@stigmer/server 3.18.0-dev.20260918103812 → 3.18.1-dev.20260919070736

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/README.md +1 -1
  2. package/dist/boot/compose.d.ts +12 -0
  3. package/dist/boot/compose.d.ts.map +1 -1
  4. package/dist/boot/compose.js +46 -8
  5. package/dist/boot/compose.js.map +1 -1
  6. package/dist/boot/config.d.ts +6 -2
  7. package/dist/boot/config.d.ts.map +1 -1
  8. package/dist/boot/config.js.map +1 -1
  9. package/dist/boot/oauth-redirect-uri.d.ts +54 -0
  10. package/dist/boot/oauth-redirect-uri.d.ts.map +1 -0
  11. package/dist/boot/oauth-redirect-uri.js +37 -0
  12. package/dist/boot/oauth-redirect-uri.js.map +1 -0
  13. package/dist/domain/agentexecution/lifecycle.js +1 -1
  14. package/dist/domain/agentexecution/lifecycle.js.map +1 -1
  15. package/dist/domain/iampolicy/constants.d.ts +3 -3
  16. package/dist/domain/iampolicy/constants.js +3 -3
  17. package/dist/domain/mcpserver/complete-endpoint-auth.d.ts +16 -0
  18. package/dist/domain/mcpserver/complete-endpoint-auth.d.ts.map +1 -0
  19. package/dist/domain/mcpserver/complete-endpoint-auth.js +260 -0
  20. package/dist/domain/mcpserver/complete-endpoint-auth.js.map +1 -0
  21. package/dist/domain/mcpserver/complete-oauth-connect.d.ts.map +1 -1
  22. package/dist/domain/mcpserver/complete-oauth-connect.js +1 -1
  23. package/dist/domain/mcpserver/complete-oauth-connect.js.map +1 -1
  24. package/dist/domain/mcpserver/connect.d.ts +25 -0
  25. package/dist/domain/mcpserver/connect.d.ts.map +1 -1
  26. package/dist/domain/mcpserver/connect.js +8 -23
  27. package/dist/domain/mcpserver/connect.js.map +1 -1
  28. package/dist/domain/mcpserver/controller.d.ts.map +1 -1
  29. package/dist/domain/mcpserver/controller.js +12 -0
  30. package/dist/domain/mcpserver/controller.js.map +1 -1
  31. package/dist/domain/mcpserver/initiate-oauth-connect.d.ts.map +1 -1
  32. package/dist/domain/mcpserver/initiate-oauth-connect.js +16 -13
  33. package/dist/domain/mcpserver/initiate-oauth-connect.js.map +1 -1
  34. package/dist/domain/mcpserver/oauth/dcr.d.ts +10 -1
  35. package/dist/domain/mcpserver/oauth/dcr.d.ts.map +1 -1
  36. package/dist/domain/mcpserver/oauth/dcr.js +1 -9
  37. package/dist/domain/mcpserver/oauth/dcr.js.map +1 -1
  38. package/dist/domain/mcpserver/oauth/discovery.d.ts +43 -20
  39. package/dist/domain/mcpserver/oauth/discovery.d.ts.map +1 -1
  40. package/dist/domain/mcpserver/oauth/discovery.js +69 -54
  41. package/dist/domain/mcpserver/oauth/discovery.js.map +1 -1
  42. package/dist/domain/mcpserver/oauth/preflight.d.ts +27 -1
  43. package/dist/domain/mcpserver/oauth/preflight.d.ts.map +1 -1
  44. package/dist/domain/mcpserver/oauth/preflight.js +1 -26
  45. package/dist/domain/mcpserver/oauth/preflight.js.map +1 -1
  46. package/dist/domain/mcpserver/oauth/refresh.d.ts +2 -1
  47. package/dist/domain/mcpserver/oauth/refresh.d.ts.map +1 -1
  48. package/dist/domain/mcpserver/oauth/refresh.js +1 -1
  49. package/dist/domain/mcpserver/oauth/refresh.js.map +1 -1
  50. package/dist/domain/mcpserver/oauth/token.d.ts +9 -2
  51. package/dist/domain/mcpserver/oauth/token.d.ts.map +1 -1
  52. package/dist/domain/mcpserver/oauth/token.js +2 -8
  53. package/dist/domain/mcpserver/oauth/token.js.map +1 -1
  54. package/dist/domain/oauthapp/refresolution/refresolution.js +1 -1
  55. package/dist/domain/oauthapp/refresolution.js +1 -1
  56. package/dist/domain/platform/controller.d.ts +8 -1
  57. package/dist/domain/platform/controller.d.ts.map +1 -1
  58. package/dist/domain/platform/controller.js +2 -3
  59. package/dist/domain/platform/controller.js.map +1 -1
  60. package/dist/domain/plugin/constants.d.ts +7 -1
  61. package/dist/domain/plugin/constants.d.ts.map +1 -1
  62. package/dist/domain/plugin/constants.js +7 -1
  63. package/dist/domain/plugin/constants.js.map +1 -1
  64. package/dist/domain/plugin/materialize/plan.d.ts.map +1 -1
  65. package/dist/domain/plugin/materialize/plan.js +16 -1
  66. package/dist/domain/plugin/materialize/plan.js.map +1 -1
  67. package/dist/domain/plugin/members.d.ts +46 -0
  68. package/dist/domain/plugin/members.d.ts.map +1 -1
  69. package/dist/domain/plugin/members.js +31 -8
  70. package/dist/domain/plugin/members.js.map +1 -1
  71. package/dist/domain/plugin/push.d.ts +5 -3
  72. package/dist/domain/plugin/push.d.ts.map +1 -1
  73. package/dist/domain/plugin/push.js +58 -14
  74. package/dist/domain/plugin/push.js.map +1 -1
  75. package/dist/domain/workflowexecution/lifecycle.js +1 -1
  76. package/dist/domain/workflowexecution/lifecycle.js.map +1 -1
  77. package/dist/extensions/drivers.d.ts +17 -0
  78. package/dist/extensions/drivers.d.ts.map +1 -1
  79. package/dist/extensions/outbound-egress.d.ts +49 -0
  80. package/dist/extensions/outbound-egress.d.ts.map +1 -0
  81. package/dist/extensions/outbound-egress.js +51 -0
  82. package/dist/extensions/outbound-egress.js.map +1 -0
  83. package/dist/extensions/registry.d.ts +6 -0
  84. package/dist/extensions/registry.d.ts.map +1 -1
  85. package/dist/extensions/registry.js +10 -0
  86. package/dist/extensions/registry.js.map +1 -1
  87. package/dist/index.d.ts +2 -0
  88. package/dist/index.d.ts.map +1 -1
  89. package/dist/index.js +1 -0
  90. package/dist/index.js.map +1 -1
  91. package/dist/pipeline/apiresource-labels.d.ts +34 -1
  92. package/dist/pipeline/apiresource-labels.d.ts.map +1 -1
  93. package/dist/pipeline/apiresource-labels.js +31 -0
  94. package/dist/pipeline/apiresource-labels.js.map +1 -1
  95. package/dist/sandbox/kubernetes.d.ts.map +1 -1
  96. package/dist/sandbox/kubernetes.js +1 -8
  97. package/dist/sandbox/kubernetes.js.map +1 -1
  98. package/dist/sandbox/provisioner.d.ts +5 -20
  99. package/dist/sandbox/provisioner.d.ts.map +1 -1
  100. package/dist/sandbox/provisioner.js.map +1 -1
  101. package/dist/sandbox/steps.d.ts +8 -22
  102. package/dist/sandbox/steps.d.ts.map +1 -1
  103. package/dist/sandbox/steps.js +12 -17
  104. package/dist/sandbox/steps.js.map +1 -1
  105. package/dist/store/interface.d.ts +6 -2
  106. package/dist/store/interface.d.ts.map +1 -1
  107. package/dist/store/interface.js.map +1 -1
  108. package/package.json +6 -5
  109. package/src/boot/__tests__/oauth-redirect-uri.test.ts +38 -0
  110. package/src/boot/compose.ts +63 -10
  111. package/src/boot/config.ts +6 -2
  112. package/src/boot/oauth-redirect-uri.ts +53 -0
  113. package/src/domain/agentexecution/lifecycle.ts +1 -1
  114. package/src/domain/iampolicy/constants.ts +3 -3
  115. package/src/domain/mcpserver/__tests__/complete-endpoint-auth.test.ts +270 -0
