returns Array of security schemes for the tool\n   */\n  generateSecuritySchemes(\n    tool: AuthorizableTool,\n    freemiumMode: boolean,\n  ): SecurityScheme[] {\n    const metadata = tool.metadata;\n    const schemes: SecurityScheme[] = [];\n\n    // If tool is marked as @PublicTool(), it can be accessed without auth\n    if (metadata.isPublic) {\n      schemes.push({ type: 'noauth' });\n    }\n\n    // If tool has required scopes, add oauth2 scheme with those scopes\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      schemes.push({ type: 'oauth2', scopes: metadata.requiredScopes });\n    }\n    // Else if tool requires specific roles, advertise that auth is needed\n    else if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {\n      schemes.push({ type: 'oauth2' });\n    }\n    // Else, in freemium mode a non-public tool still requires authentication\n    else if (freemiumMode && !metadata.isPublic) {\n      schemes.push({ type: 'oauth2' });\n    }\n\n    // If no schemes were added, tool is accessible without authentication\n    if (schemes.length === 0) {\n      schemes.push({ type: 'noauth' });\n    }\n\n    return schemes;\n  }\n\n  /**\n   * Check if a user can access a tool based on its per-tool requirements.\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param tool - The discovered tool\n   * @param allowUnauthenticatedAccess - Whether unauthenticated access is allowed (freemium mode)\n   * @returns true if the user can access the tool, false otherwise\n   */\n  canAccessTool(\n    user: AuthenticatedUser | undefined,\n    tool: AuthorizableTool,\n    allowUnauthenticatedAccess: boolean = false,\n  ): boolean {\n    const metadata = tool.metadata;\n\n    // If tool is public, always allow access\n    if (metadata.isPublic) {\n      return true;\n    }\n\n    // If tool has specific scope/role requirements, user MUST be authenticated\n    const hasSpecificRequirements =\n      (metadata.requiredScopes && metadata.requiredScopes.length > 0) ||\n      (metadata.requiredRoles && metadata.requiredRoles.length > 0);\n\n    if (hasSpecificRequirements && !user) {\n      return false;\n    }\n\n    // If tool has specific scopes, validate them\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      if (!this.hasRequiredScopes(user, metadata.requiredScopes)) {\n        return false;\n      }\n    }\n\n    // If tool has specific roles, validate them\n    if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {\n      if (!this.hasRequiredRoles(user, metadata.requiredRoles)) {\n        return false;\n      }\n    }\n\n    // At this point the tool is not public and has no (or satisfied) scope/role\n    // requirements. The only remaining question is the undecorated tool:\n    //\n    // - Freemium mode (allowUnauthenticatedAccess = true): anonymous callers may\n    //   only reach @PublicTool() (or specifically-scoped) tools, so an\n    //   undecorated tool requires a user.\n    // - Standard mode (default): real enforcement is delegated to @UseGuards /\n    //   auth middleware, so we trust that decision and allow access. (On stdio\n    //   there is no request and no user — all undecorated tools are reachable.)\n    if (allowUnauthenticatedAccess && !user) {\n      return false;\n    }\n\n    return true;\n  }\n\n  /**\n   * Validate that a user can access a tool, throwing an error if not authorized.