@rockcarver/frodo-lib 4.10.0 → 4.11.0

package/types/mcp/ToolRuntime.d.ts

@@ -0,0 +1,477 @@
+/**
+ * Provides a manifest-driven MCP tool runtime for executing Frodo capability
+ * descriptors with request-scoped Frodo instances.
+ *
+ * @remarks
+ * This module intentionally decouples tool selection from invocation:
+ * - The registry discovers raw capabilities.
+ * - The manifest collapses them into a reduced tool surface.
+ * - This runtime resolves incoming tool calls back to exact descriptors and
+ *   executes them against an isolated Frodo instance per request.
+ *
+ * The default instance resolver is service-account/admin-account aware and uses
+ * the established Frodo factory helpers (`createInstance*`).
+ */
+import { Frodo } from '../lib/FrodoLib';
+import type { BrowserLoginPromptHandler } from '../ops/BrowserAuthenticateOps';
+import { StateInterface } from '../shared/State';
+import { McpCapabilityRoutingStatus } from './CapabilityRouting';
+import { McpCapabilityDescriptor, McpCapabilityOperationType, McpDeploymentType } from './CapabilityTypes';
+import { McpCatalogHydrationStatus, McpManagedObjectHydrationStatus, McpToolManifest } from './ToolManifest';
+/**
+ * Credentials payload for a service-account request context.
+ */
+export type McpRuntimeServiceAccountAuth = {
+    /** Discriminator for service-account auth mode. */
+    mode: 'service-account';
+    /** AM host base URL. */
+    host: string;
+    /** Service account UUID. */
+    serviceAccountId: string;
+    /** Service account JWK, provided as JSON string or object. */
+    serviceAccountJwk: string | Record<string, unknown>;
+    /** Optional realm override. */
+    realm?: string;
+    /** Optional deployment type override. */
+    deploymentType?: string;
+    /** Optional insecure-connection toggle. */
+    allowInsecureConnection?: boolean;
+    /** Optional debug toggle. */
+    debug?: boolean;
+    /** Optional curlirize toggle. */
+    curlirize?: boolean;
+};
+/**
+ * Credentials payload for an admin-account request context.
+ */
+export type McpRuntimeAdminAccountAuth = {
+    /** Discriminator for admin-account auth mode. */
+    mode: 'admin-account';
+    /** AM host base URL. */
+    host: string;
+    /** Admin username. */
+    username: string;
+    /** Admin password. */
+    password: string;
+    /** Optional realm override. */
+    realm?: string;
+    /** Optional deployment type override. */
+    deploymentType?: string;
+    /** Optional insecure-connection toggle. */
+    allowInsecureConnection?: boolean;
+    /** Optional debug toggle. */
+    debug?: boolean;
+    /** Optional curlirize toggle. */
+    curlirize?: boolean;
+};
+/**
+ * Full frodo state payload for direct state-based instance creation.
+ */
+export type McpRuntimeStateAuth = {
+    /** Discriminator for direct state-config auth mode. */
+    mode: 'state-config';
+    /** Full state configuration passed into `frodo.createInstance`. */
+    config: StateInterface;
+};
+/**
+ * Credentials payload for a browser-login (interactive) request context.
+ *
+ * @remarks
+ * Unlike every other auth mode, resolving this one is not a single
+ * synchronous credential lookup — it requires a real interactive round trip
+ * (a loopback-redirect or device-authorization flow) before the instance is
+ * usable. See {@link McpToolRuntimeOptions.browserLoginPromptHandler}: this
+ * runtime never launches a browser or prints to a terminal itself, exactly
+ * like `AuthenticateOps.getTokensInteractive()` — the host embedding this
+ * MCP server (e.g. `frodo-cli`'s `frodo mcp server start`) must supply a
+ * handler that presents the login step however is appropriate for its
+ * environment.
