@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/entities/mcp-oauth-client.entity.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthClient = void 0;
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+/**
+ * @description
+ * Metadata for an MCP client registered via OAuth Dynamic Client Registration, or resolved
+ * from a Client ID Metadata Document (CIMD) URL.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+let McpOauthClient = class McpOauthClient extends core_1.VendureEntity {
+    constructor(input) {
+        super(input);
+    }
+};
+exports.McpOauthClient = McpOauthClient;
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)({ length: 512 }),
+    __metadata("design:type", String)
+], McpOauthClient.prototype, "clientId", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpOauthClient.prototype, "clientName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthClient.prototype, "clientUri", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthClient.prototype, "logoUri", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json' }),
+    __metadata("design:type", Array)
+], McpOauthClient.prototype, "redirectUris", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json' }),
+    __metadata("design:type", Array)
+], McpOauthClient.prototype, "grantTypes", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ default: 'none' }),
+    __metadata("design:type", String)
+], McpOauthClient.prototype, "tokenEndpointAuthMethod", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: Date, nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthClient.prototype, "cimdDocumentExpiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: Date, nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthClient.prototype, "lastUsedAt", void 0);
+exports.McpOauthClient = McpOauthClient = __decorate([
+    (0, typeorm_1.Entity)(),
+    __metadata("design:paramtypes", [Object])
+], McpOauthClient);
+//# sourceMappingURL=mcp-oauth-client.entity.js.map

package/lib/entities/mcp-oauth-client.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-client.entity.js","sourceRoot":"","sources":["../../src/entities/mcp-oauth-client.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAA2D;AAC3D,qCAAgD;AAEhD;;;;;;;GAOG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,oBAAa;IAC7C,YAAY,KAAmC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;CAgEJ,CAAA;AAnEY,wCAAc;AAWvB;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;gDACP;AAQjB;IADC,IAAA,gBAAM,GAAE;;kDACU;AAQnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACnB;AAOzB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACrB;AAGvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;oDACT;AAQvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;kDACX;AAUrB;IADC,IAAA,gBAAM,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;;+DACI;AAQhC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6DACJ;AAGnC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACf;yBAlEf,cAAc;IAD1B,IAAA,gBAAM,GAAE;;GACI,cAAc,CAmE1B"}

package/lib/entities/mcp-oauth-grant.entity.d.ts

@@ -0,0 +1,77 @@
+import { DeepPartial, ID, VendureEntity } from '@vendure/core';
+import { McpGrantUserType } from '../types';
+import { McpOauthClient } from './mcp-oauth-client.entity';
+/**
+ * @description
+ * The three states a grant can be in. Their alphabetical order is also their
+ * lifecycle order, so sorting by status ascending runs active, expired, revoked.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export type McpOauthGrantStatus = 'active' | 'expired' | 'revoked';
+/**
+ * @description
+ * Represents one MCP OAuth grant: the hashed access + refresh token pair issued to a
+ * client, the granting user, and the dedicated Vendure session created for the grant.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpOauthGrant extends VendureEntity {
+    constructor(input?: DeepPartial<McpOauthGrant>);
+    /**
+     * @description
+     * A hash of the access token, which is how a request finds its grant. The token itself is
+     * never stored, and every refresh replaces this hash.
+     */
+    accessTokenHash: string;
+    /**
+     * @description
+     * A hash of the refresh token. The token itself is never stored, and every refresh replaces
+     * this hash.
+     */
+    refreshTokenHash: string;
+    /**
+     * @description
+     * A hash of the refresh token the last refresh replaced. Null until the first refresh. If a
+     * client presents this old token, the server assumes it was stolen and revokes the grant.
+     */
+    previousRefreshTokenHash: string | null;
+    oauthClient: McpOauthClient;
+    oauthClientId: ID;
+    /**
+     * @description
+     * The user who approved this grant. Tool calls made with it run as that user.
+     */
+    actorId: ID;
+    /**
+     * @description
+     * Whether an administrator or a customer approved this grant. It also decides which MCP
+     * endpoint the grant's tokens may call.
+     */
+    actorType: McpGrantUserType;
+    /**
+     * @description
+     * The one endpoint these tokens work against: the issuer URL plus `/mcp/admin` or
+     * `/mcp/shop`. Presenting a token anywhere else is refused.
+     */
+    resource: string;
+    accessTokenExpiresAt: Date;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    /**
+     * @description
+     * The Vendure session this grant's tool calls run in. Revoking the grant deletes that
+     * session, and so does the cleanup job once the grant has expired.
+     */
+    vendureSessionId: ID;
+    channelId: ID | null;
+    lastActivityAt: Date;
+    /**
+     * @description
+     * Worked out on read rather than stored, so it is always current without anything having to
+     * update it.
+     */
+    get status(): McpOauthGrantStatus;
+}