\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param tool - The discovered tool\n   * @param allowUnauthenticatedAccess - Whether unauthenticated access is allowed (freemium mode)\n   * @throws McpError if user is not authorized to access the tool\n   */\n  validateToolAccess(\n    user: AuthenticatedUser | undefined,\n    tool: AuthorizableTool,\n    allowUnauthenticatedAccess: boolean = false,\n  ): void {\n    const metadata = tool.metadata;\n    const toolName = metadata.name;\n\n    // If tool is public, allow access\n    if (metadata.isPublic) {\n      return;\n    }\n\n    // Check if tool has specific scope/role requirements\n    const hasSpecificRequirements =\n      (metadata.requiredScopes && metadata.requiredScopes.length > 0) ||\n      (metadata.requiredRoles && metadata.requiredRoles.length > 0);\n\n    if (hasSpecificRequirements && !user) {\n      throw new McpError(\n        ErrorCode.InvalidRequest,\n        `Tool '${toolName}' requires authentication`,\n      );\n    }\n\n    // Validate scopes if required\n    if (metadata.requiredScopes && metadata.requiredScopes.length > 0) {\n      if (!this.hasRequiredScopes(user, metadata.requiredScopes)) {\n        throw new McpError(\n          ErrorCode.InvalidRequest,\n          `Tool '${toolName}' requires scopes: ${metadata.requiredScopes.join(', ')}`,\n        );\n      }\n    }\n\n    // Validate roles if required\n    if (metadata.requiredRoles && metadata.requiredRoles.length > 0) {\n      if (!this.hasRequiredRoles(user, metadata.requiredRoles)) {\n        throw new McpError(\n          ErrorCode.InvalidRequest,\n          `Tool '${toolName}' requires roles: ${metadata.requiredRoles.join(', ')}`,\n        );\n      }\n    }\n\n    // Freemium mode: an undecorated, non-public tool still requires a user.\n    // Standard mode trusts @UseGuards / auth middleware (see canAccessTool).\n    if (allowUnauthenticatedAccess && !user) {\n      throw new McpError(\n        ErrorCode.InvalidRequest,\n        `Tool '${toolName}' requires authentication`,\n      );\n    }\n  }\n\n  /**\n   * Check if user has all required scopes\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param requiredScopes - Array of required scope strings\n   * @returns true if user has all required scopes\n   */\n  private hasRequiredScopes(\n    user: AuthenticatedUser | undefined,\n    requiredScopes: string[],\n  ): boolean {\n    if (!user) {\n      return false;\n    }\n\n    // Get user scopes - could be in 'scope' (space-delimited string) or 'scopes' (array)\n    let userScopes: string[] = [];\n\n    if (user.scope) {\n      // OAuth 2.0 standard: space-delimited string\n      userScopes = user.scope.split(' ').filter((s) => s.length > 0);\n    } else if ((user as any).scopes && Array.isArray((user as any).scopes)) {\n      // Alternative: array of scopes\n      userScopes = (user as any).scopes;\n    }\n\n    // Check if user has ALL required scopes\n    return requiredScopes.every((required) => userScopes.includes(required));\n  }\n\n  /**\n   * Check if user has all required roles\n   *\n   * @param user - The authenticated user (may be undefined)\n   * @param requiredRoles - Array of required role strings\n   * @returns true if user has all required roles\n   */\n  private hasRequiredRoles(\n    user: AuthenticatedUser | undefined,\n    requiredRoles: string[],\n  ): boolean {\n    if (!user) {\n      return false;\n    }\n\n    // Get user roles from user data\n    let userRoles: string[] = [];\n\n    if ((user as any).roles && Array.isArray((user as any).roles)) {\n      userRoles = (user as any).roles;\n    } else if (\n      user.user_data &&\n      user.user_data.roles &&\n      Array.isArray(user.user_data.roles)\n    ) {\n      userRoles = user.user_data.roles;\n    }\n\n    // Check if user has ALL required roles\n    return requiredRoles.every((required) => userRoles.includes(required));\n  }\n}\n"]}

