@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/check-options.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkMcpPluginOptions = checkMcpPluginOptions;
+const core_1 = require("@vendure/core");
+const constants_1 = require("./constants");
+const loopback_1 = require("./shared/loopback");
+/**
+ * @description
+ * Checks the resolved plugin options at startup: warns about settings that only matter on a real
+ * deployment, and throws when an OAuth option is shaped in a way nothing can work with.
+ */
+function checkMcpPluginOptions(options) {
+    var _a, _b;
+    const logging = options.logging;
+    if (logging.capture === 'full' && !logging.redact) {
+        core_1.Logger.warn('Full MCP logging is enabled without redaction. ' +
+            'This may store sensitive data. Add logging.redact to sanitize logs, ' +
+            'or switch to metadata-only logging.', constants_1.loggerCtx);
+    }
+    // Without an allowlist the endpoints answer any Host and Origin, which is what lets a
+    // page in a browser reach a server it should not.
+    const dnsRebinding = options.dnsRebinding;
+    if (process.env.NODE_ENV === 'production' &&
+        !((_a = dnsRebinding === null || dnsRebinding === void 0 ? void 0 : dnsRebinding.allowedHosts) === null || _a === void 0 ? void 0 : _a.length) &&
+        !((_b = dnsRebinding === null || dnsRebinding === void 0 ? void 0 : dnsRebinding.allowedOrigins) === null || _b === void 0 ? void 0 : _b.length)) {
+        core_1.Logger.warn('dnsRebinding is not set, so the MCP endpoints accept any Host and Origin header. ' +
+            'Set dnsRebinding.allowedHosts and dnsRebinding.allowedOrigins for a server that ' +
+            'browsers can reach.', constants_1.loggerCtx);
+    }
+    const oauth = options.oauth;
+    if (!oauth) {
+        return;
+    }
+    assertOauthShape(oauth);
+    // The same three tiers core uses for its superadmin credential check: production refuses to
+    // start, tests stay silent, and every other environment gets a warning.
+    const problems = collectProductionSafetyProblems(oauth);
+    if (process.env.NODE_ENV === 'production') {
+        if (problems.length) {
+            throw new Error(`McpPlugin: ${problems[0]}`);
+        }
+    }
+    else if (process.env.NODE_ENV !== 'test') {
+        for (const problem of problems) {
+            core_1.Logger.warn(`Unsafe for production: ${problem}`, constants_1.loggerCtx);
+        }
+    }
+}
+/** The OAuth options that cannot work in any environment, so they are refused everywhere. */
+function assertOauthShape(oauth) {
+    var _a;
+    if (!oauth.tokenSecret) {
+        throw new Error('McpPlugin: oauth.tokenSecret must be set to a non-empty secret string, because issued OAuth tokens are hashed with it.');
+    }
+    const issuer = (_a = oauth.issuer) !== null && _a !== void 0 ? _a : '';
+    let issuerUrl;
+    try {
+        issuerUrl = new URL(issuer);
+    }
+    catch (_b) {
+        throw issuerError(issuer);
+    }
+    if (issuerUrl.pathname !== '/' || issuerUrl.search || issuerUrl.hash) {
+        throw issuerError(issuer);
+    }
+    if (!staysOnIssuer(oauth.adminConsentPath, issuerUrl)) {
+        throw new Error(`McpPlugin: oauth.adminConsentPath "${oauth.adminConsentPath}" must be a path on ` +
+            `oauth.issuer, such as "/dashboard/mcp/authorize".`);
+    }
+    if (oauth.storefrontConsentUrl) {
+        try {
+            new URL(oauth.storefrontConsentUrl);
+        }
+        catch (_c) {
+            throw new Error(`McpPlugin: oauth.storefrontConsentUrl must be a full URL with a scheme, such as ` +
+                `"https://shop.example.com/mcp/authorize", got "${oauth.storefrontConsentUrl}".`);
+        }
+    }
+}
+function issuerError(issuer) {
+    return new Error(`McpPlugin: oauth.issuer must be a URL with a scheme and no path, such as ` +
+        `"https://example.com", got "${issuer}".`);
+}
+/**
+ * The admin consent page is served by the Vendure server itself. Forms such as "//host/x" and
+ * "/\\host/x" resolve to another host, which is why the origin is compared rather than the text.
+ */
+function staysOnIssuer(path, issuerUrl) {
+    try {
+        return new URL(path, issuerUrl).origin === issuerUrl.origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/** The OAuth settings that a production server must not run with, as messages. */
+function collectProductionSafetyProblems(oauth) {
+    var _a;
+    const problems = [];
+    if (oauth.allowLoopbackCimdDocuments) {
+        problems.push(`oauth.allowLoopbackCimdDocuments must be false in production; it lets any authorize ` +
+            `caller reach every port on this machine.`);
+    }
+    const issuerProblem = publicHttpsProblem('oauth.issuer', (_a = oauth.issuer) !== null && _a !== void 0 ? _a : '');
+    if (issuerProblem) {
+        problems.push(issuerProblem);
+    }
+    if (oauth.storefrontConsentUrl) {
+        const consentProblem = publicHttpsProblem('oauth.storefrontConsentUrl', oauth.storefrontConsentUrl);
+        if (consentProblem) {
+            problems.push(consentProblem);
+        }
+    }
+    return problems;
+}
+/** Names a URL option that clients on the public internet could not reach, or use safely. */
+function publicHttpsProblem(name, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_a) {
+        // Not a URL at all, so not a public address either.
+    }
+    if ((parsed === null || parsed === void 0 ? void 0 : parsed.protocol) !== 'https:' || (0, loopback_1.isLoopbackHostname)(parsed.hostname)) {
+        return `${name} must be a public https URL in production, got "${url}".`;
+    }
+    return undefined;
+}
+//# sourceMappingURL=check-options.js.map