package/lib/entities/mcp-oauth-grant.entity.js

@@ -0,0 +1,121 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpOauthGrant = void 0;
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+const DateUtils_1 = require("typeorm/util/DateUtils");
+const mcp_oauth_client_entity_1 = require("./mcp-oauth-client.entity");
+/**
+ * @description
+ * Represents one MCP OAuth grant: the hashed access + refresh token pair issued to a
+ * client, the granting user, and the dedicated Vendure session created for the grant.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+let McpOauthGrant = class McpOauthGrant extends core_1.VendureEntity {
+    constructor(input) {
+        super(input);
+    }
+    /**
+     * @description
+     * Worked out on read rather than stored, so it is always current without anything having to
+     * update it.
+     */
+    get status() {
+        if (this.revokedAt != null) {
+            return 'revoked';
+        }
+        return this.expiresAt.getTime() <= Date.now() ? 'expired' : 'active';
+    }
+};
+exports.McpOauthGrant = McpOauthGrant;
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpOauthGrant.prototype, "accessTokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpOauthGrant.prototype, "refreshTokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "previousRefreshTokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.ManyToOne)(() => mcp_oauth_client_entity_1.McpOauthClient, { onDelete: 'CASCADE' }),
+    __metadata("design:type", mcp_oauth_client_entity_1.McpOauthClient)
+], McpOauthGrant.prototype, "oauthClient", void 0);
+__decorate([
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "oauthClientId", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "actorId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], McpOauthGrant.prototype, "actorType", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpOauthGrant.prototype, "resource", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date }),
+    __metadata("design:type", Date)
+], McpOauthGrant.prototype, "accessTokenExpiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date }),
+    __metadata("design:type", Date)
+], McpOauthGrant.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date, nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "revokedAt", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, core_1.EntityId)(),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "vendureSessionId", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, core_1.EntityId)({ nullable: true }),
+    __metadata("design:type", Object)
+], McpOauthGrant.prototype, "channelId", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: Date }),
+    __metadata("design:type", Date)
+], McpOauthGrant.prototype, "lastActivityAt", void 0);
+__decorate([
+    (0, core_1.Calculated)({
+        query: qb => qb.setParameter('grant_status_now', DateUtils_1.DateUtils.mixedDateToUtcDatetimeString(new Date())),
+        expression: `CASE WHEN mcpoauthgrant.revokedAt IS NOT NULL THEN 'revoked' WHEN mcpoauthgrant.expiresAt <= :grant_status_now THEN 'expired' ELSE 'active' END`,
+    }),
+    __metadata("design:type", String),
+    __metadata("design:paramtypes", [])
+], McpOauthGrant.prototype, "status", null);
+exports.McpOauthGrant = McpOauthGrant = __decorate([
+    (0, typeorm_1.Entity)(),
+    __metadata("design:paramtypes", [Object])
+], McpOauthGrant);
+//# sourceMappingURL=mcp-oauth-grant.entity.js.map