  116. package/src/domain/mcpserver/__tests__/connect-authorization.test.ts +3 -0
  117. package/src/domain/mcpserver/__tests__/connect.test.ts +31 -0
  118. package/src/domain/mcpserver/complete-endpoint-auth.ts +277 -0
  119. package/src/domain/mcpserver/complete-oauth-connect.ts +1 -0
  120. package/src/domain/mcpserver/connect.ts +21 -15
  121. package/src/domain/mcpserver/controller.ts +16 -0
  122. package/src/domain/mcpserver/initiate-oauth-connect.ts +16 -12
  123. package/src/domain/mcpserver/oauth/__tests__/discovery.test.ts +120 -91
  124. package/src/domain/mcpserver/oauth/__tests__/token-refresh.test.ts +3 -1
  125. package/src/domain/mcpserver/oauth/dcr.ts +2 -1
  126. package/src/domain/mcpserver/oauth/discovery.ts +120 -89
  127. package/src/domain/mcpserver/oauth/preflight.ts +2 -1
  128. package/src/domain/mcpserver/oauth/refresh.ts +2 -1
  129. package/src/domain/mcpserver/oauth/token.ts +4 -3
  130. package/src/domain/oauthapp/__tests__/oauthapp.test.ts +2 -2
  131. package/src/domain/oauthapp/__tests__/refresolution.test.ts +2 -2
  132. package/src/domain/oauthapp/refresolution/refresolution.ts +1 -1
  133. package/src/domain/oauthapp/refresolution.ts +1 -1
  134. package/src/domain/platform/__tests__/platform.test.ts +47 -0
  135. package/src/domain/platform/controller.ts +10 -4
  136. package/src/domain/plugin/__tests__/materialize.test.ts +42 -47
  137. package/src/domain/plugin/__tests__/members.test.ts +149 -0
  138. package/src/domain/plugin/__tests__/plugin.test.ts +219 -8
  139. package/src/domain/plugin/constants.ts +7 -1
  140. package/src/domain/plugin/materialize/plan.ts +20 -1
  141. package/src/domain/plugin/members.ts +76 -7
  142. package/src/domain/plugin/push.ts +80 -20
  143. package/src/domain/workflowexecution/lifecycle.ts +1 -1
  144. package/src/extensions/__tests__/outbound-egress-points.test.ts +58 -0
  145. package/src/extensions/drivers.ts +17 -0
  146. package/src/extensions/outbound-egress.ts +55 -0
  147. package/src/extensions/registry.ts +19 -0
  148. package/src/index.ts +10 -0
  149. package/src/pipeline/apiresource-labels.ts +42 -1
  150. package/src/sandbox/__tests__/docker.integration.test.ts +0 -2
  151. package/src/sandbox/__tests__/kubernetes.test.ts +2 -10
  152. package/src/sandbox/__tests__/local-process.integration.test.ts +0 -3
  153. package/src/sandbox/__tests__/steps.test.ts +19 -72
  154. package/src/sandbox/kubernetes.ts +1 -8
  155. package/src/sandbox/provisioner.ts +5 -20
  156. package/src/sandbox/steps.ts +12 -29
  157. package/src/store/interface.ts +6 -2
@@ -1 +1 @@
1
- {"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/store/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAM3H;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,MAAM,EAAE,MAAM;CAI3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,MAAM,EAAE,MAAM;CAI3B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4DAA4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACxC,SAAS,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAMD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,0CAA0C;IAC1C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,CAAC;AAEzD,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAMD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,6DAA6D;IAC7D,IAAI,CACF,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACnC,MAAM,CACJ,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;OAOG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IACzE,6DAA6D;IAC7D,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IAKpB,4DAA4D;IAC5D,YAAY,CAAC,IAAI,SAAS,WAAW,EACnC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,oEAAoE;IACpE,WAAW,CAAC,IAAI,SAAS,WAAW,EAClC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,EACZ,MAAM,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,GACxC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5D,yDAAyD;IACzD,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,SAAS,WAAW,EAClC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,cAAc,CACZ,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAczB;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,IAAI,EAAE,eAAe,EACrB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAElC;;;;;;;;;;OAUG;IACH,8BAA8B,CAC5B,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,UAAU,EACxB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,kEAAkE;IAClE,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D;;;OAGG;IACH,yBAAyB,CACvB,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAAC;IAMnB,uEAAuE;IACvE,SAAS,CAAC,IAAI,SAAS,WAAW,EAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,EACvB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,mEAAmE;IACnE,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,aAAa,CAAC,IAAI,SAAS,WAAW,EACpC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,gBAAgB,CACd,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB,mEAAmE;IACnE,uBAAuB,CACrB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,gEAAgE;IAChE,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9E;;;OAGG;IACH,kBAAkB,CAChB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;;;;OAUG;IACH,WAAW,CACT,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,gBAAgB,CACd,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1B;;;;;;OAMG;IACH,oBAAoB,CAClB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;OAIG;IACH,mBAAmB,CACjB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,CAAC,CAAC;IAMxB;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,4BAA4B,EAAE,GAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;OAGG;IACH,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAE3C,uEAAuE;IACvE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAQ1D;;;;;OAKG;IACH,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,yEAAyE;IACzE,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE;;;OAGG;IACH,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAM3D;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,2DAA2D;IAC3D,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAMlC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAMpD,oEAAoE;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
1
