@stigmer/server 3.14.0-dev.20260910084630

package/dist/domain/mcpserver/enabledtools/enabledtools.js

@@ -0,0 +1,46 @@
+/** Whether every requested name resolved to a discovered tool. */
+export function isValidClassification(c) {
+    return c.unknown.length === 0 && c.resourceTemplates.length === 0;
+}
+/**
+ * Checks each requested name against the discovered capabilities. Matching
+ * is exact and case-sensitive — tool names must match what the server
+ * reports via tools/list (see McpServerUsage.enabled_tools docs).
+ *
+ * Callers are expected to skip validation entirely when capabilities are
+ * absent (server not yet connected); classifying against absent
+ * capabilities would mark every name unknown, which is not a statement the
+ * platform can honestly make before the first discovery.
+ */
+export function classify(caps, requested) {
+    const tools = new Set(caps.tools.map((tool) => tool.name));
+    const templates = new Set(caps.resourceTemplates.map((tmpl) => tmpl.name));
+    const unknown = [];
+    const resourceTemplates = [];
+    for (const name of requested) {
+        if (tools.has(name)) {
+            continue;
+        }
+        if (templates.has(name)) {
+            resourceTemplates.push(name);
+            continue;
+        }
+        unknown.push(name);
+    }
+    return { unknown, resourceTemplates };
+}
+/**
+ * The discovered tool names in discovery order, for error messages that
+ * tell the operator what IS valid.
+ */
+export function toolNames(caps) {
+    return caps.tools.map((tool) => tool.name);
+}
+/**
+ * Renders a name list as 'a', 'b', 'c' for error messages — shared so the
+ * agent and mcpserver error texts quote tool names identically.
+ */
+export function quoteJoin(names) {
+    return names.map((n) => `'${n}'`).join(", ");
+}
+//# sourceMappingURL=enabledtools.js.map

package/dist/domain/mcpserver/enabledtools/enabledtools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enabledtools.js","sourceRoot":"","sources":["../../../../src/domain/mcpserver/enabledtools/enabledtools.ts"],"names":[],"mappings":"AAyCA,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,CAAiB;IACrD,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,IAA4B,EAC5B,SAA4B;IAE5B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,iBAAiB,GAAa,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAA4B;IACpD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAChD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/mcpserver/engine.d.ts