package/dist/mcp/transport/mcp-context.d.ts

@@ -0,0 +1,34 @@
+import { Logger } from '@nestjs/common';
+import { BaseRpcContext } from '@nestjs/microservices';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { Progress } from '@modelcontextprotocol/sdk/types.js';
+import { Context, McpRequest } from '../interfaces';
+export type McpTransportKind = 'stdio' | 'streamable-http';
+export interface McpSessionInfo {
+    sessionId?: string;
+    transport: McpTransportKind;
+    stateless: boolean;
+}
+type McpContextArgs = [
+    mcpServer: McpServer,
+    mcpRequest: McpRequest,
+    session: McpSessionInfo,
+    rawRequest: unknown
+];
+export declare class McpContext extends BaseRpcContext<McpContextArgs> implements Context {
+    private readonly logger?;
+    readonly reportProgress: (progress: Progress) => Promise<void>;
+    readonly log: Context['log'];
+    constructor(args: McpContextArgs, logger?: Logger | undefined);
+    get mcpServer(): McpServer;
+    get mcpRequest(): McpRequest;
+    getSession(): McpSessionInfo;
+    getRawRequest<T = unknown>(): T | undefined;
+    private get progressToken();
+    private createReportProgress;
+    private createLog;
+    private createStatelessReportProgress;
+    private createStatelessLog;
+}
+export {};
+//# sourceMappingURL=mcp-context.d.ts.map

package/dist/mcp/transport/mcp-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-context.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAqB,MAAM,eAAe,CAAC;AAEvE,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,iBAAiB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAE7B,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,gBAAgB,CAAC;IAM5B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,KAAK,cAAc,GAAG;IACpB,SAAS,EAAE,SAAS;IACpB,UAAU,EAAE,UAAU;IACtB,OAAO,EAAE,cAAc;IACvB,UAAU,EAAE,OAAO;CACpB,CAAC;AAYF,qBAAa,UACX,SAAQ,cAAc,CAAC,cAAc,CACrC,YAAW,OAAO;IAOhB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAL1B,SAAgB,cAAc,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,SAAgB,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAGlC,IAAI,EAAE,cAAc,EACH,MAAM,CAAC,EAAE,MAAM,YAAA;IAYlC,IAAI,SAAS,IAAI,SAAS,CAEzB;IAGD,IAAI,UAAU,IAAI,UAAU,CAE3B;IAGD,UAAU,IAAI,cAAc;IAK5B,aAAa,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,SAAS;IAI3C,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,SAAS;IAmBjB,OAAO,CAAC,6BAA6B;IAWrC,OAAO,CAAC,kBAAkB;CAY3B"}

package/dist/mcp/transport/mcp-context.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpContext = void 0;
+const microservices_1 = require("@nestjs/microservices");
+class McpContext extends microservices_1.BaseRpcContext {
+    constructor(args, logger) {
+        super(args);
+        this.logger = logger;
+        this.reportProgress = this.getSession().stateless
+            ? this.createStatelessReportProgress()
+            : this.createReportProgress();
+        this.log = this.getSession().stateless
+            ? this.createStatelessLog()
+            : this.createLog();
+    }
+    get mcpServer() {
+        return this.args[0];
+    }
+    get mcpRequest() {
+        return this.args[1];
+    }
+    getSession() {
+        return this.args[2];
+    }
+    getRawRequest() {
+        return this.args[3];
+    }
+    get progressToken() {
+        return this.mcpRequest.params?._meta?.progressToken;
+    }
+    createReportProgress() {
+        return async (progress) => {
+            const progressToken = this.progressToken;
+            if (progressToken === undefined) {
+                return;
+            }
+            await this.mcpServer.server.notification({
+                method: 'notifications/progress',
+                params: { ...progress, progressToken },
+            });
+        };
+    }
+    createLog() {
+        const send = (level, message, context) => {
+            void this.mcpServer.server.sendLoggingMessage({
+                level,
+                data: { message, context },
+            });
+        };
+        return {
+            debug: (message, context) => send('debug', message, context),
+            info: (message, context) => send('info', message, context),
+            warn: (message, context) => send('warning', message, context),
+            error: (message, context) => send('error', message, context),
+        };
+    }
+    createStatelessReportProgress() {
+        return () => {
+            this.logger?.warn("Stateless context: 'reportProgress' is not supported.");
+            return Promise.resolve();
+        };
+    }
+    createStatelessLog() {
+        const warn = () => this.logger?.warn('Stateless context: server-side logging is not supported.');
+        return {
+            debug: () => warn(),
+            info: () => warn(),
+            warn: () => warn(),
+            error: () => warn(),
+        };
+    }
+}
+exports.McpContext = McpContext;
+//# sourceMappingURL=mcp-context.js.map