package/lib/check-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-options.js","sourceRoot":"","sources":["../src/check-options.ts"],"names":[],"mappings":";;AAWA,sDA2CC;AAtDD,wCAAuC;AAEvC,2CAAwC;AAExC,gDAAuD;AAEvD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,OAAiC;;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAChD,aAAM,CAAC,IAAI,CACP,iDAAiD;YAC7C,sEAAsE;YACtE,qCAAqC,EACzC,qBAAS,CACZ,CAAC;IACN,CAAC;IACD,sFAAsF;IACtF,kDAAkD;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,IACI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,CAAC,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,YAAY,0CAAE,MAAM,CAAA;QACnC,CAAC,CAAA,MAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,cAAc,0CAAE,MAAM,CAAA,EACvC,CAAC;QACC,aAAM,CAAC,IAAI,CACP,mFAAmF;YAC/E,kFAAkF;YAClF,qBAAqB,EACzB,qBAAS,CACZ,CAAC;IACN,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO;IACX,CAAC;IACD,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAExB,4FAA4F;IAC5F,wEAAwE;IACxE,MAAM,QAAQ,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,aAAM,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,EAAE,qBAAS,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB,CAAC,KAAkC;;IACxD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,wHAAwH,CAC3H,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,MAAA,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC;IAClC,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACD,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,WAAM,CAAC;QACL,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;QACnE,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACX,sCAAsC,KAAK,CAAC,gBAAgB,sBAAsB;YAC9E,mDAAmD,CAC1D,CAAC;IACN,CAAC;IACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC7B,IAAI,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAAC,WAAM,CAAC;YACL,MAAM,IAAI,KAAK,CACX,kFAAkF;gBAC9E,kDAAkD,KAAK,CAAC,oBAAoB,IAAI,CACvF,CAAC;QACN,CAAC;IACL,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAC/B,OAAO,IAAI,KAAK,CACZ,2EAA2E;QACvE,+BAA+B,MAAM,IAAI,CAChD,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,SAAc;IAC/C,IAAI,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC;IAChE,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,+BAA+B,CAAC,KAAkC;;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,0BAA0B,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CACT,sFAAsF;YAClF,0CAA0C,CACjD,CAAC;IACN,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,cAAc,EAAE,MAAA,KAAK,CAAC,MAAM,mCAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,aAAa,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC7B,MAAM,cAAc,GAAG,kBAAkB,CAAC,4BAA4B,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACpG,IAAI,cAAc,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,6FAA6F;AAC7F,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAW;IACjD,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,WAAM,CAAC;QACL,oDAAoD;IACxD,CAAC;IACD,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,MAAK,QAAQ,IAAI,IAAA,6BAAkB,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,OAAO,GAAG,IAAI,mDAAmD,GAAG,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/lib/constants.d.ts