+ */
+export type McpRuntimeBrowserAuth = {
+    /** Discriminator for browser-login auth mode. */
+    mode: 'browser';
+    /** AM host base URL. */
+    host: string;
+    /** Deployment type — required for browser login, since there is no existing session to auto-detect it from. */
+    deploymentType?: string;
+    /** Optional realm override. */
+    realm?: string;
+    /** OAuth2 client id (mandatory for forgeops/classic; cloud has a built-in default). */
+    loginClientId?: string;
+    /** Override the default scope requested for the target deployment type. */
+    loginScope?: string;
+    /** Full, absolute redirect URI to use, for a client registered with an exact-match redirect URI (shared with the non-interactive synthetic flow's own redirect URI setting). */
+    loginRedirectUri?: string;
+    /** Use the OAuth2 Device Authorization Grant instead of a loopback redirect. */
+    useDeviceFlow?: boolean;
+    /** Optional insecure-connection toggle. */
+    allowInsecureConnection?: boolean;
+    /** Optional debug toggle. */
+    debug?: boolean;
+    /** Optional curlirize toggle. */
+    curlirize?: boolean;
+};
+/**
+ * Credentials payload for a request context driven by an already-verified,
+ * externally-issued OAuth2 access token — the caller (e.g. an MCP server
+ * acting as an OAuth2 resource server for its HTTP transport) is expected
+ * to have already validated the token (signature/introspection, scope,
+ * expiry) before ever constructing this; this runtime never verifies a
+ * token itself, only wires an already-trusted one onto a fresh instance.
+ *
+ * @remarks
+ * Unlike every other auth mode, resolving this one never calls a login
+ * endpoint at all — see `AuthenticateOps.ts`'s `applyAccessToken()`, which
+ * this ultimately dispatches to.
+ */
+export type McpRuntimeBearerTokenAuth = {
+    /** Discriminator for externally-issued-bearer-token auth mode. */
+    mode: 'bearer-token';
+    /** AM host base URL. */
+    host: string;
+    /** The already-verified access token. */
+    accessToken: string;
+    /** Space-delimited granted scope, when known. */
+    scope?: string;
+    /** Token expiry, epoch milliseconds, when known. */
+    expiresAt?: number;
+    /**
+     * AM SSO session id, when the issuing OAuth2 client has a session-capture
+     * script configured (ForgeOps/classic) and it was already recovered by
+     * the caller (e.g. via `/oauth2/tokeninfo`'s `sessionToken` field).
+     */
+    sessionId?: string;
+    /** Optional realm override. */
+    realm?: string;
+    /** Deployment type — required, since there is no existing session to auto-detect it from. */
+    deploymentType?: string;
+    /** Optional insecure-connection toggle. */
+    allowInsecureConnection?: boolean;
+    /** Optional debug toggle. */
+    debug?: boolean;
+    /** Optional curlirize toggle. */
+    curlirize?: boolean;
+};
+/**
+ * Union of supported runtime auth modes.
+ */
+export type McpRuntimeAuth = McpRuntimeServiceAccountAuth | McpRuntimeAdminAccountAuth | McpRuntimeStateAuth | McpRuntimeBrowserAuth | McpRuntimeBearerTokenAuth;
+/**
+ * Execution-scoped context used to create an isolated Frodo instance.
+ */
+export type McpRuntimeRequestContext = {
+    /** Optional caller-supplied correlation id for audit/log stitching. */
+    requestId?: string;
+    /** Auth mode and credential payload for this request. */
+    auth: McpRuntimeAuth;
+    /** Optional request-scoped sink for bounded lifecycle and discovery traces. */
+    trace?: McpToolRuntimeTraceHandler;
+    /**
+     * The resolved scoped instance's caller-privilege tier (see
+     * `ops/CallerTrustTierOps.ts`'s `determineCallerTrustTier()`), attached
+     * once the instance is authenticated. Absent until then; `assertTrustTierAllowed`
+     * treats an absent value as `'full-trust'` (see its own remarks for why
+     * that default is safe for every existing, non-browser auth mode).
+     */
+    callerTrustTier?: 'full-trust' | 'delegated';
+};
+export type McpToolRuntimeTraceCandidate = {
+    skillId: string;
+    routingStatus: McpCapabilityRoutingStatus;
+    matchedObjectTypeCount?: number;
+};
+export type McpToolRuntimeTraceCriteria = Readonly<Pick<McpFindSkillsArguments, 'query' | 'objectFamily' | 'domain' | 'objectType' | 'skillIdPrefix' | 'operationTypes' | 'riskClasses' | 'kind' | 'limit' | 'includeIncompatible'>>;
+export type McpToolRuntimeTraceEvent = {
+    event: 'discovery' | 'selection' | 'dispatch-start' | 'dispatch-success' | 'dispatch-failure' | 'compatibility-rejection' | 'credential-rejection' | 'trust-tier-rejection';
+    requestId?: string;
+    toolName: string;
+    descriptorId?: string;
+    deploymentType?: McpDeploymentType;
+    candidateCount?: number;
+    resultCount?: number;
+    criteria?: McpToolRuntimeTraceCriteria;
+    topCandidates?: McpToolRuntimeTraceCandidate[];
+    routingReason?: string;
+    elapsedMs?: number;
+    error?: string;
+};
+export type McpToolRuntimeTraceHandler = (event: McpToolRuntimeTraceEvent) => void | Promise<void>;
+/**
+ * Generic-tool execution arguments.