@@ -0,0 +1,171 @@
+/**
+ * McpServer connect-engine seam — the domain's view of the Temporal client
+ * operations the connect lanes need (Go holds these as optional fields on
+ * McpServerController, set by SetConnectDependencies; here availability is
+ * the modeled engine state, the same idiom as agentexecution's engine.ts
+ * and workflowexecution's engine.ts — guidelines §4).
+ *
+ * The engine does NOT run a worker: the connect workflow
+ * (stigmer/mcp-server/connect) is the RUNNER's — this server only starts,
+ * attaches to, and awaits runs of it. The temporal-side implementation
+ * lands in src/temporal/mcpserver/engine-client.ts; tests fake this
+ * interface directly.
+ *
+ * Failure classification (ConnectRunFailure) mirrors the error taxonomy
+ * Go's awaitConnectWorkflow switches on (connect.go:661-694). The engine
+ * classifies; the DOMAIN owns the gRPC codes and user-facing copy the
+ * classes map to — the split keeps Temporal error types out of handler
+ * code.
+ */
+/**
+ * The connect workflow's input — matches the runner's
+ * ConnectMcpServerWorkflowInput (Go connectWorkflowInput). Snake_case keys
+ * are the Temporal JSON payload wire contract; ids-only except
+ * execution_context_token, the ONE deliberate exception (oss#535): the EC
+ * read RPC redacts secrets unless the caller presents an execution-scoped
+ * runner token, and the discovery activity has no execution of its own to
+ * exchange for one — the capability travels with the work item. It is a
+ * decrypt-lane discriminator, not a secret value: short-TTL, bound to
+ * this connect flow's ephemeral EC (deleted when the handler returns),
+ * and useless once either expires.
+ */
+export interface ConnectWorkflowInput {
+    readonly mcp_server_id: string;
+    readonly execution_context_id?: string;
+    readonly execution_context_token?: string;
+}
+/**
+ * The connect workflow's result — mirrors the runner's
+ * ConnectMcpServerWorkflowOutput (Go connectWorkflowOutput). Every field
+ * the runner emits must have a home here: a missing field is silently
+ * dropped during JSON deserialization, which is exactly how
+ * tool_approvals used to be lost.
+ */
+export interface ConnectWorkflowOutput {
+    readonly tools?: DiscoveredToolResult[];
+    readonly resource_templates?: DiscoveredResourceTemplateResult[];
+    /**
+     * Per-tool approval policies produced by the connect-time classifier —
+     * layer 1 of the approval policy chain. The classifier returns only the
+     * gated tools, but each entry still carries requires_approval so a
+     * future runner that emits non-gated entries is handled defensively at
+     * conversion time.
+     */
+    readonly tool_approvals?: ToolApprovalResult[];
+}
+export interface DiscoveredToolResult {
+    readonly name?: string;
+    readonly description?: string;
+    readonly input_schema?: Record<string, unknown>;
+}
+export interface DiscoveredResourceTemplateResult {
+    readonly uri_template?: string;
+    readonly name?: string;
+    readonly description?: string;
+    readonly mime_type?: string;
+}
+export interface ToolApprovalResult {
+    readonly tool_name?: string;
+    readonly requires_approval?: boolean;
+    readonly message?: string;
+    /**
+     * True when the connect-time tightener force-gated this tool from its
+     * destructiveHint annotation (not the classifier) — persisted to
+     * ToolApprovalPolicy.from_destructive_hint so the runner attributes the
+     * gate to the annotation rather than the classifier default.
+     */
+    readonly from_destructive_hint?: boolean;
+}
+/**
+ * How a connect run failed, in Go awaitConnectWorkflow's taxonomy:
+ * - "application": the workflow itself failed with the runner's crafted,
+ *   user-facing message (Go temporal.ApplicationError).
+ * - "timeout": the WorkflowRunTimeout elapsed (Go temporal.TimeoutError).
+ * - "service-not-found": Temporal no longer knows the run (Go
+ *   serviceerror.NotFound).
+ * - "other": everything else; message carries the error's own text (Go's
+ *   default arm, err.Error()).
+ */
+export type ConnectRunFailure = {
+    readonly kind: "application";
+    readonly message: string;
+} | {
+    readonly kind: "timeout";
+} | {
+    readonly kind: "service-not-found";
+} | {
+    readonly kind: "other";
+    readonly message: string;
+};
+export type ConnectRunOutcome = {
+    readonly ok: true;
+    readonly output: ConnectWorkflowOutput;
+} | {
+    readonly ok: false;
+    readonly failure: ConnectRunFailure;
+};
+/** A started-or-attached connect run (Go client.WorkflowRun). */
+export interface ConnectRun {
+    readonly workflowId: string;
+    /**
+     * True when the deterministic workflow ID reported an in-flight run and
+     * this handle attached to it instead of starting a new one — the lanes
+     * skip the CONNECTING write in that case so the starting lane's
+     * started_at survives.
+     */
+    readonly attached: boolean;
+    /**
+     * Blocks until the run settles and classifies the outcome. The
+     * workflow's own WorkflowRunTimeout is the deadline that should fire
+     * first; raceTimeoutMs (budget + a small buffer on the background
+     * lanes) is only a backstop so a settle task can never hang if Temporal
+     * becomes unreachable — Go's bounded background contexts.
+     */
+    result(raceTimeoutMs?: number): Promise<ConnectRunOutcome>;
+}
+/** The Temporal client operations the connect lanes consume. */
+export interface McpServerConnectEngine {
+    /**
+     * Starts the connect workflow on the runner queue, or attaches to the
+     * in-flight run when the deterministic workflow ID reports one already
+     * running (Go startOrAttachConnectWorkflow). Throws on any other start
+     * failure — the lanes map that to Internal "failed to start connect
+     * workflow".
+     */
+    startOrAttachConnect(mcpServerId: string, input: ConnectWorkflowInput, runTimeoutMs: number): Promise<ConnectRun>;
+    /**
+     * Whether the recorded connect workflow is still running (Go
+     * isConnectRunRunning). Errors — including a run Temporal no longer
+     * knows — report false: the caller falls through to a fresh start,
+     * where the AlreadyStarted refusal is the authoritative answer.
+     */
+    isConnectRunRunning(workflowId: string): Promise<boolean>;
+    /**
+     * Whether any worker is polling the runner task queue (Go
+     * runnerQueueWarning's DescribeTaskQueue probe). `undefined` when the
+     * question cannot be answered — an unreachable Temporal should not cry
+     * wolf on an operation that is about to fail loudly anyway.
+     */
+    hasRunnerQueuePollers(): Promise<boolean | undefined>;
+}
+/** Engine availability as an explicit modeled state (guidelines §4). */
+export type McpServerEngineState = {
+    readonly connected: true;
+    readonly engine: McpServerConnectEngine;
+} | {
+    readonly connected: false;
+};
+/**
+ * The disconnected state: no Temporal behind this server (never
+ * connected since boot). Connect/startConnect refuse with Go's
+ * byte-pinned FailedPrecondition; the OAuth RPCs work fully — the
+ * ratified DB-1 split (sub-project 20260825.02).
+ */
+export declare const MCP_SERVER_ENGINE_DISCONNECTED: McpServerEngineState;
+/**
+ * A provider rather than a value: consumers observe the CURRENT state at
+ * request time, never a boot-time snapshot — reconnects propagate
+ * automatically (the #18 engine-state idiom).
+ */
+export type McpServerEngineStateProvider = () => McpServerEngineState;
+//# sourceMappingURL=engine.d.ts.map

