@vendure/mcp-plugin 3.8.0-minor-bootstrap.0

package/lib/logging/mcp-tool-call-log-retention.service.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolCallLogRetentionService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const constants_1 = require("../constants");
+const delete_in_batches_1 = require("../delete-in-batches");
+const mcp_tool_call_log_entity_1 = require("../entities/mcp-tool-call-log.entity");
+// Deletes in batches so a large table is never locked by one statement.
+let McpToolCallLogRetentionService = class McpToolCallLogRetentionService {
+    constructor(connection, options) {
+        this.connection = connection;
+        this.options = options;
+    }
+    async deleteExpiredToolCallLogs(ctx, channelId) {
+        const ttlDays = this.options.logging.ttlDays;
+        if (ttlDays === 0) {
+            return 0;
+        }
+        const cutoff = new Date(Date.now() - ttlDays * constants_1.MS_PER_DAY);
+        return (0, delete_in_batches_1.deleteInBatches)(this.connection, ctx, mcp_tool_call_log_entity_1.McpToolCallLog, () => {
+            const query = this.connection
+                .getRepository(ctx, mcp_tool_call_log_entity_1.McpToolCallLog)
+                .createQueryBuilder('log')
+                .select('log.id', 'id')
+                .where('log.createdAt < :cutoff', { cutoff })
+                .limit(constants_1.RETENTION_DELETE_BATCH_SIZE);
+            if (channelId != null) {
+                // A channel only ever prunes its own rows, matching what it can see in the dashboard log list.
+                query.andWhere('log.channelId = :channelId', { channelId });
+            }
+            return query.getRawMany();
+        });
+    }
+};
+exports.McpToolCallLogRetentionService = McpToolCallLogRetentionService;
+exports.McpToolCallLogRetentionService = McpToolCallLogRetentionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection, Object])
+], McpToolCallLogRetentionService);
+//# sourceMappingURL=mcp-tool-call-log-retention.service.js.map

package/lib/logging/mcp-tool-call-log-retention.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tool-call-log-retention.service.js","sourceRoot":"","sources":["../../src/logging/mcp-tool-call-log-retention.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAA4E;AAE5E,4CAA2F;AAC3F,4DAAuD;AACvD,mFAAsE;AAGtE,wEAAwE;AAEjE,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IACvC,YACqB,UAAmC,EACP,OAAiC;QAD7D,eAAU,GAAV,UAAU,CAAyB;QACP,YAAO,GAAP,OAAO,CAA0B;IAC/E,CAAC;IAEJ,KAAK,CAAC,yBAAyB,CAAC,GAAmB,EAAE,SAAqB;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAC7C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,sBAAU,CAAC,CAAC;QAC3D,OAAO,IAAA,mCAAe,EAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,yCAAc,EAAE,GAAG,EAAE;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU;iBACxB,aAAa,CAAC,GAAG,EAAE,yCAAc,CAAC;iBAClC,kBAAkB,CAAC,KAAK,CAAC;iBACzB,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;iBACtB,KAAK,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,CAAC;iBAC5C,KAAK,CAAC,uCAA2B,CAAC,CAAC;YACxC,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;gBACpB,+FAA+F;gBAC/F,KAAK,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,KAAK,CAAC,UAAU,EAAc,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AA1BY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;IAIJ,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;qCADE,8BAAuB;GAF/C,8BAA8B,CA0B1C"}

package/lib/logging/mcp-tool-call-log.service.d.ts

@@ -0,0 +1,24 @@
+import { EventBus, TransactionalConnection } from '@vendure/core';
+import { McpExecutionContext, ResolvedMcpPluginOptions } from '../internal-types';
+import { McpRegisteredTool } from '../registry/registry-types';
+import { McpToolCallStatus } from '../types';
+export interface LogToolCallInput {
+    executionContext: McpExecutionContext;
+    tool: McpRegisteredTool;
+    input: unknown;
+    output: unknown;
+    durationMs: number;
+    status: McpToolCallStatus;
+}
+export declare class McpToolCallLogService {
+    private readonly connection;
+    private readonly eventBus;
+    private readonly options;
+    constructor(connection: TransactionalConnection, eventBus: EventBus, options: ResolvedMcpPluginOptions);
+    logToolCall(call: LogToolCallInput): Promise<void>;
+    private resolveActor;
+    private resolveActorType;
+    /** Both `input` and `output` come back null in `metadata` capture mode, or if the operator's redact function throws. */
+    private captureBodies;
+    private capBody;
+}