+ */
+export type McpGenericExecutionArguments = {
+    /** Domain key, e.g. `authn`. */
+    domain: string;
+    /** Object type label, e.g. `Journey`. */
+    objectType: string;
+    /** Optional scope selector for ambiguous generic operations (e.g. `single` vs `bulk`). */
+    scope?: string;
+    /** Optional realm override applied to request-scoped auth context. */
+    realm?: string;
+    /** Optional requested page size hint. */
+    pageSize?: number;
+    /** Optional requested page offset hint. */
+    pageOffset?: number;
+    /** Optional requested page token/cursor hint. */
+    pageToken?: string;
+    /** Optional hint to request exact totals when supported. */
+    includeTotal?: boolean;
+    /** Optional logical target resolved to deployment-specific object types. */
+    semanticTarget?: {
+        family: string;
+        realm?: string;
+    };
+    /** Optional positional args forwarded to the underlying Frodo method. */
+    positionalArgs?: unknown[];
+    /** Optional named args forwarded as a single object argument. */
+    namedArgs?: Record<string, unknown>;
+};
+export type McpFindSkillsArguments = {
+    query?: string;
+    objectFamily?: string;
+    domain?: string;
+    objectType?: string;
+    skillIdPrefix?: string;
+    operationTypes?: McpCapabilityOperationType[];
+    riskClasses?: Array<'low' | 'medium' | 'high' | 'critical'>;
+    kind?: 'generic' | 'special';
+    limit?: number;
+    includeIncompatible?: boolean;
+    /** Execute a unique deterministic read-only recommendation. Defaults to true. */
+    executeRecommended?: boolean;
+};
+export type McpDiscoverArguments = {
+    detail?: 'summary' | 'catalog';
+};
+export type McpDescribeSkillArguments = {
+    skillId: string;
+};
+export type McpDispatchExecutionArguments = {
+    skillId?: string;
+    operationType?: McpCapabilityOperationType;
+    domain?: string;
+    objectType?: string;
+    scope?: string;
+    realm?: string;
+    pageSize?: number;
+    pageOffset?: number;
+    pageToken?: string;
+    includeTotal?: boolean;
+    semanticTarget?: {
+        family: string;
+        realm?: string;
+    };
+    positionalArgs?: unknown[];
+    namedArgs?: Record<string, unknown>;
+};
+/**
+ * Pagination metadata returned for list/search style tool calls.
+ *
+ * @remarks
+ * When {@link McpExecutionPaginationMetadata.hasMore} is present, the result
+ * was actually sliced by the runtime's default response-size safety net (see
+ * `applyResponseSizeLimit`) before being returned — not just flagged as
+ * possibly truncated. `nextPageOffset` is always a usable continuation value
+ * in that case.
+ */
+export type McpExecutionPaginationMetadata = {
+    /** Whether the result appears to be truncated/paginated. */
+    isPartial: boolean;
+    /** Number of rows returned when the payload is an array. */
+    returnedCount?: number;
+    /** Total number of rows available before truncation, when known. */
+    totalCount?: number;
+    /** Requested page size hint, if provided by caller. */
+    requestedPageSize?: number;
+    /** Requested page offset hint, if provided by caller. */
+    requestedPageOffset?: number;
+    /** Requested page token hint, if provided by caller. */
+    requestedPageToken?: string;
+    /** Whether caller requested exact totals. */
+    includeTotalRequested?: boolean;
+    /** Whether more items remain past the returned page. */
+    hasMore?: boolean;
+    /** Offset to pass as pageOffset to fetch the next page, when hasMore is true. */
+    nextPageOffset?: number;
+    /** Optional advisory warning for agent callers. */
+    warning?: string;
+};
+/**
+ * Scope metadata returned for realm-sensitive executions.
+ */
+export type McpExecutionScopeMetadata = {
+    /** Realm explicitly requested by the caller, if any. */
+    requestedRealm?: string;
+    /** Realm ultimately applied to request-scoped auth context. */
+    appliedRealm?: string;
+    /** Whether payload contents suggest a realm mismatch. */
+    scopeMismatch?: boolean;
+    /** Optional warning message when scope mismatch is detected. */
+    warning?: string;
+};
+/**
+ * Optional execution metadata surfaced alongside tool results.