package/lib/entities/mcp-oauth-grant.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-grant.entity.js","sourceRoot":"","sources":["../../src/entities/mcp-oauth-grant.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAqF;AACrF,qCAA2D;AAC3D,sDAAmD;AAInD,uEAA2D;AAY3D;;;;;;;GAOG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,oBAAa;IAC5C,YAAY,KAAkC;QAC1C,KAAK,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAyFD;;;;OAIG;IACH,IAII,MAAM;QACN,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzE,CAAC;CACJ,CAAA;AA3GY,sCAAa;AAYtB;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;sDACe;AASxB;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,GAAE;;uDACgB;AASzB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACJ;AAIxC;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wCAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;8BAC5C,wCAAc;kDAAC;AAG5B;IADC,IAAA,eAAQ,GAAE;;oDACO;AAQlB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,eAAQ,GAAE;;8CACC;AAQZ;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;gDACA;AAQ5B;IADC,IAAA,gBAAM,GAAE;;+CACQ;AAIjB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACD,IAAI;2DAAC;AAI3B;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACZ,IAAI;gDAAC;AAIhB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAChB;AASvB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,eAAQ,GAAE;;uDACU;AAIrB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,eAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACR;AAIrB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACP,IAAI;qDAAC;AAOrB;IAAC,IAAA,iBAAU,EAAC;QACR,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAkB,EAAE,qBAAS,CAAC,4BAA4B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACpG,UAAU,EAAE,iJAAiJ;KAChK,CAAC;;;2CAMD;wBA1GQ,aAAa;IADzB,IAAA,gBAAM,GAAE;;GACI,aAAa,CA2GzB"}

package/lib/entities/mcp-tool-call-log.entity.d.ts

@@ -0,0 +1,50 @@
+import { DeepPartial, ID, VendureEntity } from '@vendure/core';
+import { McpActorType, McpToolCallStatus } from '../types';
+import { McpOauthClient } from './mcp-oauth-client.entity';
+import { McpOauthGrant } from './mcp-oauth-grant.entity';
+/**
+ * @description
+ * Audit record of a single MCP tool call.
+ *
+ * A row exists only for a call that actually ran the tool. Calls turned away first, by a rate
+ * limit, a permission check, an unknown or switched-off tool, bad arguments, or a confirmation
+ * request, leave no trace here.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpToolCallLog extends VendureEntity {
+    constructor(input?: DeepPartial<McpToolCallLog>);
+    /**
+     * @description
+     * Null when the call did not arrive over OAuth, and set back to null if the cleanup job
+     * later deletes the grant.
+     */
+    grant: McpOauthGrant | null;
+    grantId: ID | null;
+    /**
+     * @description
+     * Id of the user the call ran as. Null when nobody was signed in.
+     */
+    actor: string | null;
+    actorType: McpActorType;
+    /**
+     * @description
+     * Null unless `logging.captureClientIp` is on, and null for calls that never came over HTTP.
+     * The Admin API also hides it from anyone without the `ReadCustomer` permission.
+     */
+    clientIp: string | null;
+    channelId: ID | null;
+    toolName: string;
+    /**
+     * @description
+     * The plugin that registered the tool, or `unknown` if it could not be traced back to one.
+     */
+    pluginSource: string | null;
+    input: unknown;
+    output: unknown;
+    durationMs: number | null;
+    status: McpToolCallStatus;
+    oauthClient: McpOauthClient | null;
+    oauthClientId: ID | null;
+}