+ {"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/store/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AAM3H;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,MAAM,EAAE,MAAM;CAI3B;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,MAAM,EAAE,MAAM;CAI3B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,4DAA4D;AAC5D,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0BAA0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,GACxC,SAAS,CAAC;IACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,kCAAkC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvC,0CAA0C;IAC1C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,QAAsB,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,CAAC;AAEzD,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,2BAA2B;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,KAAK,CACH,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE;;;;;OAKG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAMD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oBAAoB;IACpB,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,6DAA6D;IAC7D,IAAI,CACF,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACnC,MAAM,CACJ,iBAAiB,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;OAOG;IACH,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACxE;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC;IACzE,6DAA6D;IAC7D,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAMD;;;;;;GAMG;AACH,MAAM,WAAW,KAAK;IAKpB,4DAA4D;IAC5D,YAAY,CAAC,IAAI,SAAS,WAAW,EACnC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,oEAAoE;IACpE,WAAW,CAAC,IAAI,SAAS,WAAW,EAClC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,IAAI,EACZ,MAAM,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,GACxC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5D,yDAAyD;IACzD,cAAc,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;;OAMG;IACH,WAAW,CAAC,IAAI,SAAS,WAAW,EAClC,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B;;;;;;;;OAQG;IACH,cAAc,CACZ,IAAI,EAAE,eAAe,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB;;;;;;OAMG;IACH,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAczB;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,IAAI,EAAE,eAAe,EACrB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAElC;;;;;;;;;;OAUG;IACH,8BAA8B,CAC5B,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,UAAU,EACxB,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,kEAAkE;IAClE,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D;;;OAGG;IACH,yBAAyB,CACvB,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAAC;IAMnB,uEAAuE;IACvE,SAAS,CAAC,IAAI,SAAS,WAAW,EAChC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,EACZ,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,EACvB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,mEAAmE;IACnE,cAAc,CAAC,IAAI,SAAS,WAAW,EACrC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,aAAa,CAAC,IAAI,SAAS,WAAW,EACpC,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,IAAI,GACX,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/B,gEAAgE;IAChE,gBAAgB,CACd,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB,mEAAmE;IACnE,uBAAuB,CACrB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB,gEAAgE;IAChE,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9E;;;OAGG;IACH,kBAAkB,CAChB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;;;;;;;OAUG;IACH,WAAW,CACT,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;OAIG;IACH,gBAAgB,CACd,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1B;;;;;;OAMG;IACH,oBAAoB,CAClB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;;;OAIG;IACH,mBAAmB,CACjB,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,WAAW,CAAC,CAAC;IAMxB;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,4BAA4B,EAAE,GAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;OAGG;IACH,0BAA0B,CACxB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC;IAE3C,uEAAuE;IACvE,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAQ1D;;;;;OAKG;IACH,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D;;;;;;;;;OASG;IACH,6BAA6B,CAC3B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,yEAAyE;IACzE,gBAAgB,CACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEzD,0EAA0E;IAC1E,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE;;;OAGG;IACH,iBAAiB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAM3D;;;;OAIG;IACH,iBAAiB,CACf,IAAI,EAAE,eAAe,EACrB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,2DAA2D;IAC3D,iBAAiB,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5E;;;;;;;;OAQG;IACH,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE3E;;;OAGG;IACH,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAMlC,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAMpD,oEAAoE;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}
@@ -1 +1 @@
1
- {"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/store/interface.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,MAAc;QACxB,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,MAAc;QACxB,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAkLD,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwHlE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}
1
+ {"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/store/interface.ts"],"names":[],"mappings":"AAgCA,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,MAAc;QACxB,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,MAAc;QACxB,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAsLD,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAEhF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAwHlE;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@stigmer/server",
3
- "version": "3.18.0-dev.20260918103812",
3
+ "version": "3.18.1-dev.20260919070736",
4
4
  "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
5
5
  "license": "Apache-2.0",
6
6
  "type": "module",
@@ -62,10 +62,11 @@
62
62
  "@connectrpc/connect-node": "^2.0.0",
63
63
  "@kubernetes/client-node": "2.0.0",
64
64
  "@opentelemetry/api": "^1.9.0",
65
- "@stigmer/plugin-package": "3.18.0-dev.20260918103812",
66
- "@stigmer/protos": "3.18.0-dev.20260918103812",
67
- "@stigmer/temporal-codecs": "3.18.0-dev.20260918103812",
68
- "@stigmer/zip-structure": "3.18.0-dev.20260918103812",
65
+ "@stigmer/outbound": "3.18.1-dev.20260919070736",
66
+ "@stigmer/plugin-package": "3.18.1-dev.20260919070736",
67
+ "@stigmer/protos": "3.18.1-dev.20260919070736",
68
+ "@stigmer/temporal-codecs": "3.18.1-dev.20260919070736",
69
+ "@stigmer/zip-structure": "3.18.1-dev.20260919070736",
69
70
  "@temporalio/activity": "1.16.2",
70
71
  "@temporalio/client": "1.16.2",
71
72
  "@temporalio/common": "1.16.2",
@@ -0,0 +1,38 @@
1
+ /**
2
+ * Pins the OAuth redirect-URI posture: a configured value wins, a served
3
+ * console on a known port derives the console's callback page at
4
+ * localhost, and a server with no console or no known port derives nothing
5
+ * (today's warn and refusal stand).