+ */
+export type McpExecutionResultMetadata = {
+    /** Top-level JSON shape returned by the tool call. */
+    topLevelType: 'array' | 'object' | 'string' | 'number' | 'boolean' | 'null' | 'undefined';
+    /** Estimated serialized payload size in bytes. */
+    payloadSizeBytes?: number;
+    /** Human-readable payload size string. */
+    payloadSizeHuman?: string;
+    /** Number of items when the top-level payload is an array. */
+    itemCount?: number;
+    /** Top-level keys when the payload is an object. */
+    objectKeys?: string[];
+    /** Count summary for top-level arrays/records inside the payload. */
+    fieldCounts?: Record<string, number>;
+    /** Whether the payload is considered large for inline agent use. */
+    isLarge?: boolean;
+    /** Whether the payload was truncated by the transport layer. */
+    isTruncated?: boolean;
+    /** Optional advisory warning for large or truncated payloads. */
+    warning?: string;
+};
+export type McpToolExecutionMetadata = {
+    /** Scope metadata for realm-sensitive calls. */
+    scope?: McpExecutionScopeMetadata;
+    /** Pagination metadata for list/search calls. */
+    pagination?: McpExecutionPaginationMetadata;
+    /** Result summary metadata for agent reasoning and large-payload handling. */
+    result?: McpExecutionResultMetadata;
+};
+/**
+ * Special-tool execution arguments.
+ */
+export type McpSpecialExecutionArguments = {
+    /** Optional positional args forwarded to the underlying Frodo method. */
+    positionalArgs?: unknown[];
+    /** Optional named args forwarded as a single object argument. */
+    namedArgs?: Record<string, unknown>;
+};
+/**
+ * Envelope for runtime tool execution.
+ */
+export type McpToolExecutionRequest = {
+    /** MCP tool name from the manifest. */
+    toolName: string;
+    /**
+     * Tool arguments.
+     * - Generic tools require `domain` and `objectType`.
+     * - Special tools accept `positionalArgs` and/or `namedArgs`.
+     * - Discovery tool ignores arguments.
+     */
+    arguments?: McpGenericExecutionArguments | McpFindSkillsArguments | McpDescribeSkillArguments | McpDispatchExecutionArguments | McpSpecialExecutionArguments | Record<string, unknown>;
+    /** Request-scoped context used to create an isolated Frodo instance. */
+    context: McpRuntimeRequestContext;
+};
+/**
+ * Result envelope returned by all runtime executions.
+ */
+export type McpToolExecutionResult = {
+    /** Tool name that was executed. */
+    toolName: string;
+    /** Descriptor id backing the execution, if applicable. */
+    descriptorId?: string;
+    /** Underlying method result payload. */
+    data: unknown;
+    /** Optional execution metadata for scope and pagination diagnostics. */
+    metadata?: McpToolExecutionMetadata;
+};
+/**
+ * Optional runtime customization hooks.
+ */
+export type McpToolRuntimeOptions = {
+    /**
+     * Optional root Frodo instance used by the default resolver.
+     * Defaults to the library singleton `frodo`.
+     */
+    frodoRoot?: Frodo;
+    /**
+     * Optional custom resolver that returns a request-scoped Frodo instance.
+     * When omitted, {@link resolveRequestScopedFrodo} is used.
+     */
+    resolveFrodoForRequest?: (context: McpRuntimeRequestContext, frodoRoot: Frodo) => Frodo | Promise<Frodo>;
+    /**
+     * Optional heuristic threshold used to flag potentially paginated array
+     * responses when no explicit pagination controls were provided.
+     *
+     * Defaults to `1000`.
+     */
+    paginationWarningThreshold?: number;
+    /**
+     * Optional payload size threshold used to flag large inline responses and
+     * produce actionable summary metadata for agents.
+     *
+     * Defaults to `65536` bytes.