package/dist/domain/mcpserver/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gCAAgC,EAAE,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhE,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC5D;AAED,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,oBAAoB,CAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB;;;;;OAKG;IACH,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D;;;;;OAKG;IACH,qBAAqB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAAC;AAElC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,oBACR,CAAC;AAEtC;;;;GAIG;AACH,MAAM,MAAM,4BAA4B,GAAG,MAAM,oBAAoB,CAAC"}

package/dist/domain/mcpserver/engine.js

@@ -0,0 +1,27 @@
+/**
+ * McpServer connect-engine seam — the domain's view of the Temporal client
+ * operations the connect lanes need (Go holds these as optional fields on
+ * McpServerController, set by SetConnectDependencies; here availability is
+ * the modeled engine state, the same idiom as agentexecution's engine.ts
+ * and workflowexecution's engine.ts — guidelines §4).
+ *
+ * The engine does NOT run a worker: the connect workflow
+ * (stigmer/mcp-server/connect) is the RUNNER's — this server only starts,
+ * attaches to, and awaits runs of it. The temporal-side implementation
+ * lands in src/temporal/mcpserver/engine-client.ts; tests fake this
+ * interface directly.
+ *
+ * Failure classification (ConnectRunFailure) mirrors the error taxonomy
+ * Go's awaitConnectWorkflow switches on (connect.go:661-694). The engine
+ * classifies; the DOMAIN owns the gRPC codes and user-facing copy the
+ * classes map to — the split keeps Temporal error types out of handler
+ * code.
+ */
+/**
+ * The disconnected state: no Temporal behind this server (never
+ * connected since boot). Connect/startConnect refuse with Go's
+ * byte-pinned FailedPrecondition; the OAuth RPCs work fully — the
+ * ratified DB-1 split (sub-project 20260825.02).
+ */
+export const MCP_SERVER_ENGINE_DISCONNECTED = Object.freeze({ connected: false });
+//# sourceMappingURL=engine.js.map

package/dist/domain/mcpserver/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA+IH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC"}

package/dist/domain/mcpserver/get-oauth-grant-status.d.ts

@@ -0,0 +1,20 @@
+import type { GetOAuthGrantStatusInput, GetOAuthGrantStatusOutput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { OAuthConnectionHealth } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { OAuthGrant } from "../../store/interface.js";
+import type { McpServerConnectDeps } from "./connect.js";
+export declare function getOAuthGrantStatus(deps: McpServerConnectDeps, input: GetOAuthGrantStatusInput, identity: CallerIdentity): Promise<GetOAuthGrantStatusOutput>;
+/**
+ * Determines the health of an OAuth connection from locally available
+ * grant metadata (Go evaluateHealth). Uses the same 60-second expiry
+ * buffer as oauth/refresh.ts so the UX signal matches execution behavior.
+ *
+ * Ported bug, as-is (oss#863): "refreshable" keys off
+ * refreshTokenEnvVar != "" — but completeOAuthConnect sets that field
+ * unconditionally, so TOKEN_EXPIRED is unreachable through the real flow
+ * and an expired grant always claims refreshable even when no refresh
+ * token was ever issued. The conformance suite pins this behavior;
+ * fixing it is a both-editions change tracked on the issue.
+ */
+export declare function evaluateHealth(grant: OAuthGrant): OAuthConnectionHealth;
+//# sourceMappingURL=get-oauth-grant-status.d.ts.map

package/dist/domain/mcpserver/get-oauth-grant-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-oauth-grant-status.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/get-oauth-grant-status.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAEL,qBAAqB,EACtB,MAAM,uDAAuD,CAAC;AAI/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,wBAAwB,EAC/B,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAqCpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,qBAAqB,CAevE"}