@@ -0,0 +1,48 @@
+import { CrudPermissionDefinition } from '@vendure/core';
+import { McpLogCapture, McpRateLimitOptions } from './types';
+export declare const MCP_PLUGIN_OPTIONS: unique symbol;
+export declare const loggerCtx = "McpPlugin";
+export declare const DEFAULT_TOOL_EXPOSURE: "direct";
+export declare const DEFAULT_SHOP_ACCESS: "anonymous";
+export declare const MCP_SETTINGS_NAMESPACE = "mcp";
+/** Field name registered in `settingsStoreFields` under {@link MCP_SETTINGS_NAMESPACE}. */
+export declare const MCP_TOOL_TOGGLES_FIELD_NAME = "tool-toggles";
+/** Namespaced lookup key used with `SettingsStoreService.get/set`. */
+export declare const MCP_TOOL_TOGGLES_STORE_KEY = "mcp.tool-toggles";
+/**
+ * JSON-RPC error code for a rate-limit refusal (handshake pre-check only).
+ */
+export declare const RATE_LIMIT_ERROR_CODE = -31029;
+export declare const RATE_LIMIT_WINDOW_MS = 60000;
+export declare const RATE_LIMIT_CACHE_PREFIX = "mcp:rate-limit";
+export declare const mcpServerPermission: CrudPermissionDefinition;
+/** Throttles how often a bearer-token call bumps `McpOauthGrant.lastActivityAt`. */
+export declare const MCP_GRANT_ACTIVITY_UPDATE_INTERVAL_MS = 60000;
+/** Turns the day-valued retention options into a cutoff date. */
+export declare const MS_PER_DAY = 86400000;
+export declare const MCP_UNUSED_OAUTH_CLIENT_RETENTION_MS = 86400000;
+/** Rows deleted per statement by a retention sweep — small enough not to lock a large table. */
+export declare const RETENTION_DELETE_BATCH_SIZE = 500;
+export declare const DEFAULT_LOG_TTL_DAYS = 30;
+export declare const DEFAULT_LOG_MAX_BODY_BYTES = 64000;
+export declare const DEFAULT_LOG_CAPTURE: McpLogCapture;
+export declare const DEFAULT_OAUTH_OPTIONS: {
+    readonly accessTokenTtlSeconds: number;
+    readonly refreshTokenTtlSeconds: number;
+    readonly authorizationCodeTtlSeconds: 60;
+    readonly authorizationRequestTtlSeconds: number;
+    readonly adminConsentPath: "/dashboard/mcp/authorize";
+    readonly allowLoopbackCimdDocuments: false;
+    readonly grantRetentionDays: 30;
+};
+/** The only grant types this server supports: advertised in the metadata, enforced at registration. */
+export declare const SUPPORTED_OAUTH_GRANT_TYPES: string[];
+export declare const CIMD_FETCH_TIMEOUT_MS = 5000;
+export declare const CIMD_MAX_DOCUMENT_BYTES: number;
+export declare const CIMD_MAX_CLIENT_ID_LENGTH = 512;
+export declare const MAX_CLIENT_METADATA_FIELD_LENGTH = 255;
+export declare const MAX_OAUTH_STATE_LENGTH = 255;
+export declare const CIMD_CACHE_TTL_SECONDS: number;
+/** Hard cap on simultaneous outbound CIMD fetches, regardless of how many distinct client_id URLs ask for one. */
+export declare const MAX_CONCURRENT_CIMD_FETCHES = 8;
+export declare const DEFAULT_RATE_LIMIT_OPTIONS: Required<McpRateLimitOptions>;