+     */
+    resultWarningThresholdBytes?: number;
+    /** Optional service-wide sink for payload-free lifecycle traces. */
+    trace?: McpToolRuntimeTraceHandler;
+    /** Tenant managed-object types available to service-local semantic search. */
+    managedObjectTypes?: readonly string[];
+    /** Outcome of tenant managed-object type hydration. */
+    managedObjectHydrationStatus?: McpManagedObjectHydrationStatus;
+    /** Tenant config entity IDs available to service-local semantic search. */
+    configEntityIds?: readonly string[];
+    /** Outcome of tenant config entity hydration. */
+    configEntityHydrationStatus?: McpCatalogHydrationStatus;
+    /** Execute unique deterministic read-only recommendations unless a request opts out. */
+    executeRecommendedByDefault?: boolean;
+    /**
+     * Presents a browser-login (auth mode `'browser'`) interactive login step
+     * to whoever operates this MCP server. Required only for requests using
+     * that auth mode; every other mode ignores it. Frodo's MCP runtime never
+     * launches a browser or writes to stdout itself (stdio transport reserves
+     * stdout for the JSON-RPC stream) — the embedding host supplies this,
+     * typically printing to stderr and/or opening a local browser.
+     */
+    browserLoginPromptHandler?: BrowserLoginPromptHandler;
+};
+/**
+ * Manifest-backed runtime object.
+ */
+export type McpToolRuntime = {
+    /** Reduced manifest used for tool registration and discovery. */
+    manifest: McpToolManifest;
+    /**
+     * Executes one tool invocation against a request-scoped Frodo instance.
+     *
+     * @param request Tool execution request.
+     * @returns Normalized execution result envelope.
+     */
+    executeTool(request: McpToolExecutionRequest): Promise<McpToolExecutionResult>;
+};
+/**
+ * Creates a manifest-backed MCP runtime with descriptor indexes for efficient
+ * execution dispatch.
+ *
+ * @param manifest Reduced tool manifest created by `buildToolManifest`.
+ * @param capabilities Capability descriptors that back the manifest.
+ * @param options Optional runtime customization hooks.
+ * @returns Runtime object capable of executing manifest tool calls.
+ */
+export declare function createToolRuntime(manifest: McpToolManifest, capabilities: McpCapabilityDescriptor[], options?: McpToolRuntimeOptions): McpToolRuntime;
+/**
+ * Creates a request-scoped Frodo instance using standard factory helpers and
+ * the provided auth mode.
+ *
+ * @param context Request-scoped runtime context.
+ * @param frodoRoot Root frodo instance exposing `createInstance*` helpers.
+ * @returns New request-scoped Frodo instance.
+ */
+export declare function resolveRequestScopedFrodo(context: McpRuntimeRequestContext, frodoRoot?: Frodo): Frodo;
+/**
+ * Reads the effective realm from a runtime request context.
+ *
+ * @remarks
+ * Exported for custom `resolveFrodoForRequest` implementations (see
+ * {@link McpToolRuntimeOptions.resolveFrodoForRequest}) that reuse a
+ * pre-authenticated singleton `Frodo` instance for performance instead of
+ * calling {@link resolveRequestScopedFrodo} on every request: such a
+ * resolver still needs to know when `context` carries a realm that differs
+ * from the singleton's own, so it can fall back to a genuinely scoped
+ * instance for that one call rather than silently ignoring the override.
+ */
+export declare function getRealmFromContext(context: McpRuntimeRequestContext): string | undefined;
+//# sourceMappingURL=ToolRuntime.d.ts.map

package/types/mcp/ToolRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolRuntime.d.ts","sourceRoot":"","sources":["../../src/mcp/ToolRuntime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,KAAK,EAAS,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAG/E,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAEL,0BAA0B,EAE3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAG1B,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAc3B,OAAO,EACL,yBAAyB,EAGzB,+BAA+B,EAC/B,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAexB;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,mDAAmD;IACnD,IAAI,EAAE,iBAAiB,CAAC;IACxB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,iDAAiD;IACjD,IAAI,EAAE,