package/lib/entities/mcp-tool-call-log.entity.js

@@ -0,0 +1,101 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolCallLog = void 0;
+const core_1 = require("@vendure/core");
+const typeorm_1 = require("typeorm");
+const mcp_oauth_client_entity_1 = require("./mcp-oauth-client.entity");
+const mcp_oauth_grant_entity_1 = require("./mcp-oauth-grant.entity");
+/**
+ * @description
+ * Audit record of a single MCP tool call.
+ *
+ * A row exists only for a call that actually ran the tool. Calls turned away first, by a rate
+ * limit, a permission check, an unknown or switched-off tool, bad arguments, or a confirmation
+ * request, leave no trace here.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+let McpToolCallLog = class McpToolCallLog extends core_1.VendureEntity {
+    constructor(input) {
+        super(input);
+    }
+};
+exports.McpToolCallLog = McpToolCallLog;
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.ManyToOne)(() => mcp_oauth_grant_entity_1.McpOauthGrant, { nullable: true, onDelete: 'SET NULL' }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "grant", void 0);
+__decorate([
+    (0, core_1.EntityId)({ nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "grantId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "actor", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], McpToolCallLog.prototype, "actorType", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "clientIp", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, core_1.EntityId)({ nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "channelId", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], McpToolCallLog.prototype, "toolName", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "pluginSource", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "input", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'simple-json', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "output", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: 'int', nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "durationMs", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], McpToolCallLog.prototype, "status", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.ManyToOne)(() => mcp_oauth_client_entity_1.McpOauthClient, { nullable: true, onDelete: 'SET NULL' }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "oauthClient", void 0);
+__decorate([
+    (0, core_1.EntityId)({ nullable: true }),
+    __metadata("design:type", Object)
+], McpToolCallLog.prototype, "oauthClientId", void 0);
+exports.McpToolCallLog = McpToolCallLog = __decorate([
+    (0, typeorm_1.Index)(['createdAt']),
+    (0, typeorm_1.Entity)(),
+    __metadata("design:paramtypes", [Object])
+], McpToolCallLog);
+//# sourceMappingURL=mcp-tool-call-log.entity.js.map

package/lib/entities/mcp-tool-call-log.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tool-call-log.entity.js","sourceRoot":"","sources":["../../src/entities/mcp-tool-call-log.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAAyE;AACzE,qCAA2D;AAI3D,uEAA2D;AAC3D,qEAAyD;AAEzD;;;;;;;;;;GAUG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,oBAAa;IAC7C,YAAY,KAAmC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;CAmEJ,CAAA;AAtEY,wCAAc;AAYvB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,sCAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;;6CAC7C;AAG5B;IADC,IAAA,eAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACV;AAOnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CACvB;AAGrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;iDACJ;AAQxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACpB;AAIxB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,eAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDACR;AAIrB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,GAAE;;gDACQ;AAOjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDAChB;AAG5B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;6CACjC;AAGf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;8CAChC;AAIhB;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACd;AAI1B;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;8CACF;AAI1B;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wCAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;;mDACvC;AAGnC;IADC,IAAA,eAAQ,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACJ;yBArEhB,cAAc;IAF1B,IAAA,eAAK,EAAC,CAAC,WAAW,CAAC,CAAC;IACpB,IAAA,gBAAM,GAAE;;GACI,cAAc,CAsE1B"}

package/lib/events/mcp-tool-call.event.d.ts

@@ -0,0 +1,17 @@
+import { RequestContext, VendureEvent } from '@vendure/core';
+import { McpToolCallLog } from '../entities/mcp-tool-call-log.entity';
+/**
+ * @description
+ * Fired after a tool call is executed and its log entry is saved.
+ *
+ * Carries the request context and the persisted log entry.
+ * Only emitted for calls that actually ran.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+export declare class McpToolCallEvent extends VendureEvent {
+    ctx: RequestContext;
+    entry: McpToolCallLog;
+    constructor(ctx: RequestContext, entry: McpToolCallLog);
+}

package/lib/events/mcp-tool-call.event.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolCallEvent = void 0;
+const core_1 = require("@vendure/core");
+/**
+ * @description
+ * Fired after a tool call is executed and its log entry is saved.
+ *
+ * Carries the request context and the persisted log entry.
+ * Only emitted for calls that actually ran.
+ *
+ * @docsCategory core plugins/McpPlugin
+ * @since 3.8.0
+ */
+class McpToolCallEvent extends core_1.VendureEvent {
+    constructor(ctx, entry) {
+        super();
+        this.ctx = ctx;
+        this.entry = entry;
+    }
+}
+exports.McpToolCallEvent = McpToolCallEvent;
+//# sourceMappingURL=mcp-tool-call.event.js.map