6
+ */
7
+ import { describe, expect, it } from "vitest";
8
+
9
+ import { CONSOLE_OAUTH_CALLBACK_PATH, resolveOAuthRedirectUri } from "../oauth-redirect-uri.js";
10
+
11
+ describe("resolveOAuthRedirectUri", () => {
12
+ it("keeps a configured value whatever else is true", () => {
13
+ expect(resolveOAuthRedirectUri({ configured: "https://app.stigmer.test/auth/oauth/callback", servesConsole: true, port: 7777 })).toEqual({
14
+ kind: "configured",
15
+ uri: "https://app.stigmer.test/auth/oauth/callback",
16
+ });
17
+ expect(resolveOAuthRedirectUri({ configured: "https://app.stigmer.test/cb", servesConsole: false, port: 0 })).toEqual({
18
+ kind: "configured",
19
+ uri: "https://app.stigmer.test/cb",
20
+ });
21
+ });
22
+
23
+ it("derives the console's callback page at localhost on the unified port when the console is served", () => {
24
+ expect(resolveOAuthRedirectUri({ configured: "", servesConsole: true, port: 7777 })).toEqual({
25
+ kind: "derived",
26
+ uri: `http://localhost:7777${CONSOLE_OAUTH_CALLBACK_PATH}`,
27
+ });
28
+ expect(CONSOLE_OAUTH_CALLBACK_PATH).toBe("/auth/oauth/callback");
29
+ });
30
+
31
+ it("derives nothing for a server that serves no console", () => {
32
+ expect(resolveOAuthRedirectUri({ configured: "", servesConsole: false, port: 7777 })).toEqual({ kind: "absent" });
33
+ });
34
+
35
+ it("derives nothing when the port is not known until listen", () => {
36
+ expect(resolveOAuthRedirectUri({ configured: "", servesConsole: true, port: 0 })).toEqual({ kind: "absent" });
37
+ });
38
+ });
@@ -40,6 +40,7 @@ import { authorizationPostureOf } from "../authorization/posture.js";
40
40
  import { newBuiltInScheduleFireCaller } from "../authorization/schedule-fire-caller.js";
41
41
  import type { Authorizer } from "../extensions/authorizer.js";
42
42
  import { ABSENT_LICENSE_STATUS } from "../extensions/license-status.js";
43
+ import { relaxedEgressPolicy } from "../extensions/outbound-egress.js";
43
44
  import type { ListReadScope } from "../extensions/list-read-scope.js";
44
45
  import type { OrganizationDirectory } from "../extensions/organization-directory.js";
45
46
  import type { ScheduleFireCallerMint } from "../extensions/schedule-fire-caller.js";
@@ -86,6 +87,7 @@ import { newDirectAccountProvisioner } from "../domain/identityaccount/provision
86
87
  import { newResourceIdentityAccountStore } from "../domain/identityaccount/resource-store.js";
87
88
  import { registerIamPolicyServices } from "../domain/iampolicy/controller.js";
88
89
  import { newIamPolicyGrantPath } from "../domain/iampolicy/grant-path.js";
90
+ import { asFetch, guardedFetch, nodeLookup } from "@stigmer/outbound/egress";
89
91
  import { newOrganizationOnlyGrantScope } from "../domain/iampolicy/grant-scope.js";
90
92
  import { newMembershipRules } from "../domain/iampolicy/membership.js";
91
93
  import { newResourceIamPolicyStore } from "../domain/iampolicy/resource-store.js";
@@ -109,6 +111,7 @@ import { registerOAuthAppServices } from "../domain/oauthapp/controller.js";
109
111
  import { registerOrganizationServices } from "../domain/organization/controller.js";
110
112
  import { registerMcpServerServices } from "../domain/mcpserver/controller.js";
111
113
  import { registerPlatformServices } from "../domain/platform/controller.js";
114
+ import { SERVER_VERSION } from "../domain/platform/version.js";
112
115
  import { registerProjectServices } from "../domain/project/controller.js";
113
116
  import { registerSessionServices } from "../domain/session/controller.js";
114
117
  import { registerPluginServices } from "../domain/plugin/controller.js";
@@ -163,6 +166,7 @@ import { PostgresStore } from "../store/postgres/store.js";
163
166
  import { SqliteStore } from "../store/sqlite/store.js";
164
167
  import type { Store } from "../store/interface.js";
165
168
  import { resolveExtensions } from "../extensions/registry.js";
169
+ import { resolveOAuthRedirectUri } from "./oauth-redirect-uri.js";
166
170
  import type { ServerExtension } from "../extensions/registry.js";
167
171
  import { registerWorkflowServices } from "../domain/workflow/controller.js";
168
172
  import {
@@ -283,6 +287,18 @@ export interface ComposeOptions {
283
287
  * conformance rosters.
284
288
  */
285
289
  extensions?: ReadonlyArray<ServerExtension>;
290
+ /**
291
+ * The release this server reports through getServerInfo. Defaults to
292
+ * SERVER_VERSION: the esbuild define the all-in-one bundle stamps, or
293
+ * "dev" when unbundled. A composition that consumes @stigmer/server as a
294
+ * library runs no bundle and would otherwise report "dev" whatever
295
+ * release it installed, so it states the version of the package it
296
+ * composes (the installed package's own manifest is the honest source).
297
+ * A fact about the library the consumer installed, not about any
298
+ * extension unit — which is why it lives here and not on
299
+ * ServerExtension beside `edition`.
300
+ */
301
+ version?: string;
286
302
  /** Test seam forwarded to the model-registry upstream fetch. */
287
303
  fetchImpl?: typeof fetch;
288
304
  /** Test seam: bind an ephemeral port instead of config.grpcPort. */
@@ -1088,14 +1104,46 @@ export async function composeServer(
1088
1104
  config: temporalConfig,
1089
1105
  logger,
1090
1106
  });
1091
- // WARN-degrade, not boot-fatal (Go server.go:722-729): every OAuth RPC
1092
- // except initiateOAuthConnect works without the redirect URI, and
1093
- // initiate refuses with the pinned FailedPrecondition copy.
1094
- if (config.oauthRedirectUri === "") {
1095
- logger.warn(
1096
- "STIGMER_OAUTH_REDIRECT_URI is not set — OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)",
1097
- );
1107
+ // The OAuth callback: configured, or derived from the served console's
1108
+ // own origin when it serves one on a known port (boot/oauth-redirect-uri.ts
1109
+ // carries the posture). Absent is WARN-degrade, not boot-fatal (Go
1110
+ // server.go:722-729): every OAuth RPC except initiateOAuthConnect works
1111
+ // without the redirect URI, and initiate refuses with the pinned
1112
+ // FailedPrecondition copy.
1113
+ const oauthRedirect = resolveOAuthRedirectUri({
1114
+ configured: config.oauthRedirectUri,
1115
+ servesConsole: consoleAssets !== undefined,
1116
+ port: options.portOverride ?? config.grpcPort,
1117
+ });
1118
+ switch (oauthRedirect.kind) {
1119
+ case "configured":
1120
+ break;
1121
+ case "derived":
1122
+ logger.info("STIGMER_OAUTH_REDIRECT_URI is not set — deriving the served console's callback for MCP server OAuth Connect", {
1123
+ redirectUri: oauthRedirect.uri,
1124
+ });
1125
+ break;
1126
+ case "absent":
1127
+ logger.warn(
1128
+ "STIGMER_OAUTH_REDIRECT_URI is not set — OAuth Connect flows for MCP servers are unavailable (initiateOAuthConnect will refuse)",
1129
+ );
1130
+ break;
1131
+ default: {
1132
+ const exhaustive: never = oauthRedirect;
1133
+ throw new Error(String(exhaustive));
1134
+ }
1098
1135
  }
1136
+ const oauthRedirectUri = oauthRedirect.kind === "absent" ? "" : oauthRedirect.uri;
1137
+ // The ONE fetch the McpServer domain dials user-supplied URLs with: the
1138
+ // endpoint it probes at save time and the login server it reaches on
1139
+ // Sign in. Every hop is judged under the edition's egress policy
1140
+ // (`drivers.outboundEgress`; the default is open source's relaxed
1141
+ // posture, installed at this `??` site like the permissive Authorizer).