package/lib/logging/mcp-tool-call-log.service.js

@@ -0,0 +1,128 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpToolCallLogService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const constants_1 = require("../constants");
+const mcp_tool_call_log_entity_1 = require("../entities/mcp-tool-call-log.entity");
+const mcp_tool_call_event_1 = require("../events/mcp-tool-call.event");
+let McpToolCallLogService = class McpToolCallLogService {
+    constructor(connection, eventBus, options) {
+        this.connection = connection;
+        this.eventBus = eventBus;
+        this.options = options;
+    }
+    async logToolCall(call) {
+        var _a, _b, _c, _d;
+        const { ctx, grant, clientIp } = call.executionContext;
+        let saved = false;
+        try {
+            const log = new mcp_tool_call_log_entity_1.McpToolCallLog({
+                grantId: (_a = grant === null || grant === void 0 ? void 0 : grant.id) !== null && _a !== void 0 ? _a : null,
+                actor: this.resolveActor(grant, ctx),
+                actorType: this.resolveActorType(grant, ctx),
+                channelId: grant ? ((_b = grant.channelId) !== null && _b !== void 0 ? _b : null) : ((_c = ctx.channelId) !== null && _c !== void 0 ? _c : null),
+                clientIp: this.options.logging.captureClientIp ? (clientIp !== null && clientIp !== void 0 ? clientIp : null) : null,
+                toolName: call.tool.name,
+                pluginSource: call.tool.pluginSource,
+                durationMs: call.durationMs,
+                status: call.status,
+                oauthClientId: (_d = grant === null || grant === void 0 ? void 0 : grant.oauthClientId) !== null && _d !== void 0 ? _d : null,
+            });
+            const bodies = this.captureBodies(call);
+            log.input = bodies.input;
+            log.output = bodies.output;
+            await this.connection.getRepository(ctx, mcp_tool_call_log_entity_1.McpToolCallLog).save(log);
+            saved = true;
+            await this.eventBus.publish(new mcp_tool_call_event_1.McpToolCallEvent(ctx, log));
+        }
+        catch (e) {
+            const reason = e instanceof Error ? e.message : String(e);
+            if (saved) {
+                core_1.Logger.warn(`Recorded MCP tool call "${call.tool.name}" but publishing its McpToolCallEvent failed: ${reason}`, constants_1.loggerCtx);
+            }
+            else {
+                core_1.Logger.warn(`Failed to record MCP tool call "${call.tool.name}": ${reason}`, constants_1.loggerCtx);
+            }
+        }
+    }
+    resolveActor(grant, ctx) {
+        if ((grant === null || grant === void 0 ? void 0 : grant.actorId) != null) {
+            return String(grant.actorId);
+        }
+        if (ctx.activeUserId != null) {
+            return String(ctx.activeUserId);
+        }
+        return null;
+    }
+    resolveActorType(grant, ctx) {
+        if ((grant === null || grant === void 0 ? void 0 : grant.actorType) != null) {
+            return grant.actorType;
+        }
+        if (ctx.apiType === 'admin') {
+            return 'admin';
+        }
+        if (ctx.activeUserId != null) {
+            return 'customer';
+        }
+        return 'anonymous';
+    }
+    /** Both `input` and `output` come back null in `metadata` capture mode, or if the operator's redact function throws. */
+    captureBodies(call) {
+        const logging = this.options.logging;
+        if (logging.capture !== 'full') {
+            return { input: null, output: null };
+        }
+        let bodies;
+        if (logging.redact) {
+            try {
+                bodies = logging.redact({
+                    toolName: call.tool.name,
+                    input: call.input,
+                    output: call.output,
+                });
+            }
+            catch (redactError) {
+                const reason = redactError instanceof Error ? redactError.message : String(redactError);
+                core_1.Logger.warn(`The configured logging.redact function threw while redacting tool call ` +
+                    `"${call.tool.name}": ${reason}. ` +
+                    `The call was recorded without its input/output bodies.`, constants_1.loggerCtx);
+            }
+        }
+        else {
+            bodies = { input: call.input, output: call.output };
+        }
+        return { input: this.capBody(bodies === null || bodies === void 0 ? void 0 : bodies.input), output: this.capBody(bodies === null || bodies === void 0 ? void 0 : bodies.output) };
+    }
+    capBody(value) {
+        if (value == null) {
+            return null;
+        }
+        const maxBodyBytes = this.options.logging.maxBodyBytes;
+        const bytes = Buffer.byteLength(JSON.stringify(value), 'utf8');
+        if (bytes > maxBodyBytes) {
+            return { omitted: `body exceeded logging.maxBodyBytes (${maxBodyBytes} bytes)`, bytes };
+        }
+        return value;
+    }
+};
+exports.McpToolCallLogService = McpToolCallLogService;
+exports.McpToolCallLogService = McpToolCallLogService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection,
+        core_1.EventBus, Object])
+], McpToolCallLogService);
+//# sourceMappingURL=mcp-tool-call-log.service.js.map