package/dist/mcp/transport/mcp-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-context.js","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-context.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AAqCvD,MAAa,UACX,SAAQ,8BAA8B;IAMtC,YACE,IAAoB,EACH,MAAe;QAEhC,KAAK,CAAC,IAAI,CAAC,CAAC;QAFK,WAAM,GAAN,MAAM,CAAS;QAGhC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS;YAC/C,CAAC,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACtC,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS;YACpC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACvB,CAAC;IAGD,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAGD,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAGD,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAGD,aAAa;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAkB,CAAC;IACvC,CAAC;IAED,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,CAAC;IACtD,CAAC;IAEO,oBAAoB;QAC1B,OAAO,KAAK,EAAE,QAAkB,EAAE,EAAE;YAClC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;YACzC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC;gBACvC,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAc;aACnD,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,CACX,KAA6C,EAC7C,OAAe,EACf,OAA2B,EAC3B,EAAE;YACF,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC;gBAC5C,KAAK;gBACL,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC,CAAC;QACF,OAAO;YACL,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YAC5D,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;YAC1D,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;YAC7D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;SAC7D,CAAC;IACJ,CAAC;IAEO,6BAA6B;QAGnC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,uDAAuD,CACxD,CAAC;YACF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,0DAA0D,CAC3D,CAAC;QACJ,OAAO;YACL,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YACnB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;YAClB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE;SACpB,CAAC;IACJ,CAAC;CACF;AAnGD,gCAmGC","sourcesContent":["import { Logger } from '@nestjs/common';\nimport { BaseRpcContext } from '@nestjs/microservices';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { Progress } from '@modelcontextprotocol/sdk/types.js';\nimport { Context, McpRequest, SerializableValue } from '../interfaces';\n\nexport type McpTransportKind = 'stdio' | 'streamable-http';\n\nexport interface McpSessionInfo {\n  /** The MCP session id, when the transport is session-aware. */\n  sessionId?: string;\n  /** Which transport delivered this request. */\n  transport: McpTransportKind;\n  /**\n   * `true` only for the per-request streamable-HTTP stateless mode, where the\n   * server cannot push notifications/progress back to the client. stdio and\n   * stateful streamable-HTTP are both session-aware (`false`).\n   */\n  stateless: boolean;\n}\n\ntype McpContextArgs = [\n  mcpServer: McpServer,\n  mcpRequest: McpRequest,\n  session: McpSessionInfo,\n  rawRequest: unknown,\n];\n\n/**\n * Execution context handed to every MCP capability handler via `@Ctx()`.