1142
+ // `options.fetchImpl` is the test seam under the guard.
1143
+ const outboundFetch = guardedFetch(
1144
+ extensions.drivers.outboundEgress ?? relaxedEgressPolicy(),
1145
+ { fetchImpl: options.fetchImpl ?? fetch, lookup: nodeLookup() },
1146
+ );
1099
1147
  // The SAME `routes` function registers every service on BOTH the serving
1100
1148
  // router and the in-process router transport (createInProcessClients).
1101
1149
  // Handlers are stateless over the same store, so the two routers behave
@@ -1321,6 +1369,9 @@ export async function composeServer(
1321
1369
  executionContextCreator: () =>
1322
1370
  requireInProcess().executionContextCreator,
1323
1371
  managedEnvService,
1372
+ // The run-start token refresh dials the vendor's token endpoint;
1373
+ // it rides the same egress-guarded fetch as every other OAuth call.
1374
+ fetchImpl: asFetch(outboundFetch),
1324
1375
  },
1325
1376
  });
1326
1377
  registerWorkflowServices(router, {
@@ -1401,7 +1452,8 @@ export async function composeServer(
1401
1452
  oauthGrants: store.oauthGrants,
1402
1453
  pendingOAuthStates: store.pendingOAuthStates,
1403
1454
  secretService,
1404
- oauthRedirectUri: config.oauthRedirectUri,
1455
+ oauthRedirectUri,
1456
+ outboundFetch,
1405
1457
  },
1406
1458
  });
1407
1459
  registerSkillServices(router, {
@@ -1473,6 +1525,7 @@ export async function composeServer(
1473
1525
  temporalNamespace: config.temporalNamespace,
1474
1526
  runnerAuthService: runnerCredentials,
1475
1527
  edition: extensions.edition,
1528
+ version: options.version ?? SERVER_VERSION,
1476
1529
  // The built-in `absent` answer installs here, at the consumer, when
1477
1530
  // no unit registered a license-status provider: open source and the
1478
1531
  // cloud hold no key, and only an Enterprise unit ever has one.
@@ -1655,8 +1708,8 @@ export async function composeServer(
1655
1708
  await artifactStorage.health();
1656
1709
  // Rebuild the search index before the port binds (Go
1657
1710
  // server.go:617): the index is separate from the resources table,
1658
- // and rebuilding here makes every resource — including seedpack
1659
- // rows bootstrapped into an earlier database — discoverable the
1711
+ // and rebuilding here makes every resource — including rows an
1712
+ // earlier release wrote into this database — discoverable the
1660
1713
  // moment the server accepts connections. Warn-only: a partial
1661
1714
  // rebuild degrades search, never boot.
1662
1715
  try {
@@ -109,8 +109,12 @@ export interface ServerConfig {
109
109
  readonly gitHubOAuthClientSecret: string;
110
110
  /**
111
111
  * The OAuth callback URL for the McpServer OAuth Connect flows
112
- * (STIGMER_OAUTH_REDIRECT_URI; Go config.go OAuthRedirectURI). Unset is
113
- * a WARN at wiring time, not a boot failure — every RPC except
112
+ * (STIGMER_OAUTH_REDIRECT_URI; Go config.go OAuthRedirectURI). Unset, a
113
+ * server that serves the web console on its unified port derives the
114
+ * console's own callback page at `http://localhost:<port>` (the
115
+ * `trusted-local` reading; boot/oauth-redirect-uri.ts), so a local
116
+ * install signs in without being told. Unset on a server that serves no
117
+ * console is a WARN at wiring time, not a boot failure — every RPC except
114
118
  * initiateOAuthConnect works without it, and initiate refuses with a
115
119
  * FailedPrecondition naming the variable (the pinned copy).
116
120
  */
@@ -0,0 +1,53 @@
1
+ /**
2
+ * Where an MCP server's OAuth Sign in comes back to, on a server that was
3
+ * not told.
4
+ *
5
+ * `STIGMER_OAUTH_REDIRECT_URI` is the callback URL the McpServer OAuth
6
+ * Connect flows hand the vendor's login server; the cloud sets it to its
7
+ * console's callback page. A local install (`stigmer up`, the desktop app,
8
+ * the all-in-one image) never set it, and `initiateOAuthConnect` refuses
9
+ * without it, so every Sign in surface the console offers was dead on a
10
+ * local install. The posture that already decides how a served console
11
+ * signs its users in (`trusted-local` when no issuer is configured) answers
12
+ * this too: a server that serves the console on its unified port is
13
+ * reached by a browser on the machine it runs on, so its callback is the
14
+ * console's callback page at `http://localhost:<port>`, the same host the
15
+ * config already assumes for `SKILL_TRANSFER_BASE_URL`.
16
+ *
17
+ * The rules, in order: a configured value always wins; a server that
18
+ * serves no console derives nothing (the CLI and the SDKs need no
19
+ * callback, and today's warn and refusal stand); a server whose port is
20
+ * not yet known (an ephemeral `0`, the test harness's shape) derives
21
+ * nothing either. The console's callback route is the web app's
22
+ * `app/auth/oauth/callback/page.tsx`; its path is a constant here because
23
+ * this is the one place the server names it.
24
+ *
25
+ * Proven by __tests__/oauth-redirect-uri.test.ts.