package/lib/constants.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RATE_LIMIT_OPTIONS = exports.MAX_CONCURRENT_CIMD_FETCHES = exports.CIMD_CACHE_TTL_SECONDS = exports.MAX_OAUTH_STATE_LENGTH = exports.MAX_CLIENT_METADATA_FIELD_LENGTH = exports.CIMD_MAX_CLIENT_ID_LENGTH = exports.CIMD_MAX_DOCUMENT_BYTES = exports.CIMD_FETCH_TIMEOUT_MS = exports.SUPPORTED_OAUTH_GRANT_TYPES = exports.DEFAULT_OAUTH_OPTIONS = exports.DEFAULT_LOG_CAPTURE = exports.DEFAULT_LOG_MAX_BODY_BYTES = exports.DEFAULT_LOG_TTL_DAYS = exports.RETENTION_DELETE_BATCH_SIZE = exports.MCP_UNUSED_OAUTH_CLIENT_RETENTION_MS = exports.MS_PER_DAY = exports.MCP_GRANT_ACTIVITY_UPDATE_INTERVAL_MS = exports.mcpServerPermission = exports.RATE_LIMIT_CACHE_PREFIX = exports.RATE_LIMIT_WINDOW_MS = exports.RATE_LIMIT_ERROR_CODE = exports.MCP_TOOL_TOGGLES_STORE_KEY = exports.MCP_TOOL_TOGGLES_FIELD_NAME = exports.MCP_SETTINGS_NAMESPACE = exports.DEFAULT_SHOP_ACCESS = exports.DEFAULT_TOOL_EXPOSURE = exports.loggerCtx = exports.MCP_PLUGIN_OPTIONS = void 0;
+const core_1 = require("@vendure/core");
+exports.MCP_PLUGIN_OPTIONS = Symbol('MCP_PLUGIN_OPTIONS');
+exports.loggerCtx = 'McpPlugin';
+exports.DEFAULT_TOOL_EXPOSURE = 'direct';
+exports.DEFAULT_SHOP_ACCESS = 'anonymous';
+exports.MCP_SETTINGS_NAMESPACE = 'mcp';
+/** Field name registered in `settingsStoreFields` under {@link MCP_SETTINGS_NAMESPACE}. */
+exports.MCP_TOOL_TOGGLES_FIELD_NAME = 'tool-toggles';
+/** Namespaced lookup key used with `SettingsStoreService.get/set`. */
+exports.MCP_TOOL_TOGGLES_STORE_KEY = `${exports.MCP_SETTINGS_NAMESPACE}.${exports.MCP_TOOL_TOGGLES_FIELD_NAME}`;
+/**
+ * JSON-RPC error code for a rate-limit refusal (handshake pre-check only).
+ */
+exports.RATE_LIMIT_ERROR_CODE = -31029;
+exports.RATE_LIMIT_WINDOW_MS = 60000;
+exports.RATE_LIMIT_CACHE_PREFIX = 'mcp:rate-limit';
+exports.mcpServerPermission = new core_1.CrudPermissionDefinition('McpServer');
+/** Throttles how often a bearer-token call bumps `McpOauthGrant.lastActivityAt`. */
+exports.MCP_GRANT_ACTIVITY_UPDATE_INTERVAL_MS = 60000;
+/** Turns the day-valued retention options into a cutoff date. */
+exports.MS_PER_DAY = 86400000;
+exports.MCP_UNUSED_OAUTH_CLIENT_RETENTION_MS = exports.MS_PER_DAY;
+/** Rows deleted per statement by a retention sweep — small enough not to lock a large table. */
+exports.RETENTION_DELETE_BATCH_SIZE = 500;
+exports.DEFAULT_LOG_TTL_DAYS = 30;
+// MySQL's TEXT columns cap out at 65,535 bytes, so this keeps a body under that limit.
+exports.DEFAULT_LOG_MAX_BODY_BYTES = 64000;
+exports.DEFAULT_LOG_CAPTURE = 'metadata';
+exports.DEFAULT_OAUTH_OPTIONS = {
+    accessTokenTtlSeconds: 15 * 60,
+    refreshTokenTtlSeconds: 30 * 24 * 60 * 60,
+    authorizationCodeTtlSeconds: 60,
+    authorizationRequestTtlSeconds: 10 * 60,
+    adminConsentPath: '/dashboard/mcp/authorize',
+    allowLoopbackCimdDocuments: false,
+    grantRetentionDays: 30,
+};
+/** The only grant types this server supports: advertised in the metadata, enforced at registration. */
+exports.SUPPORTED_OAUTH_GRANT_TYPES = ['authorization_code', 'refresh_token'];
+// CIMD (client_id metadata document) fetch budget, per the ~5 KB cap the spec recommends (§8.7).
+exports.CIMD_FETCH_TIMEOUT_MS = 5000;
+exports.CIMD_MAX_DOCUMENT_BYTES = 5 * 1024;
+// Keeps an over-long value a validation error (HTTP 400) rather than a database error at insert time.
+exports.CIMD_MAX_CLIENT_ID_LENGTH = 512;
+// Applies to client_name, client_uri, logo_uri and redirect_uri.
+exports.MAX_CLIENT_METADATA_FIELD_LENGTH = 255;
+// Declared separately from the client-metadata cap above so changing one doesn't change the other.
+exports.MAX_OAUTH_STATE_LENGTH = 255;
+// A fixed lifetime rather than the document's own Cache-Control header, so a hostile document
+// can't force one outbound fetch per authorization request.
+exports.CIMD_CACHE_TTL_SECONDS = 60 * 60;
+/** Hard cap on simultaneous outbound CIMD fetches, regardless of how many distinct client_id URLs ask for one. */
+exports.MAX_CONCURRENT_CIMD_FETCHES = 8;
+// The anonymous-IP and OAuth-IP limits are on by default as the backstop for those unauthenticated
+// surfaces. The per-tool defaults cap only the tools that create rows or refund money.
+exports.DEFAULT_RATE_LIMIT_OPTIONS = {
+    perSession: { rpm: 60 },
+    perUser: { rpm: 120 },
+    perClient: { rpm: 3000 },
+    perTool: {
+        place_order: { rpm: 5 },
+        create_product: { rpm: 10 },
+        refund_order: { rpm: 5 },
+        cancel_order: { rpm: 5 },
+    },
+    anonymousIp: { rpm: 60 },
+    oauthIp: { rpm: 60 },
+};
+//# sourceMappingURL=constants.js.map