package/lib/events/mcp-tool-call.event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tool-call.event.js","sourceRoot":"","sources":["../../src/events/mcp-tool-call.event.ts"],"names":[],"mappings":";;;AAAA,wCAA6D;AAI7D;;;;;;;;;GASG;AACH,MAAa,gBAAiB,SAAQ,mBAAY;IAC9C,YACW,GAAmB,EACnB,KAAqB;QAE5B,KAAK,EAAE,CAAC;QAHD,QAAG,GAAH,GAAG,CAAgB;QACnB,UAAK,GAAL,KAAK,CAAgB;IAGhC,CAAC;CACJ;AAPD,4CAOC"}

package/lib/get-client-ip.d.ts

@@ -0,0 +1,2 @@
+import type { Request } from 'express';
+export declare function getClientIp(req: Request): string | undefined;

package/lib/get-client-ip.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClientIp = getClientIp;
+const node_net_1 = require("node:net");
+function getClientIp(req) {
+    var _a, _b;
+    const value = (_a = req.ip) !== null && _a !== void 0 ? _a : (_b = req.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress;
+    return value != null && (0, node_net_1.isIP)(value) !== 0 ? value : undefined;
+}
+//# sourceMappingURL=get-client-ip.js.map

package/lib/get-client-ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-client-ip.js","sourceRoot":"","sources":["../src/get-client-ip.ts"],"names":[],"mappings":";;AAGA,kCAGC;AALD,uCAAgC;AAEhC,SAAgB,WAAW,CAAC,GAAY;;IACpC,MAAM,KAAK,GAAG,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,CAAC;IAClD,OAAO,KAAK,IAAI,IAAI,IAAI,IAAA,eAAI,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/lib/get-language-code.d.ts

@@ -0,0 +1,3 @@
+import { LanguageCode } from '@vendure/core';
+import type { Request } from 'express';
+export declare function getLanguageCodeFromQuery(req: Request | undefined): LanguageCode | undefined;

package/lib/get-language-code.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLanguageCodeFromQuery = getLanguageCodeFromQuery;
+// Matches how core's RequestContextService reads languageCode for the GraphQL APIs: a format
+// check, not an enum check, so custom language codes pass and anything else falls back to the
+// channel default.
+function getLanguageCodeFromQuery(req) {
+    var _a;
+    const value = (_a = req === null || req === void 0 ? void 0 : req.query) === null || _a === void 0 ? void 0 : _a.languageCode;
+    return typeof value === 'string' && /^[a-zA-Z0-9_-]+$/.test(value) ? value : undefined;
+}
+//# sourceMappingURL=get-language-code.js.map

package/lib/get-language-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-language-code.js","sourceRoot":"","sources":["../src/get-language-code.ts"],"names":[],"mappings":";;AAMA,4DAGC;AAND,6FAA6F;AAC7F,8FAA8F;AAC9F,mBAAmB;AACnB,SAAgB,wBAAwB,CAAC,GAAwB;;IAC7D,MAAM,KAAK,GAAG,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,0CAAE,YAAY,CAAC;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7G,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,6 @@
+export { McpToolCallLog } from './entities/mcp-tool-call-log.entity';
+export * from './events/mcp-tool-call.event';
+export * from './plugin';
+export { McpToolExecutionService } from './registry/mcp-tool-execution.service';
+export { McpToolRegistryService } from './registry/mcp-tool-registry.service';
+export type { McpActorType, McpDnsRebindingOptions, McpGrantUserType, McpLogCapture, McpLogRedactFn, McpLoggingOptions, McpOauthOptions, McpPluginOptions, McpRateLimitOptions, McpRetentionSchedule, McpToolCallStatus, McpToolExposureMode, McpToolSummary, } from './types';