26
+ */
27
+
28
+ /** The console's OAuth callback page, relative to the served console's origin. */
29
+ export const CONSOLE_OAUTH_CALLBACK_PATH = "/auth/oauth/callback";
30
+
31
+ export type OAuthRedirectUriResolution =
32
+ /** The operator's value, as configured. */
33
+ | { readonly kind: "configured"; readonly uri: string }
34
+ /** Derived from the served console's own origin. */
35
+ | { readonly kind: "derived"; readonly uri: string }
36
+ /** Nothing to hand the login server; initiate refuses with the pinned copy. */
37
+ | { readonly kind: "absent" };
38
+
39
+ export interface OAuthRedirectUriInputs {
40
+ /** `STIGMER_OAUTH_REDIRECT_URI` as loaded; empty when unset. */
41
+ readonly configured: string;
42
+ /** Whether this server serves the web console on its unified port. */
43
+ readonly servesConsole: boolean;
44
+ /** The port the unified listener binds; 0 means "not known until listen". */
45
+ readonly port: number;
46
+ }
47
+
48
+ /** The callback URL the McpServer OAuth flows use, and where it came from. */
49
+ export function resolveOAuthRedirectUri(inputs: OAuthRedirectUriInputs): OAuthRedirectUriResolution {
50
+ if (inputs.configured !== "") return { kind: "configured", uri: inputs.configured };
51
+ if (!inputs.servesConsole || inputs.port === 0) return { kind: "absent" };
52
+ return { kind: "derived", uri: `http://localhost:${inputs.port}${CONSOLE_OAUTH_CALLBACK_PATH}` };
53
+ }
@@ -720,7 +720,7 @@ export async function recoverExecution(
720
720
  temporalConfig: deps.temporalConfig,
721
721
  },
722
722
  loadedExecution(ctx),
723
- ctx.callerIdentity,
723
+ ctx.callerIdentity.identityId,
724
724
  );
725
725
  },
726
726
  },
@@ -148,9 +148,9 @@ export const BLUEPRINT_KINDS: ReadonlyArray<ApiResourceKind> = [
148
148
  * a database whose accounts were provisioned before the rules existed is
149
149
  * reconciled once, at the first boot under the built-in authorization
150
150
  * posture, and never again — the value is the RFC 3339 time it finished.
151
- * Lives in `store.bootstrapState` beside the seedpack's own idempotency
152
- * keys; deleting it makes the next boot reconcile again, which is the
153
- * operator's deliberate act and nobody else's.
151
+ * Lives in `store.bootstrapState`, the store's one-shot boot state, and is
152
+ * the one key this server writes there; deleting it makes the next boot
153
+ * reconcile again, which is the operator's deliberate act and nobody else's.
154
154
  */
155
155
  export const ROLES_RECONCILED_KEY = "membership_rules_reconciled";
156
156
 
@@ -0,0 +1,270 @@
1
+ /**
2
+ * Pins CompleteEndpointAuth over a fake fetch: the author's shape and
3
+ * nothing else is probed; an OAuth challenge completes exactly the trio
4
+ * plus the provenance label and the completed spec passes the proto
5
+ * validator; every other outcome and a throwing fetch leave the spec as
6
+ * sent; carry-over reuses an earlier completion with no network; the
7
+ * console's exact echo keeps the label; the author's own auth drops it; a
8
+ * changed URL probes again; the Bearer default serves a hand-written auth;
9
+ * the label is recorded as stamped so GuardReservedLabels admits it.
10
+ */
11
+ import { create } from "@bufbuild/protobuf";
12
+ import { describe, expect, it } from "vitest";
13
+
14
+ import type { OutboundFetch } from "@stigmer/outbound/egress";
15
+ import { EnvVarDeclarationSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/spec_pb";
16
+ import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
17
+ import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
18
+ import { McpServerAuthSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
19
+ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
20
+
21
+ import { createLogger } from "../../../boot/logger.js";
22
+ import { MCP_AUTH_ENDPOINT, MCP_AUTH_LABEL } from "../../../pipeline/apiresource-labels.js";
23
+ import { RequestContext } from "../../../pipeline/request-context.js";
24
+ import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
25
+ import { EXISTING_RESOURCE_KEY } from "../../../pipeline/steps/load-existing.js";
26
+ import { serverStampedReservedLabels } from "../../../pipeline/steps/server-stamped-reserved-labels.js";
27
+ import { validator } from "../../../pipeline/steps/validation.js";
28
+ import { accessTokenVariable, newCompleteEndpointAuthStep } from "../complete-endpoint-auth.js";
29
+
30
+ const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
31
+
32
+ const URL_ONLY = "https://mcp.vendor.test/mcp";
33
+ const CHALLENGE = 'Bearer realm="OAuth", resource_metadata="https://mcp.vendor.test/.well-known/oauth-protected-resource/mcp"';
34
+ const VARIABLE = "LINEAR_ACCESS_TOKEN";
35
+
36
+ interface FakeFetch {
37
+ readonly fetchImpl: OutboundFetch;
38
+ readonly calls: { url: string; init: RequestInit | undefined }[];
39
+ }
40
+
41
+ function answering(status: number, headers: Record<string, string> = {}): FakeFetch {
42
+ const calls: FakeFetch["calls"] = [];
43
+ return {
44
+ calls,
45
+ fetchImpl: async (url, init) => {
46
+ calls.push({ url: String(url), init });
47
+ return new Response(null, { status, headers });
48
+ },
49
+ };
50
+ }
51
+
52
+ function throwing(): FakeFetch {
53
+ const calls: FakeFetch["calls"] = [];
54
+ return {
55
+ calls,
56
+ fetchImpl: async (url, init) => {
57
+ calls.push({ url: String(url), init });
58
+ throw new Error("connect ECONNREFUSED");
59
+ },
60
+ };
61
+ }
62
+
63
+ function server(overrides: { url?: string; headers?: Record<string, string>; env?: Record<string, { isSecret: boolean; optional?: boolean; description?: string }>; auth?: { targetEnvVar?: string; oauthOnly?: boolean; discoveryUrl?: string }; labels?: Record<string, string>; stdio?: boolean } = {}): McpServer {
64
+ return create(McpServerSchema, {
65
+ apiVersion: "agentic.stigmer.ai/v1",
66
+ kind: "McpServer",
67
+ metadata: { id: "mcps_1", name: "Linear", slug: "linear", org: "acme", labels: overrides.labels ?? {} },
68
+ spec: {
69
+ description: "Linear's hosted MCP server",
70
+ serverType: overrides.stdio === true ? { case: "stdio", value: { command: "npx" } } : { case: "http", value: { url: overrides.url ?? URL_ONLY, headers: overrides.headers ?? {} } },
71