package/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAAA,wCAAyD;AAI5C,QAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAElD,QAAA,SAAS,GAAG,WAAW,CAAC;AAExB,QAAA,qBAAqB,GAAG,QAAiB,CAAC;AAE1C,QAAA,mBAAmB,GAAG,WAAoB,CAAC;AAE3C,QAAA,sBAAsB,GAAG,KAAK,CAAC;AAC5C,2FAA2F;AAC9E,QAAA,2BAA2B,GAAG,cAAc,CAAC;AAC1D,sEAAsE;AACzD,QAAA,0BAA0B,GAAG,GAAG,8BAAsB,IAAI,mCAA2B,EAAE,CAAC;AAErG;;GAEG;AACU,QAAA,qBAAqB,GAAG,CAAC,KAAK,CAAC;AAC/B,QAAA,oBAAoB,GAAG,KAAM,CAAC;AAC9B,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AAE3C,QAAA,mBAAmB,GAAG,IAAI,+BAAwB,CAAC,WAAW,CAAC,CAAC;AAE7E,oFAAoF;AACvE,QAAA,qCAAqC,GAAG,KAAM,CAAC;AAE5D,iEAAiE;AACpD,QAAA,UAAU,GAAG,QAAU,CAAC;AAExB,QAAA,oCAAoC,GAAG,kBAAU,CAAC;AAC/D,gGAAgG;AACnF,QAAA,2BAA2B,GAAG,GAAG,CAAC;AAClC,QAAA,oBAAoB,GAAG,EAAE,CAAC;AACvC,uFAAuF;AAC1E,QAAA,0BAA0B,GAAG,KAAM,CAAC;AACpC,QAAA,mBAAmB,GAAkB,UAAU,CAAC;AAEhD,QAAA,qBAAqB,GAAG;IACjC,qBAAqB,EAAE,EAAE,GAAG,EAAE;IAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;IACzC,2BAA2B,EAAE,EAAE;IAC/B,8BAA8B,EAAE,EAAE,GAAG,EAAE;IACvC,gBAAgB,EAAE,0BAA0B;IAC5C,0BAA0B,EAAE,KAAK;IACjC,kBAAkB,EAAE,EAAE;CAChB,CAAC;AAEX,uGAAuG;AAC1F,QAAA,2BAA2B,GAAG,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;AAEnF,iGAAiG;AACpF,QAAA,qBAAqB,GAAG,IAAK,CAAC;AAC9B,QAAA,uBAAuB,GAAG,CAAC,GAAG,IAAI,CAAC;AAChD,sGAAsG;AACzF,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAC7C,iEAAiE;AACpD,QAAA,gCAAgC,GAAG,GAAG,CAAC;AACpD,mGAAmG;AACtF,QAAA,sBAAsB,GAAG,GAAG,CAAC;AAC1C,8FAA8F;AAC9F,4DAA4D;AAC/C,QAAA,sBAAsB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9C,kHAAkH;AACrG,QAAA,2BAA2B,GAAG,CAAC,CAAC;AAE7C,mGAAmG;AACnG,uFAAuF;AAC1E,QAAA,0BAA0B,GAAkC;IACrE,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;IACvB,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;IACrB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;IACxB,OAAO,EAAE;QACL,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;QACvB,cAAc,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAC3B,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;QACxB,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;KAC3B;IACD,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;IACxB,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;CACvB,CAAC"}