package/lib/index.js

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolRegistryService = exports.McpToolExecutionService = exports.McpToolCallLog = void 0;
+var mcp_tool_call_log_entity_1 = require("./entities/mcp-tool-call-log.entity");
+Object.defineProperty(exports, "McpToolCallLog", { enumerable: true, get: function () { return mcp_tool_call_log_entity_1.McpToolCallLog; } });
+__exportStar(require("./events/mcp-tool-call.event"), exports);
+__exportStar(require("./plugin"), exports);
+var mcp_tool_execution_service_1 = require("./registry/mcp-tool-execution.service");
+Object.defineProperty(exports, "McpToolExecutionService", { enumerable: true, get: function () { return mcp_tool_execution_service_1.McpToolExecutionService; } });
+var mcp_tool_registry_service_1 = require("./registry/mcp-tool-registry.service");
+Object.defineProperty(exports, "McpToolRegistryService", { enumerable: true, get: function () { return mcp_tool_registry_service_1.McpToolRegistryService; } });
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gFAAqE;AAA5D,0HAAA,cAAc,OAAA;AACvB,+DAA6C;AAC7C,2CAAyB;AACzB,oFAAgF;AAAvE,qIAAA,uBAAuB,OAAA;AAChC,kFAA8E;AAArE,mIAAA,sBAAsB,OAAA"}

package/lib/internal-types.d.ts

@@ -0,0 +1,27 @@
+import type { RequestContext } from '@vendure/core';
+import type { DEFAULT_OAUTH_OPTIONS } from './constants';
+import type { McpOauthGrant } from './entities/mcp-oauth-grant.entity';
+import type { McpLoggingOptions, McpOauthOptions, McpPluginOptions, McpRateLimitOptions } from './types';
+export interface McpExecutionContext {
+    ctx: RequestContext;
+    grant?: McpOauthGrant;
+    clientIp?: string;
+}
+export type McpAuthenticatedContext = Required<Pick<McpExecutionContext, 'ctx' | 'grant'>>;
+export type McpOauthOptionsWithDefaults = McpOauthOptions & Required<Pick<McpOauthOptions, keyof typeof DEFAULT_OAUTH_OPTIONS>>;
+/**
+ * Plugin options after `resolveMcpPluginOptions` has applied every documented default.
+ * Services receive this via `MCP_PLUGIN_OPTIONS` and must not re-apply defaults.
+ */
+export interface ResolvedMcpPluginOptions extends McpPluginOptions {
+    toolExposure: NonNullable<McpPluginOptions['toolExposure']>;
+    shopAccess: NonNullable<McpPluginOptions['shopAccess']>;
+    oauth?: McpOauthOptionsWithDefaults;
+    rateLimits: Required<McpRateLimitOptions>;
+    logging: McpLoggingOptions & {
+        ttlDays: number;
+        capture: NonNullable<McpLoggingOptions['capture']>;
+        maxBodyBytes: number;
+        captureClientIp: boolean;
+    };
+}

package/lib/internal-types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=internal-types.js.map

package/lib/internal-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-types.js","sourceRoot":"","sources":["../src/internal-types.ts"],"names":[],"mappings":""}

package/lib/logging/mcp-tool-call-log-retention.service.d.ts

@@ -0,0 +1,8 @@
+import { ID, RequestContext, TransactionalConnection } from '@vendure/core';
+import { ResolvedMcpPluginOptions } from '../internal-types';
+export declare class McpToolCallLogRetentionService {
+    private readonly connection;
+    private readonly options;
+    constructor(connection: TransactionalConnection, options: ResolvedMcpPluginOptions);
+    deleteExpiredToolCallLogs(ctx: RequestContext, channelId?: ID | null): Promise<number>;
+}