package/dist/domain/mcpserver/get-oauth-grant-status.js

@@ -0,0 +1,77 @@
+/**
+ * getOAuthGrantStatus — ports
+ * pkg/domain/mcpserver/controller/get_oauth_grant_status.go: whether the
+ * authenticated user has an active OAuth grant for the specified MCP
+ * server in the given org. Returns grant metadata (connected status,
+ * token expiry, auth method, connection health) without exposing secret
+ * token values; the frontend renders the OAuth state in the MCP server
+ * detail page and session composer from it. In OSS mode the
+ * identity_account_id is always empty (single-user).
+ *
+ * Proven by mcpserver-oauth.conformance.test.ts
+ * (CONFORMANCE_TARGET=local) and
+ * __tests__/get-oauth-grant-status.test.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { GetOAuthGrantStatusOutputSchema, OAuthConnectionHealth, } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
+import { internalError, invalidArgumentError } from "../../pipeline/errors.js";
+import { authorizeDirect } from "../../pipeline/steps/authorize.js";
+import { REFRESH_EXPIRY_BUFFER_SECONDS } from "./oauth/refresh.js";
+export async function getOAuthGrantStatus(deps, input, identity) {
+    if (input.resourceId === "") {
+        throw invalidArgumentError("resource_id is required");
+    }
+    if (input.org === "") {
+        throw invalidArgumentError("org is required");
+    }
+    // The annotation's can_view check (validate → authorize, the Java
+    // McpServerGetOAuthGrantStatusHandler order — no load step). C2 Stage 4.
+    await authorizeDirect(McpServerQueryController.method.getOAuthGrantStatus, deps.authorizer, identity, input);
+    let grant;
+    try {
+        grant = await deps.oauthGrants.find("", input.resourceId, input.org);
+    }
+    catch (error) {
+        throw internalError(error, "failed to look up OAuth grant");
+    }
+    if (grant === undefined) {
+        return create(GetOAuthGrantStatusOutputSchema, {
+            connected: false,
+            connectionHealth: OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_NO_GRANT,
+        });
+    }
+    return create(GetOAuthGrantStatusOutputSchema, {
+        connected: true,
+        accessTokenExpiresAt: BigInt(grant.accessTokenExpiresAt),
+        targetEnvVar: grant.accessTokenEnvVar,
+        authMethod: grant.authMethod,
+        connectionHealth: evaluateHealth(grant),
+    });
+}
+/**
+ * Determines the health of an OAuth connection from locally available
+ * grant metadata (Go evaluateHealth). Uses the same 60-second expiry
+ * buffer as oauth/refresh.ts so the UX signal matches execution behavior.
+ *
+ * Ported bug, as-is (oss#863): "refreshable" keys off
+ * refreshTokenEnvVar != "" — but completeOAuthConnect sets that field
+ * unconditionally, so TOKEN_EXPIRED is unreachable through the real flow
+ * and an expired grant always claims refreshable even when no refresh
+ * token was ever issued. The conformance suite pins this behavior;
+ * fixing it is a both-editions change tracked on the issue.
+ */
+export function evaluateHealth(grant) {
+    if (grant.accessTokenExpiresAt === 0) {
+        return OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY;
+    }
+    const now = Math.floor(Date.now() / 1000);
+    if (now < grant.accessTokenExpiresAt - REFRESH_EXPIRY_BUFFER_SECONDS) {
+        return OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_HEALTHY;
+    }
+    if (grant.refreshTokenEnvVar !== "") {
+        return OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED_REFRESHABLE;
+    }
+    return OAuthConnectionHealth.OAUTH_CONNECTION_HEALTH_TOKEN_EXPIRED;
+}
+//# sourceMappingURL=get-oauth-grant-status.js.map