package/lib/delete-in-batches.d.ts

@@ -0,0 +1,5 @@
+import { ID, RequestContext, TransactionalConnection } from '@vendure/core';
+import { ObjectLiteral, ObjectType } from 'typeorm';
+export declare function deleteInBatches<R extends {
+    id: ID;
+}>(connection: TransactionalConnection, ctx: RequestContext, entity: ObjectType<ObjectLiteral>, selectBatch: () => Promise<R[]>, afterDelete?: (rows: R[]) => Promise<void>): Promise<number>;

package/lib/delete-in-batches.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deleteInBatches = deleteInBatches;
+const constants_1 = require("./constants");
+// Deletes in batches so a large retention sweep doesn't lock the table with one big statement.
+async function deleteInBatches(connection, ctx, entity, selectBatch, afterDelete) {
+    var _a;
+    const repository = connection.getRepository(ctx, entity);
+    let totalDeleted = 0;
+    for (;;) {
+        const rows = await selectBatch();
+        if (rows.length === 0) {
+            break;
+        }
+        const result = await repository
+            .createQueryBuilder()
+            .delete()
+            .where('id IN (:...ids)', { ids: rows.map(row => row.id) })
+            .execute();
+        await (afterDelete === null || afterDelete === void 0 ? void 0 : afterDelete(rows));
+        totalDeleted += (_a = result.affected) !== null && _a !== void 0 ? _a : rows.length;
+        if (rows.length < constants_1.RETENTION_DELETE_BATCH_SIZE) {
+            break;
+        }
+    }
+    return totalDeleted;
+}
+//# sourceMappingURL=delete-in-batches.js.map

package/lib/delete-in-batches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-in-batches.js","sourceRoot":"","sources":["../src/delete-in-batches.ts"],"names":[],"mappings":";;AAMA,0CA0BC;AA7BD,2CAA0D;AAE1D,+FAA+F;AACxF,KAAK,UAAU,eAAe,CACjC,UAAmC,EACnC,GAAmB,EACnB,MAAiC,EACjC,WAA+B,EAC/B,WAA0C;;IAE1C,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM;QACV,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU;aAC1B,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,KAAK,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;aAC1D,OAAO,EAAE,CAAC;QACf,MAAM,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAG,IAAI,CAAC,CAAA,CAAC;QAC1B,YAAY,IAAI,MAAA,MAAM,CAAC,QAAQ,mCAAI,IAAI,CAAC,MAAM,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,uCAA2B,EAAE,CAAC;YAC5C,MAAM;QACV,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACxB,CAAC"}

package/lib/entities/index.d.ts

@@ -0,0 +1,5 @@
+export * from './mcp-authorization-code.entity';
+export * from './mcp-authorization-request.entity';
+export * from './mcp-oauth-client.entity';
+export * from './mcp-oauth-grant.entity';
+export * from './mcp-tool-call-log.entity';

package/lib/entities/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./mcp-authorization-code.entity"), exports);
+__exportStar(require("./mcp-authorization-request.entity"), exports);
+__exportStar(require("./mcp-oauth-client.entity"), exports);
+__exportStar(require("./mcp-oauth-grant.entity"), exports);
+__exportStar(require("./mcp-tool-call-log.entity"), exports);
+//# sourceMappingURL=index.js.map

package/lib/entities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/entities/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kEAAgD;AAChD,qEAAmD;AACnD,4DAA0C;AAC1C,2DAAyC;AACzC,6DAA2C"}

package/lib/entities/mcp-authorization-code.entity.d.ts

@@ -0,0 +1,33 @@
+import { DeepPartial, ID, VendureEntity } from '@vendure/core';
+import { McpGrantUserType } from '../types';
+import { McpOauthClient } from './mcp-oauth-client.entity';
+/**
+ * @description
+ * Short-lived OAuth authorization code exchanged for tokens.
+ * The code is stored as a hash. Actor info is kept to recreate the session on exchange.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpAuthorizationCode extends VendureEntity {
+    constructor(input?: DeepPartial<McpAuthorizationCode>);
+    /**
+     * @description
+     * Hash of the authorization code. The raw code is never stored and is deleted after use.
+     */
+    code: string;
+    oauthClient: McpOauthClient;
+    oauthClientId: ID;
+    actorId: ID;
+    actorType: McpGrantUserType;
+    redirectUri: string;
+    /**
+     * @description
+     * Target endpoint (issuer + `/mcp/admin` or `/mcp/shop`).
+     * Must match during token exchange.
+     */
+    resource: string;
+    channelId: ID | null;
+    codeChallenge: string;
+    expiresAt: Date;
+}