\n *\n * Extends NestJS's {@link BaseRpcContext} so it is resolved as the RPC context\n * argument (the strategy invokes handlers as `handler(payload, mcpContext)`),\n * and implements the library's {@link Context} surface (`reportProgress`, `log`,\n * `mcpServer`, `mcpRequest`) so existing handler code keeps working.\n *\n * Additional accessors expose the session and the raw transport request.\n */\nexport class McpContext\n  extends BaseRpcContext<McpContextArgs>\n  implements Context\n{\n  public readonly reportProgress: (progress: Progress) => Promise<void>;\n  public readonly log: Context['log'];\n\n  constructor(\n    args: McpContextArgs,\n    private readonly logger?: Logger,\n  ) {\n    super(args);\n    this.reportProgress = this.getSession().stateless\n      ? this.createStatelessReportProgress()\n      : this.createReportProgress();\n    this.log = this.getSession().stateless\n      ? this.createStatelessLog()\n      : this.createLog();\n  }\n\n  /** The underlying MCP SDK server instance. */\n  get mcpServer(): McpServer {\n    return this.args[0];\n  }\n\n  /** The parsed JSON-RPC request (tools/call, resources/read, prompts/get, ...). */\n  get mcpRequest(): McpRequest {\n    return this.args[1];\n  }\n\n  /** Session metadata for this request. */\n  getSession(): McpSessionInfo {\n    return this.args[2];\n  }\n\n  /** The raw transport request (Express/Fastify request for HTTP; `undefined` for stdio). */\n  getRawRequest<T = unknown>(): T | undefined {\n    return this.args[3] as T | undefined;\n  }\n\n  private get progressToken(): string | number | undefined {\n    return this.mcpRequest.params?._meta?.progressToken;\n  }\n\n  private createReportProgress(): (progress: Progress) => Promise<void> {\n    return async (progress: Progress) => {\n      const progressToken = this.progressToken;\n      if (progressToken === undefined) {\n        return;\n      }\n      await this.mcpServer.server.notification({\n        method: 'notifications/progress',\n        params: { ...progress, progressToken } as Progress,\n      });\n    };\n  }\n\n  private createLog(): Context['log'] {\n    const send = (\n      level: 'debug' | 'info' | 'warning' | 'error',\n      message: string,\n      context?: SerializableValue,\n    ) => {\n      void this.mcpServer.server.sendLoggingMessage({\n        level,\n        data: { message, context },\n      });\n    };\n    return {\n      debug: (message, context) => send('debug', message, context),\n      info: (message, context) => send('info', message, context),\n      warn: (message, context) => send('warning', message, context),\n      error: (message, context) => send('error', message, context),\n    };\n  }\n\n  private createStatelessReportProgress(): (\n    progress: Progress,\n  ) => Promise<void> {\n    return () => {\n      this.logger?.warn(\n        \"Stateless context: 'reportProgress' is not supported.\",\n      );\n      return Promise.resolve();\n    };\n  }\n\n  private createStatelessLog(): Context['log'] {\n    const warn = () =>\n      this.logger?.warn(\n        'Stateless context: server-side logging is not supported.',\n      );\n    return {\n      debug: () => warn(),\n      info: () => warn(),\n      warn: () => warn(),\n      error: () => warn(),\n    };\n  }\n}\n"]}