+ env: Object.fromEntries(Object.entries(overrides.env ?? {}).map(([k, v]) => [k, create(EnvVarDeclarationSchema, { isSecret: v.isSecret, optional: v.optional ?? false, description: v.description ?? "" })])),
72
+ ...(overrides.auth !== undefined ? { auth: create(McpServerAuthSchema, overrides.auth) } : {}),
73
+ },
74
+ });
75
+ }
76
+
77
+ /** A row as an earlier save completed it: the trio and the label. */
78
+ function completedRow(url = URL_ONLY): McpServer {
79
+ return server({
80
+ url,
81
+ headers: { Authorization: `Bearer \${${VARIABLE}}` },
82
+ env: { [VARIABLE]: { isSecret: true, description: "OAuth access token for the 'linear' MCP server; Sign in fills it" } },
83
+ auth: { targetEnvVar: VARIABLE, oauthOnly: true },
84
+ labels: { [MCP_AUTH_LABEL]: MCP_AUTH_ENDPOINT },
85
+ });
86
+ }
87
+
88
+ async function run(incoming: McpServer, fake: FakeFetch, existing?: McpServer): Promise<RequestContext<typeof McpServerSchema>> {
89
+ const ctx = new RequestContext(McpServerSchema, incoming, testCallerIdentity(), ApiResourceKind.mcp_server);
90
+ if (existing !== undefined) ctx.set(EXISTING_RESOURCE_KEY, existing);
91
+ await newCompleteEndpointAuthStep({ outboundFetch: fake.fetchImpl, logger: silentLogger }).execute(ctx);
92
+ return ctx;
93
+ }
94
+
95
+ function expectCompleted(state: McpServer): void {
96
+ expect(state.spec?.auth?.targetEnvVar).toBe(VARIABLE);
97
+ expect(state.spec?.auth?.oauthOnly).toBe(true);
98
+ expect(state.spec?.auth?.discoveryUrl).toBe("");
99
+ expect(state.spec?.auth?.scopeHints).toEqual([]);
100
+ expect(state.spec?.env[VARIABLE]).toMatchObject({ isSecret: true, optional: false });
101
+ expect(state.spec?.env[VARIABLE]?.description).toContain("Sign in fills it");
102
+ expect(state.spec?.serverType.case === "http" ? state.spec.serverType.value.headers : {}).toEqual({ Authorization: `Bearer \${${VARIABLE}}` });
103
+ expect(state.metadata?.labels[MCP_AUTH_LABEL]).toBe(MCP_AUTH_ENDPOINT);
104
+ }
105
+
106
+ function expectUntouched(state: McpServer, incoming: McpServer): void {
107
+ expect(state.spec).toEqual(incoming.spec);
108
+ expect(state.metadata?.labels[MCP_AUTH_LABEL]).toBeUndefined();
109
+ }
110
+
111
+ describe("CompleteEndpointAuth: the author's shape is probed with one complete initialize", () => {
112
+ it("completes exactly the trio plus the label on an OAuth challenge, and the completed spec validates", async () => {
113
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
114
+ const ctx = await run(server(), fake);
115
+ expectCompleted(ctx.newState);
116
+ expect(fake.calls).toHaveLength(1);
117
+ expect(fake.calls[0]?.url).toBe(URL_ONLY);
118
+ const body = JSON.parse(String(fake.calls[0]?.init?.body)) as { method: string; params: { protocolVersion: string; clientInfo: { name: string } } };
119
+ expect(body.method).toBe("initialize");
120
+ expect(body.params.protocolVersion).toBe("2025-06-18");
121
+ expect(body.params.clientInfo.name).toBe("stigmer-server");
122
+ expect(serverStampedReservedLabels(ctx).has(MCP_AUTH_LABEL)).toBe(true);
123
+ expect(validator().validate(McpServerSchema, ctx.newState).kind).toBe("valid");
124
+ });
125
+
126
+ it("sends the author's literal headers with the probe", async () => {
127
+ const fake = answering(200);
128
+ await run(server({ headers: { "X-Vendor-Region": "eu" } }), fake);
129
+ expect((fake.calls[0]?.init?.headers as Record<string, string>)["X-Vendor-Region"]).toBe("eu");
130
+ });
131
+
132
+ it.each([
133
+ ["a 2xx (an open endpoint)", answering(200)],
134
+ ["a non-OAuth 401 (a static-token API)", answering(401, { "www-authenticate": 'Bearer error="invalid_token"' })],
135
+ ["a 401 without a challenge header", answering(401)],
136
+ ["any other status", answering(405)],
137
+ ["no answer at all", throwing()],
138
+ ])("leaves the spec as sent on %s", async (_label, fake) => {
139
+ const incoming = server();
140
+ const ctx = await run(incoming, fake);
141
+ expectUntouched(ctx.newState, incoming);
142
+ expect(serverStampedReservedLabels(ctx).has(MCP_AUTH_LABEL)).toBe(false);
143
+ });
144
+
145
+ it("never fails the save when the fetch it was handed throws synchronously", async () => {
146
+ const fetchImpl = (() => {
147
+ throw new Error("defective fetch");
148
+ }) as unknown as OutboundFetch;
149
+ const incoming = server();
150
+ const ctx = await run(incoming, { fetchImpl, calls: [] });
151
+ expectUntouched(ctx.newState, incoming);
152
+ });
153
+ });
154
+
155
+ describe("CompleteEndpointAuth: anything the author says about auth is left alone, unprobed", () => {
156
+ it.each([
157
+ ["a declared env variable", server({ headers: { Authorization: "Bearer ${TOKEN}" }, env: { TOKEN: { isSecret: true } } })],
158
+ ["a placeholder header without an env declaration", server({ headers: { "X-Api-Key": "${KEY}" } })],
159
+ ["a literal Authorization header, in any case", server({ headers: { authorization: "Bearer pasted-token" } })],
160
+ ["an auth block of the author's own", server({ auth: { targetEnvVar: "MY_TOKEN" }, env: { MY_TOKEN: { isSecret: true } } })],
161
+ ["a stdio server", server({ stdio: true })],
162
+ ])("does not probe %s", async (_label, incoming) => {
163
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
164
+ const ctx = await run(incoming, fake);
165
+ expect(fake.calls).toHaveLength(0);
166
+ expect(ctx.newState.metadata?.labels[MCP_AUTH_LABEL]).toBeUndefined();
167
+ });
168
+
169
+ it("completes the token path for a hand-written auth: the header when no header sends the token, the declaration when none exists", async () => {
170
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
171
+ const bare = await run(server({ auth: { targetEnvVar: "MY_TOKEN" }, env: { MY_TOKEN: { isSecret: true } } }), fake);
172
+ expect(bare.newState.spec?.serverType.case === "http" ? bare.newState.spec.serverType.value.headers : {}).toEqual({ Authorization: "Bearer ${MY_TOKEN}" });
173
+ const custom = await run(server({ auth: { targetEnvVar: "MY_TOKEN" }, env: { MY_TOKEN: { isSecret: true } }, headers: { "X-Token": "${MY_TOKEN}" } }), fake);
174
+ expect(custom.newState.spec?.serverType.case === "http" ? custom.newState.spec.serverType.value.headers : {}).toEqual({ "X-Token": "${MY_TOKEN}" });
175
+ // An auth whose variable was never declared could never receive its
176
+ // token (connect and execution inject only declared variables).