package/lib/entities/mcp-authorization-code.entity.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthorizationCode = void 0;
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+const mcp_oauth_client_entity_1 = require("./mcp-oauth-client.entity");
+/**
+ * @description
+ * Short-lived OAuth authorization code exchanged for tokens.
+ * The code is stored as a hash. Actor info is kept to recreate the session on exchange.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+let McpAuthorizationCode = class McpAuthorizationCode extends core_1.VendureEntity {
+    constructor(input) {
+        super(input);
+    }
+};
+exports.McpAuthorizationCode = McpAuthorizationCode;
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationCode.prototype, "code", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.ManyToOne)(() => mcp_oauth_client_entity_1.McpOauthClient, { onDelete: 'CASCADE' }),
+    __metadata("design:type", mcp_oauth_client_entity_1.McpOauthClient)
+], McpAuthorizationCode.prototype, "oauthClient", void 0);
+__decorate([
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpAuthorizationCode.prototype, "oauthClientId", void 0);
+__decorate([
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpAuthorizationCode.prototype, "actorId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], McpAuthorizationCode.prototype, "actorType", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationCode.prototype, "redirectUri", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationCode.prototype, "resource", void 0);
+__decorate([
+    (0, core_1.EntityId)({ nullable: true }),
+    __metadata("design:type", Object)
+], McpAuthorizationCode.prototype, "channelId", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationCode.prototype, "codeChallenge", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date }),
+    __metadata("design:type", Date)
+], McpAuthorizationCode.prototype, "expiresAt", void 0);
+exports.McpAuthorizationCode = McpAuthorizationCode = __decorate([
+    (0, typeorm_1.Entity)(),
+    __metadata("design:paramtypes", [Object])
+], McpAuthorizationCode);
+//# sourceMappingURL=mcp-authorization-code.entity.js.map

package/lib/entities/mcp-authorization-code.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-authorization-code.entity.js","sourceRoot":"","sources":["../../src/entities/mcp-authorization-code.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAyE;AACzE,qCAA2D;AAI3D,uEAA2D;AAE3D;;;;;;;GAOG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,oBAAa;IACnD,YAAY,KAAyC;QACjD,KAAK,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;CA2CJ,CAAA;AA9CY,oDAAoB;AAW7B;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;kDACI;AAIb;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wCAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;8BAC5C,wCAAc;yDAAC;AAG5B;IADC,IAAA,eAAQ,GAAE;;2DACO;AAGlB;IADC,IAAA,eAAQ,GAAE;;qDACC;AAGZ;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;uDACA;AAG5B;IADC,IAAA,gBAAM,GAAE;;yDACW;AAQpB;IADC,IAAA,gBAAM,GAAE;;sDACQ;AAGjB;IADC,IAAA,eAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACR;AAGrB;IADC,IAAA,gBAAM,GAAE;;2DACa;AAItB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACZ,IAAI;uDAAC;+BA7CP,oBAAoB;IADhC,IAAA,gBAAM,GAAE;;GACI,oBAAoB,CA8ChC"}

package/lib/entities/mcp-authorization-request.entity.d.ts

@@ -0,0 +1,31 @@
+import { DeepPartial, ID, VendureEntity } from '@vendure/core';
+import { McpToolset } from '@vendure/mcp-sdk';
+import { McpOauthClient } from './mcp-oauth-client.entity';
+/**
+ * @description
+ * Pending OAuth authorization request before user consent.
+ * Stores redirect info, PKCE challenge, and a hashed request token.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpAuthorizationRequest extends VendureEntity {
+    constructor(input?: DeepPartial<McpAuthorizationRequest>);
+    /**
+     * @description
+     * Hash of the request token used by the consent page.
+     */
+    requestToken: string;
+    oauthClient: McpOauthClient;
+    oauthClientId: ID;
+    redirectUri: string;
+    state: string | null;
+    codeChallenge: string;
+    toolset: McpToolset;
+    /**
+     * @description
+     * Target endpoint (issuer + `/mcp/admin` or `/mcp/shop`).
+     */
+    resource: string;
+    expiresAt: Date;
+}