eAAe,CAAC;IACtB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,uDAAuD;IACvD,IAAI,EAAE,cAAc,CAAC;IACrB,mEAAmE;IACnE,MAAM,EAAE,cAAc,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,iDAAiD;IACjD,IAAI,EAAE,SAAS,CAAC;IAChB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gLAAgL;IAChL,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2CAA2C;IAC3C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6BAA6B;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,4BAA4B,GAC5B,0BAA0B,GAC1B,mBAAmB,GACnB,qBAAqB,GACrB,yBAAyB,CAAC;AAE9B;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,IAAI,EAAE,cAAc,CAAC;IACrB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,0BAA0B,CAAC;IACnC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,YAAY,GAAG,WAAW,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,0BAA0B,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAChD,IAAI,CACF,sBAAsB,EACpB,OAAO,GACP,cAAc,GACd,QAAQ,GACR,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,MAAM,GACN,OAAO,GACP,qBAAqB,CACxB,CACF,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EACD,WAAW,GACX,WAAW,GACX,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,yBAAyB,GACzB,sBAAsB,GACtB,sBAAsB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,2BAA2B,CAAC;IACvC,aAAa,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,CACvC,KAAK,EAAE,wBAAwB,KAC5B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,cAAc,CAAC,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,0BAA0B,EAAE,CAAC;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,4DAA4D;IAC5D,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,wDAAwD;IACxD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG;IACtC,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,sDAAsD;IACtD,YAAY,EACV,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;IAC9E,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,gDAAgD;IAChD,KAAK,CAAC,EAAE,yBAAyB,CAAC;IAClC,iDAAiD;IACjD,UAAU,CAAC,EAAE,8BAA8B,CAAC;IAC5C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,4BAA4B,GAAG;IACzC,yEAAyE;IACzE,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;IAC3B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,SAAS,CAAC,EACN,4BAA4B,GAC5B,sBAAsB,GACtB,yBAAyB,GACzB,6BAA6B,GAC7B,4BAA4B,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,wEAAwE;IACxE,OAAO,EAAE,wBAAwB,CAAC;CACnC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wCAAwC;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,wEAAwE;IACxE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;CACrC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CACvB,OAAO,EAAE,wBAAwB,EACjC,SAAS,EAAE,KAAK,KACb,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,oEAAoE;IACpE,KAAK,CAAC,EAAE,0BAA0B,CAAC;IACnC,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,uDAAuD;IACvD,4BAA4B,CAAC,EAAE,+BAA+B,CAAC;IAC/D,2EAA2E;IAC3E,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,iDAAiD;IACjD,2BAA2B,CAAC,EAAE,yBAAyB,CAAC;IACxD,wFAAwF;IACxF,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;CACvD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,iEAAiE;IACjE,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CACT,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,EACzB,YAAY,EAAE,uBAAuB,EAAE,EACvC,OAAO,GAAE,qBAA0B,GAClC,cAAc,CAuVhB;AAoLD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,wBAAwB,EACjC,SAAS,GAAE,KAAa,GACvB,KAAK,CAqEP;AAwzED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,wBAAwB,GAChC,MAAM,GAAG,SAAS,CAapB"}

package/types/mcp/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Public entrypoint for MCP capability-building primitives in frodo-lib.
+ *
+ * @remarks
+ * This barrel keeps MCP-related contracts and helper functions grouped under a
+ * single module namespace for downstream runtime and CLI integration.
+ */
+export { type McpCapabilityDescriptor, type McpCapabilityInventoryOptions, type McpCapabilityKind, type McpCapabilityOperationType, type McpCapabilityPolicy, type McpCapabilityPolicyPresetName, type McpCapabilityRiskClass, type McpDeploymentType, type McpToolAnnotations, } from './CapabilityTypes';
+export { MCP_POLICY_PRESETS, applyCapabilityPolicy } from './CapabilityPolicy';
+export { type McpCapabilityRouting, type McpCapabilityRoutingStatus, describeCapabilityRouting, rankCapabilitiesForDeployment, } from './CapabilityRouting';