177
+ const undeclared = await run(server({ auth: { targetEnvVar: "MY_TOKEN" } }), fake);
178
+ expect(undeclared.newState.spec?.env["MY_TOKEN"]).toMatchObject({ isSecret: true, optional: false });
179
+ expect(undeclared.newState.spec?.env["MY_TOKEN"]?.description).toContain("Sign in fills it");
180
+ // A declaration the author wrote is left as written.
181
+ const declared = await run(server({ auth: { targetEnvVar: "MY_TOKEN" }, env: { MY_TOKEN: { isSecret: false, optional: true, description: "mine" } } }), fake);
182
+ expect(declared.newState.spec?.env["MY_TOKEN"]).toMatchObject({ isSecret: false, optional: true, description: "mine" });
183
+ expect(fake.calls).toHaveLength(0);
184
+ });
185
+
186
+ it("declares the variable for a stdio server's hand-written auth and adds no header", async () => {
187
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
188
+ const ctx = await run(server({ stdio: true, auth: { targetEnvVar: "MY_TOKEN" } }), fake);
189
+ expect(ctx.newState.spec?.env["MY_TOKEN"]).toMatchObject({ isSecret: true });
190
+ expect(ctx.newState.spec?.serverType.case).toBe("stdio");
191
+ expect(fake.calls).toHaveLength(0);
192
+ });
193
+ });
194
+
195
+ describe("CompleteEndpointAuth: carry-over on update, three questions in order", () => {
196
+ it("reuses an earlier completion for the author's shape at the same URL, with no network", async () => {
197
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
198
+ const ctx = await run(server(), fake, completedRow());
199
+ expectCompleted(ctx.newState);
200
+ expect(fake.calls).toHaveLength(0);
201
+ expect(serverStampedReservedLabels(ctx).has(MCP_AUTH_LABEL)).toBe(true);
202
+ });
203
+
204
+ it("keeps the label on an exact echo of the derived trio (the console's per-field save), with no network", async () => {
205
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
206
+ const echo = completedRow();
207
+ echo.spec!.description = "edited in the console";
208
+ const ctx = await run(echo, fake, completedRow());
209
+ expect(ctx.newState.metadata?.labels[MCP_AUTH_LABEL]).toBe(MCP_AUTH_ENDPOINT);
210
+ expect(ctx.newState.spec?.description).toBe("edited in the console");
211
+ expect(fake.calls).toHaveLength(0);
212
+ expect(serverStampedReservedLabels(ctx).has(MCP_AUTH_LABEL)).toBe(true);
213
+ });
214
+
215
+ it("drops the label when the author alters the derived trio: their auth is theirs now", async () => {
216
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
217
+ const altered = completedRow();
218
+ altered.spec!.auth!.discoveryUrl = "https://login.vendor.test";
219
+ const ctx = await run(altered, fake, completedRow());
220
+ expect(ctx.newState.spec?.auth?.discoveryUrl).toBe("https://login.vendor.test");
221
+ expect(ctx.newState.metadata?.labels[MCP_AUTH_LABEL]).toBeUndefined();
222
+ expect(fake.calls).toHaveLength(0);
223
+ });
224
+
225
+ it("drops the label when the author declares their own env on a completed row", async () => {
226
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
227
+ const own = server({ headers: { Authorization: "Bearer ${TOKEN}" }, env: { TOKEN: { isSecret: true } }, labels: { [MCP_AUTH_LABEL]: MCP_AUTH_ENDPOINT } });
228
+ const ctx = await run(own, fake, completedRow());
229
+ expect(ctx.newState.spec?.auth).toBeUndefined();
230
+ expect(ctx.newState.metadata?.labels[MCP_AUTH_LABEL]).toBeUndefined();
231
+ expect(fake.calls).toHaveLength(0);
232
+ });
233
+
234
+ it("probes again when the URL changed, and completes from the new answer", async () => {
235
+ const fake = answering(401, { "www-authenticate": CHALLENGE });
236
+ const moved = server({ url: "https://mcp2.vendor.test/mcp" });
237
+ const ctx = await run(moved, fake, completedRow());
238
+ expect(fake.calls).toHaveLength(1);
239
+ expect(fake.calls[0]?.url).toBe("https://mcp2.vendor.test/mcp");
240
+ expectCompleted(ctx.newState);
241
+ });
242
+
243
+ it("probes again when the URL changed, and drops the label when the new endpoint is open", async () => {
244
+ const fake = answering(200);
245
+ const moved = server({ url: "https://open.vendor.test/mcp", labels: { [MCP_AUTH_LABEL]: MCP_AUTH_ENDPOINT } });
246
+ const ctx = await run(moved, fake, completedRow());
247
+ expect(fake.calls).toHaveLength(1);
248
+ expect(ctx.newState.spec?.auth).toBeUndefined();
249
+ expect(ctx.newState.metadata?.labels[MCP_AUTH_LABEL]).toBeUndefined();
250
+ });
251
+
252
+ it("does not reuse a completion from a row that lacks the label (an author's own auth is not a completion)", async () => {
253
+ const fake = answering(200);
254
+ const authored = completedRow();
255
+ delete authored.metadata!.labels[MCP_AUTH_LABEL];
256
+ const incoming = server();
257
+ const ctx = await run(incoming, fake, authored);
258
+ expect(fake.calls).toHaveLength(1);
259
+ expectUntouched(ctx.newState, incoming);
260
+ });
261
+ });
262
+
263
+ describe("accessTokenVariable", () => {
264
+ it("upper-cases the slug and folds every non-alphanumeric run into one underscore", () => {
265
+ expect(accessTokenVariable("linear")).toBe("LINEAR_ACCESS_TOKEN");
266
+ expect(accessTokenVariable("my-plugin.github-mcp")).toBe("MY_PLUGIN_GITHUB_MCP_ACCESS_TOKEN");
267
+ expect(accessTokenVariable("--odd--")).toBe("ODD_ACCESS_TOKEN");
268
+ expect(accessTokenVariable("")).toBe("MCP_ACCESS_TOKEN");
269
+ });
270
+ });
@@ -118,6 +118,9 @@ function deps(authorizer: Authorizer): McpServerConnectDeps {
118
118
  pendingOAuthStates: store.pendingOAuthStates,
119
119
  secretService: unreachable("secretService"),
120
120
  oauthRedirectUri: "http://localhost:7233/oauth/callback",
121
+ outboundFetch: async () => {
122
+ throw new Error("no outbound fetch in this harness");
123
+ },
121
124
  };
122
125
  }
123
126