package/lib/entities/mcp-authorization-request.entity.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpAuthorizationRequest = void 0;
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+const mcp_oauth_client_entity_1 = require("./mcp-oauth-client.entity");
+/**
+ * @description
+ * Pending OAuth authorization request before user consent.
+ * Stores redirect info, PKCE challenge, and a hashed request token.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+let McpAuthorizationRequest = class McpAuthorizationRequest extends core_1.VendureEntity {
+    constructor(input) {
+        super(input);
+    }
+};
+exports.McpAuthorizationRequest = McpAuthorizationRequest;
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationRequest.prototype, "requestToken", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.ManyToOne)(() => mcp_oauth_client_entity_1.McpOauthClient, { onDelete: 'CASCADE' }),
+    __metadata("design:type", mcp_oauth_client_entity_1.McpOauthClient)
+], McpAuthorizationRequest.prototype, "oauthClient", void 0);
+__decorate([
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpAuthorizationRequest.prototype, "oauthClientId", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationRequest.prototype, "redirectUri", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpAuthorizationRequest.prototype, "state", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationRequest.prototype, "codeChallenge", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], McpAuthorizationRequest.prototype, "toolset", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpAuthorizationRequest.prototype, "resource", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date }),
+    __metadata("design:type", Date)
+], McpAuthorizationRequest.prototype, "expiresAt", void 0);
+exports.McpAuthorizationRequest = McpAuthorizationRequest = __decorate([
+    (0, typeorm_1.Entity)(),
+    __metadata("design:paramtypes", [Object])
+], McpAuthorizationRequest);
+//# sourceMappingURL=mcp-authorization-request.entity.js.map

package/lib/entities/mcp-authorization-request.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-authorization-request.entity.js","sourceRoot":"","sources":["../../src/entities/mcp-authorization-request.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAyE;AAEzE,qCAA2D;AAE3D,uEAA2D;AAE3D;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,oBAAa;IACtD,YAAY,KAA4C;QACpD,KAAK,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;CAuCJ,CAAA;AA1CY,0DAAuB;AAWhC;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;6DACY;AAIrB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wCAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;8BAC5C,wCAAc;4DAAC;AAG5B;IADC,IAAA,eAAQ,GAAE;;8DACO;AAGlB;IADC,IAAA,gBAAM,GAAE;;4DACW;AAGpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sDACvB;AAGrB;IADC,IAAA,gBAAM,GAAE;;8DACa;AAGtB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;wDACR;AAOpB;IADC,IAAA,gBAAM,GAAE;;yDACQ;AAIjB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACZ,IAAI;0DAAC;kCAzCP,uBAAuB;IADnC,IAAA,gBAAM,GAAE;;GACI,uBAAuB,CA0CnC"}

package/lib/entities/mcp-oauth-client.entity.d.ts

@@ -0,0 +1,56 @@
+import { DeepPartial, VendureEntity } from '@vendure/core';
+/**
+ * @description
+ * Metadata for an MCP client registered via OAuth Dynamic Client Registration, or resolved
+ * from a Client ID Metadata Document (CIMD) URL.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpOauthClient extends VendureEntity {
+    constructor(input?: DeepPartial<McpOauthClient>);
+    /**
+     * @description
+     * Unique client identifier (generated or metadata URL).
+     */
+    clientId: string;
+    /**
+     * @description
+     * The name the client picked for itself, shown to whoever is asked to approve it. Nothing
+     * verifies it, so treat it as untrusted.
+     */
+    clientName: string;
+    /**
+     * @description
+     * Homepage shown on the consent page. Null if the client sent none, or sent something that
+     * was not a valid `https` URL.
+     */
+    clientUri: string | null;
+    /**
+     * @description
+     * Client logo URL (HTTPS only).
+     */
+    logoUri: string | null;
+    redirectUris: string[];
+    /**
+     * @description
+     * Only `authorization_code` and `refresh_token` are accepted. Anything else a client asks
+     * for is dropped.
+     */
+    grantTypes: string[];
+    /**
+     * @description
+     * Always `none`. This server issues no client secrets, and refuses any other value at
+     * registration.
+     *
+     * @default 'none'
+     */
+    tokenEndpointAuthMethod: string;
+    /**
+     * @description
+     * When the cached copy of the client's metadata document goes stale and must be fetched
+     * again. Null for a client that registered itself and has no document.
+     */
+    cimdDocumentExpiresAt: Date | null;
+    lastUsedAt: Date | null;
+}