+export { type McpDiscoveryHydrationCatalog, type McpDiscoveryHydrationEvent, type McpDiscoveryHydrationOptions, hydrateMcpDiscoveryContext, } from './DiscoveryHydration';
+export { MCP_AMBIGUOUS_OBJECT_CONCEPTS, MCP_SEMANTIC_OBJECT_SYNONYMS, type McpManagedObjectFamilyMatch, type McpSemanticObjectFamily, type McpSemanticObjectFamilyResolution, descriptorPatternsSupportFamily, discoverManagedObjectFamilies, matchManagedObjectFamily, normalizeSemanticObjectFamily, resolveSemanticObjectFamily, } from './SemanticObjectFamilies';
+export { MCP_SEMANTIC_TERM_SYNONYMS, type McpSemanticIdentifierMatch, matchSemanticIdentifiers, normalizeSemanticIdentifier, } from './SemanticIdentifiers';
+export { capabilityMatchesAnyProfile, capabilityMatchesDisabled, getMcpProfileDefinition, listAllMcpProfiles, listMcpProfiles, resolveMcpProfileSelection, } from './ProfileRegistry';
+export { FORGEOPS_DOMAIN_PRODUCT_MAP, type McpDocsContext, type McpDocsContextForgeops, type McpDocsContextUnresolved, type McpDocsDomainProduct, type McpDocsProduct, classifyDomainProduct, parseAmDocsVersion, parseIdmDocsVersion, resolveDocsContext, } from './DocsContext';
+export { buildCapabilityInventory, inferObjectType, inferOperationType, inferRiskClass, } from './CapabilityRegistry';
+export { type McpCanonicalTool, type McpCatalogHydrationStatus, type McpDiscoveryContext, type McpDiscoveryEntry, type McpDiscoveryTarget, type McpManagedObjectHydrationStatus, type McpGenericTool, type McpObjectTypeEntry, type McpToolManifest, buildToolManifest, } from './ToolManifest';
+export { type McpDiscoverArguments, type McpExecutionPaginationMetadata, type McpExecutionScopeMetadata, type McpGenericExecutionArguments, type McpRuntimeAdminAccountAuth, type McpRuntimeAuth, type McpRuntimeRequestContext, type McpRuntimeServiceAccountAuth, type McpRuntimeStateAuth, type McpSpecialExecutionArguments, type McpToolExecutionRequest, type McpToolExecutionResult, type McpToolExecutionMetadata, type McpToolRuntime, type McpToolRuntimeOptions, type McpToolRuntimeTraceCandidate, type McpToolRuntimeTraceCriteria, type McpToolRuntimeTraceEvent, type McpToolRuntimeTraceHandler, createToolRuntime, getRealmFromContext, resolveRequestScopedFrodo, } from './ToolRuntime';
+export { type McpService, type McpServiceOptions, type McpServiceToolDefinition, composeCapabilityPolicy, createMcpService, } from './McpService';
+//# sourceMappingURL=index.d.ts.map

package/types/mcp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,+BAA+B,EAC/B,6BAA6B,EAC7B,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,eAAe,EACf,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/types/ops/AdminOps.d.ts

@@ -0,0 +1,85 @@
+import { type OAuth2ClientSkeleton } from '../api/OAuth2ClientApi';
+import { AccessTokenResponseType } from '../api/OAuth2OIDCApi';
+import { OAuth2TrustedJwtIssuerSkeleton } from '../api/OAuth2TrustedJwtIssuerApi';
+import { State } from '../shared/State';
+import { JwkRsa, JwksInterface } from './JoseOps';
+export type Admin = {
+    generateRfc7523AuthZGrantArtefacts(clientId: string, iss: string, jwk?: JwkRsa, sub?: string, scope?: string[], options?: {
+        save: boolean;
+    }): Promise<{
+        jwk: JwkRsa;
+        jwks: JwksInterface;
+        client: OAuth2ClientSkeleton;
+        issuer: OAuth2TrustedJwtIssuerSkeleton;
+    }>;
+    executeRfc7523AuthZGrantFlow(clientId: string, iss: string, jwk: JwkRsa, sub: string, scope?: string[]): Promise<AccessTokenResponseType>;
+    generateRfc7523ClientAuthNArtefacts(clientId: string, aud?: string, jwk?: JwkRsa, options?: {
+        save: boolean;
+    }): Promise<{
+        jwk: JwkRsa;
+        jwks: JwksInterface;
+        jwt: any;
+        client: OAuth2ClientSkeleton;
+    }>;
+    trainAA(apiKey: string, apiSecret: string, customUsernames?: string[], customUserAgents?: string[], customIPs?: string[], loginsPerUser?: number, service?: string): Promise<void>;
+};
+declare const _default: (state: State) => Admin;
+export default _default;
+export declare function getUniqueValues(values: string[]): string[];
+export declare function pickRandomValue(values: string[]): string;
+export declare function pickRandomNumber(max: number): number;