package/dist/mcp/transport/mcp-http-handler.d.ts

@@ -0,0 +1,7 @@
+export interface McpHttpHandler {
+    handlePost(req: unknown, res: unknown): Promise<void> | void;
+    handleGet(req: unknown, res: unknown): Promise<void> | void;
+    handleDelete(req: unknown, res: unknown): Promise<void> | void;
+}
+export declare const MCP_HTTP_HANDLER: unique symbol;
+//# sourceMappingURL=mcp-http-handler.d.ts.map

package/dist/mcp/transport/mcp-http-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-http-handler.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-http-handler.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7D,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5D,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChE;AAWD,eAAO,MAAM,gBAAgB,eAA6B,CAAC"}

package/dist/mcp/transport/mcp-http-handler.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_HTTP_HANDLER = void 0;
+exports.MCP_HTTP_HANDLER = Symbol('MCP_HTTP_HANDLER');
+//# sourceMappingURL=mcp-http-handler.js.map

package/dist/mcp/transport/mcp-http-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-http-handler.js","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-http-handler.ts"],"names":[],"mappings":";;;AA+Ba,QAAA,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC","sourcesContent":["/**\n * The HTTP verb handlers a streamable-HTTP MCP endpoint needs: one per method\n * the transport mounts (`POST` messages, `GET` SSE stream, `DELETE` session\n * teardown). This is the seam for \"bring your own controller\" setups.\n *\n * The transport owns the implementation (session handling, streaming, raw-body\n * reading); you only decide HOW the route is mounted:\n *\n * - Do nothing — the transport self-mounts the route (no guards possible).\n * - Extend {@link StreamableHttpController} (or write your own `@Controller`)\n *   and delegate to these handlers, so the route is a real Nest route that\n *   `@UseGuards()` / `@UseInterceptors()` / `@Version()` apply to.\n *\n * Obtain an instance from a transport via `transport.httpHandlers` and provide\n * it under {@link MCP_HTTP_HANDLER} so the controller can inject it.\n */\nexport interface McpHttpHandler {\n  handlePost(req: unknown, res: unknown): Promise<void> | void;\n  handleGet(req: unknown, res: unknown): Promise<void> | void;\n  handleDelete(req: unknown, res: unknown): Promise<void> | void;\n}\n\n/**\n * DI token for an {@link McpHttpHandler}. Provide a transport's `httpHandlers`\n * under this token so {@link StreamableHttpController} (or your own controller)\n * can inject it:\n *\n * ```ts\n * { provide: MCP_HTTP_HANDLER, useValue: mcpTransport.httpHandlers }\n * ```\n */\nexport const MCP_HTTP_HANDLER = Symbol('MCP_HTTP_HANDLER');\n"]}

package/dist/mcp/transport/mcp-server-options.interface.d.ts

@@ -0,0 +1,23 @@
+import { Icon, ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';
+import { HttpServer } from '@nestjs/common';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpTransport } from './mcp-transport.interface';
+export interface McpServerOptions {
+    name: string;
+    version: string;
+    server?: string;
+    title?: string;
+    description?: string;
+    websiteUrl?: string;
+    icons?: Icon[];
+    capabilities?: ServerCapabilities;
+    instructions?: string;
+    serverMutator?: (server: McpServer) => McpServer;
+    transports: McpTransport[];
+    httpAdapter?: HttpServer;
+    allowUnauthenticatedAccess?: boolean;
+    logging?: false | {
+        level: ('log' | 'error' | 'warn' | 'debug' | 'verbose')[];
+    };
+}
+//# sourceMappingURL=mcp-server-options.interface.d.ts.map

package/dist/mcp/transport/mcp-server-options.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-options.interface.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-server-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AASzD,MAAM,WAAW,gBAAgB;IAE/B,IAAI,EAAE,MAAM,CAAC;IAEb,OAAO,EAAE,MAAM,CAAC;IAMhB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IAEf,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC;IAMjD,UAAU,EAAE,YAAY,EAAE,CAAC;IAQ3B,WAAW,CAAC,EAAE,UAAU,CAAC;IAYzB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAOrC,OAAO,CAAC,EACJ,KAAK,GACL;QACE,KAAK,EAAE,CAAC,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC;KAC3D,CAAC;CACP"}

package/dist/{authz/providers/oauth-provider.interface.js → mcp/transport/mcp-server-options.interface.js}

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=oauth-provider.interface.js.map
+//# sourceMappingURL=mcp-server-options.interface.js.map