package/dist/domain/mcpserver/get-oauth-grant-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-oauth-grant-status.js","sourceRoot":"","sources":["../../../src/domain/mcpserver/get-oauth-grant-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAM5C,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AAGpG,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AAEnE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0B,EAC1B,KAA+B,EAC/B,QAAwB;IAExB,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,kEAAkE;IAClE,yEAAyE;IACzE,MAAM,eAAe,CACnB,wBAAwB,CAAC,MAAM,CAAC,mBAAmB,EACnD,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,KAAK,CACN,CAAC;IAEF,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,+BAA+B,EAAE;YAC7C,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,qBAAqB,CAAC,gCAAgC;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,+BAA+B,EAAE;QAC7C,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACxD,YAAY,EAAE,KAAK,CAAC,iBAAiB;QACrC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,qBAAqB,CAAC,+BAA+B,CAAC;IAC/D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC,oBAAoB,GAAG,6BAA6B,EAAE,CAAC;QACrE,OAAO,qBAAqB,CAAC,+BAA+B,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,qBAAqB,CAAC,iDAAiD,CAAC;IACjF,CAAC;IAED,OAAO,qBAAqB,CAAC,qCAAqC,CAAC;AACrE,CAAC"}

package/dist/domain/mcpserver/initiate-oauth-connect.d.ts

@@ -0,0 +1,52 @@
+import type { InitiateOAuthConnectInput, InitiateOAuthConnectOutput } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import type { Logger } from "../../boot/logger.js";
+import type { SecretService } from "../../encryption/encryption.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+import type { PendingOAuthState } from "../../store/interface.js";
+import type { McpServerConnectDeps } from "./connect.js";
+import type { AuthorizeRejection } from "./oauth/preflight.js";
+export declare function initiateOAuthConnect(deps: McpServerConnectDeps, input: InitiateOAuthConnectInput, identity: CallerIdentity): Promise<InitiateOAuthConnectOutput>;
+/**
+ * Builds the authorization URL (Go buildAuthorizationURL). Parameters are
+ * rendered SORTED by key — Go's url.Values.Encode() sorts, and the
+ * conformance suite asserts the exact parameter set — with
+ * form-urlencoding (spaces as +, both editions).
+ */
+export declare function buildAuthorizationUrl(authEndpoint: string, clientId: string, redirectUri: string, codeChallenge: string, state: string, scopes: string[], scopeParamName: string): string;
+/**
+ * Renders the user-facing copy for a pre-flight authorize rejection (Go
+ * dcrRejectionMessage). The wording is hedged — a 400 can in principle
+ * have other causes — but leads with the redirect-host allowlist because
+ * it is the only cause observed in the wild (Canva, stigmer/stigmer#235),
+ * and it names this deployment's callback host so self-hosted operators
+ * can act on it. Surfaces which render initiate errors pass this text
+ * through verbatim (getUserMessage in @stigmer/sdk), so it must stand on
+ * its own for an end user.
+ */
+export declare function dcrRejectionMessage(providerName: string, redirectUri: string, rejection: AuthorizeRejection): string;
+/**
+ * Encrypts the two real secrets in the pending row — code_verifier (every
+ * flow) and client_secret (vendor flow) — before they rest in SQLite, so
+ * handshake secrets never leak through filesystem backups of the database
+ * (oss#394; ports stigmer-cloud#294). The store itself stays a
+ * byte-faithful adapter; this call site is the single write seam.
+ *
+ * The row is a self-contained SNAPSHOT, never an alias of the OAuthApp's
+ * stored ciphertext: initiateVendorOAuth decrypts the app's secret
+ * (failing loudly if the key is unavailable), and the seal re-encrypts
+ * that plaintext with a fresh nonce. The token exchange must use the
+ * credentials the authorization code was minted for, not whatever a later
+ * resolution of the OAuthApp would return.
+ *
+ * The DCR path's empty client secret stays empty — never
+ * ciphertext-of-"" — so completeOAuthConnect and the token exchange keep
+ * seeing the emptiness that means "public client".
+ *
+ * Disabled encryption (no key configured) passes plaintext through with a
+ * WARN, matching the deployment-wide posture for environment, OAuthApp
+ * and ChannelApp secrets under the same key. A real encryption error
+ * while enabled throws so the caller fails the request instead of
+ * persisting plaintext.
+ */
+export declare function sealPendingOAuthState(secretService: SecretService, logger: Logger, state: PendingOAuthState): Promise<PendingOAuthState>;
+//# sourceMappingURL=initiate-oauth-connect.d.ts.map

package/dist/domain/mcpserver/initiate-oauth-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initiate-oauth-connect.d.ts","sourceRoot":"","sources":["../../../src/domain/mcpserver/initiate-oauth-connect.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,uDAAuD,CAAC;AAQ/D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAMzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,yBAAyB,EAChC,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,0BAA0B,CAAC,CAkGrC;AAoMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EAAE,EAChB,cAAc,EAAE,MAAM,GACrB,MAAM,CAkBR;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,kBAAkB,GAC5B,MAAM,CAkBR;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAmC5B"}