+export declare function pickRandomValues(values: string[], picks: number): string[];
+export declare function pickRandomUsername(customUsernames?: string[]): string;
+export declare function pickRandomUserAgent(customUserAgents?: string[]): string;
+export declare function pickRandomIPAddress(customIPs?: string[]): string;
+export declare function sleep(ms: number): Promise<unknown>;
+export declare function trainAA({ apiKey, apiSecret, customUsernames, customUserAgents, customIPs, loginsPerUser, service, state, }: {
+    apiKey: string;
+    apiSecret: string;
+    customUsernames?: string[];
+    customUserAgents?: string[];
+    customIPs?: string[];
+    loginsPerUser?: number;
+    service?: string;
+    state: State;
+}): Promise<void>;
+export declare function getAccessTokenUrl(state: State): string;
+export declare function generateRfc7523AuthZGrantArtefacts({ clientId, iss, jwk, sub, scope, options, state, }: {
+    clientId: string;
+    iss: string;
+    jwk?: JwkRsa;
+    sub?: string;
+    scope?: string[];
+    options?: {
+        save: boolean;
+    };
+    state: State;
+}): Promise<{
+    jwk: JwkRsa;
+    jwks: JwksInterface;
+    client: OAuth2ClientSkeleton;
+    issuer: OAuth2TrustedJwtIssuerSkeleton;
+}>;
+export declare function executeRfc7523AuthZGrantFlow({ clientId, iss, jwk, sub, scope, state, }: {
+    clientId: string;
+    iss: string;
+    jwk: JwkRsa;
+    sub: string;
+    scope?: string[];
+    state: State;
+}): Promise<AccessTokenResponseType>;
+export declare function generateRfc7523ClientAuthNArtefacts({ clientId, aud, jwk, options, state, }: {
+    clientId: string;
+    aud?: string;
+    jwk?: JwkRsa;
+    options?: {
+        save: boolean;
+    };
+    state: State;
+}): Promise<{
+    jwk: JwkRsa;
+    jwks: JwksInterface;
+    jwt: any;
+    client: OAuth2ClientSkeleton;
+}>;
+//# sourceMappingURL=AdminOps.d.ts.map

package/types/ops/AdminOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminOps.d.ts","sourceRoot":"","sources":["../../src/ops/AdminOps.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAIxC,OAAO,EAKL,MAAM,EACN,aAAa,EACd,MAAM,WAAW,CAAC;AASnB,MAAM,MAAM,KAAK,GAAG;IAClB,kCAAkC,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,GAC1B,OAAO,CAAC;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,aAAa,CAAC;QACpB,MAAM,EAAE,oBAAoB,CAAC;QAC7B,MAAM,EAAE,8BAA8B,CAAC;KACxC,CAAC,CAAC;IACH,4BAA4B,CAC1B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,EAAE,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,mCAAmC,CACjC,QAAQ,EAAE,MAAM,EAChB,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,GAC1B,OAAO,CAAC;QACT,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,aAAa,CAAC;QACpB,GAAG,EAAE,GAAG,CAAC;QACT,MAAM,EAAE,oBAAoB,CAAC;KAC9B,CAAC,CAAC;IACH,OAAO,CACL,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,MAAM,EAAE,EAC1B,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAC3B,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAAC;CAqFlB,CAAC;yBAEc,OAAO,KAAK,KAAG,KAAK;AAApC,wBAwKE;AA0rCF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE1D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAGxD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAO1E;AAED,wBAAgB,kBAAkB,CAAC,eAAe,GAAE,MAAM,EAAO,GAAG,MAAM,CAKzE;AAED,wBAAgB,mBAAmB,CAAC,gBAAgB,GAAE,MAAM,EAAO,GAAG,MAAM,CAK3E;AAED,wBAAgB,mBAAmB,CAAC,SAAS,GAAE,MAAM,EAAO,GAAG,MAAM,CAGpE;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,oBAE/B;AAGD,wBAAsB,OAAO,CAAC,EAC5B,MAAM,EACN,SAAS,EACT,eAAoB,EACpB,gBAAqB,EACrB,SAAc,EACd,aAAmB,EACnB,OAA0B,EAC1B,KAAK,GACN,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA8EhB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,UAY7C;AAED,wBAAsB,kCAAkC,CAAC,EACvD,QAAQ,EACR,GAAG,EACH,GAAU,EACV,GAAU,EACV,KAAyC,EACzC,OAAyB,EACzB,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,8BAA8B,CAAC;CACxC,CAAC,CA2ED;AAED,wBAAsB,4BAA4B,CAAC,EACjD,QAAQ,EACR,GAAG,EACH,GAAG,EACH,GAAG,EACH,KAAyC,EACzC,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmBnC;AAED,wBAAsB,mCAAmC,CAAC,EACxD,QAAQ,EACR,GAAU,EACV,GAAU,EACV,OAEC,EACD,KAAK,GACN,EAAE;IACD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;CACd,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,EAAE,oBAAoB,CAAC;CAC9B,CAAC,CA2DD"}