package/dist/mcp/transport/mcp-server-options.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server-options.interface.js","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-server-options.interface.ts"],"names":[],"mappings":"","sourcesContent":["import { Icon, ServerCapabilities } from '@modelcontextprotocol/sdk/types.js';\nimport { HttpServer } from '@nestjs/common';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { McpTransport } from './mcp-transport.interface';\n\n/**\n * Configuration for an {@link McpStrategy} — the NestJS microservice transport\n * strategy that powers an MCP server. Pass an instance to\n * `app.connectMicroservice({ strategy: new McpStrategy(options) })`, set the HTTP\n * adapter for HTTP transports, and declare your `@McpController` classes in a\n * module's `controllers` array. No `McpModule` is required.\n */\nexport interface McpServerOptions {\n  /** Server name (MCP `Implementation.name`). */\n  name: string;\n  /** Server version (MCP `Implementation.version`). */\n  version: string;\n  /**\n   * Logical server name used for multi-server isolation. Only\n   * `@McpController({ server: <name> })` classes bind to this strategy. Omit for\n   * the default server (binds to plain `@McpController()` classes).\n   */\n  server?: string;\n  /** Human-readable display name. */\n  title?: string;\n  /** Short description of what this server does. */\n  description?: string;\n  /** URL of the website associated with this server. */\n  websiteUrl?: string;\n  /** Icons representing this server. */\n  icons?: Icon[];\n  /** Extra MCP server capabilities merged with the auto-derived ones. */\n  capabilities?: ServerCapabilities;\n  /** Server instructions sent to clients on initialize. */\n  instructions?: string;\n  /** Mutate the SDK server right after creation (instrumentation, etc.). */\n  serverMutator?: (server: McpServer) => McpServer;\n\n  /**\n   * The integrations this server exposes. Provide one entry per transport,\n   * e.g. `[new StreamableHttpTransport(), new StdioTransport()]`.\n   */\n  transports: McpTransport[];\n\n  /**\n   * The Nest HTTP adapter, required for HTTP-based transports. Either pass it\n   * here (`new McpStrategy({ ..., httpAdapter: app.getHttpAdapter() })`) or set\n   * it later via `strategy.setHttpAdapter(app.getHttpAdapter())`. Not needed for\n   * stdio-only servers.\n   */\n  httpAdapter?: HttpServer;\n\n  /**\n   * Freemium mode. When `true`, anonymous (unauthenticated) sessions may reach\n   * `@PublicTool()` tools, while every other tool still requires a resolved\n   * `req.user`. When `false` (default), per-tool listing/visibility trusts the\n   * server's own authentication — `@UseGuards()` on `@McpController` classes or\n   * methods (run by the NestJS RPC pipeline at call time) and/or auth middleware\n   * on the HTTP routes.\n   *\n   * @default false\n   */\n  allowUnauthenticatedAccess?: boolean;\n  /**\n   * Logging configuration.\n   * - `false` to disable MCP logging\n   * - `{ level: [...] }` to filter levels\n   * - `undefined` (default) for standard NestJS logging\n   */\n  logging?:\n    | false\n    | {\n        level: ('log' | 'error' | 'warn' | 'debug' | 'verbose')[];\n      };\n}\n"]}

package/dist/mcp/transport/mcp-transport.constants.d.ts

@@ -0,0 +1,19 @@
+export declare const MCP_TRANSPORT: unique symbol;
+export declare const mcpTransportFor: (server?: string) => symbol;
+export declare const MCP_SERVER_NAME_METADATA_KEY = "mcp:server-name";
+export type McpCapabilityType = 'tool' | 'resource' | 'resource-template' | 'prompt';
+export interface McpPattern {
+    mcp: McpCapabilityType;
+    name: string;
+    [key: string]: string;
+}
+export type McpMethodRef = (...args: any[]) => any;
+export interface McpHandlerExtras {
+    mcpType: McpCapabilityType;
+    mcpName: string;
+    mcpMethodKey: string;
+    mcpMethodRef: McpMethodRef;
+}
+export declare function buildMcpPattern(type: McpCapabilityType, name: string): McpPattern;
+export declare function buildMcpHandlerExtras(type: McpCapabilityType, name: string, methodKey: string, methodRef: McpMethodRef): McpHandlerExtras;
+//# sourceMappingURL=mcp-transport.constants.d.ts.map

package/dist/mcp/transport/mcp-transport.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-transport.constants.d.ts","sourceRoot":"","sources":["../../../src/mcp/transport/mcp-transport.constants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,aAAa,eAA0C,CAAC;AAerE,eAAO,MAAM,eAAe,GAAI,SAAS,MAAM,KAAG,MAC0B,CAAC;AAO7E,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,UAAU,GACV,mBAAmB,GACnB,QAAQ,CAAC;AAQb,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,iBAAiB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAYD,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,MAAM,GACX,UAAU,CAEZ;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,iBAAiB,EACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,YAAY,GACtB,gBAAgB,CAOlB"}