package/lib/logging/mcp-tool-call-log.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-tool-call-log.service.js","sourceRoot":"","sources":["../../src/logging/mcp-tool-call-log.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAA0F;AAE1F,4CAA6D;AAE7D,mFAAsE;AACtE,uEAAiE;AAe1D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAC9B,YACqB,UAAmC,EACnC,QAAkB,EACU,OAAiC;QAF7D,eAAU,GAAV,UAAU,CAAyB;QACnC,aAAQ,GAAR,QAAQ,CAAU;QACU,YAAO,GAAP,OAAO,CAA0B;IAC/E,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,IAAsB;;QACpC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACvD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,yCAAc,CAAC;gBAC3B,OAAO,EAAE,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,EAAE,mCAAI,IAAI;gBAC1B,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC;gBACpC,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC;gBAC5C,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAA,KAAK,CAAC,SAAS,mCAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,IAAI,CAAC;gBACtE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC1E,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACxB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;gBACpC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,aAAa,mCAAI,IAAI;aAC9C,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACxC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACzB,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,yCAAc,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,sCAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACR,aAAM,CAAC,IAAI,CACP,2BAA2B,IAAI,CAAC,IAAI,CAAC,IAAI,iDAAiD,MAAM,EAAE,EAClG,qBAAS,CACZ,CAAC;YACN,CAAC;iBAAM,CAAC;gBACJ,aAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM,EAAE,EAAE,qBAAS,CAAC,CAAC;YAC5F,CAAC;QACL,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,KAAgC,EAAE,GAAmB;QACtE,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,KAAI,IAAI,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,KAAgC,EAAE,GAAmB;QAC1E,IAAI,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,SAAS,KAAI,IAAI,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,SAAS,CAAC;QAC3B,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC3B,OAAO,UAAU,CAAC;QACtB,CAAC;QACD,OAAO,WAAW,CAAC;IACvB,CAAC;IAED,wHAAwH;IAChH,aAAa,CAAC,IAAsB;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,MAAuD,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC;gBACD,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACtB,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACnB,MAAM,MAAM,GAAG,WAAW,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACxF,aAAM,CAAC,IAAI,CACP,yEAAyE;oBACrE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,MAAM,IAAI;oBAClC,wDAAwD,EAC5D,qBAAS,CACZ,CAAC;YACN,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAC,EAAE,CAAC;IACxF,CAAC;IAEO,OAAO,CAAC,KAAc;QAC1B,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,KAAK,GAAG,YAAY,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,uCAAuC,YAAY,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AAzGY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKJ,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;qCAFE,8BAAuB;QACzB,eAAQ;GAH9B,qBAAqB,CAyGjC"}

package/lib/oauth/cimd/cimd-client-resolver.service.d.ts

@@ -0,0 +1,18 @@
+import { RequestContext, TransactionalConnection } from '@vendure/core';
+import { McpOauthClient } from '../../entities/mcp-oauth-client.entity';
+import { ResolvedMcpPluginOptions } from '../../internal-types';
+/** Caches CIMD documents as client rows so they aren't refetched on every request; invalid documents are never cached. */
+export declare class McpCimdClientResolverService {
+    private readonly connection;
+    private readonly options;
+    /** Avoids firing off duplicate fetches when several requests for the same client_id arrive at once. */
+    private readonly inFlight;
+    constructor(connection: TransactionalConnection, options: ResolvedMcpPluginOptions);
+    private get allowLoopback();
+    resolveClient(ctx: RequestContext, clientId: string): Promise<McpOauthClient>;
+    /** Fetches and validates the document, sharing one request with any concurrent caller. */
+    private resolveDocument;
+    private storeDocument;
+    private findClientRow;
+    private isFresh;
+}

package/lib/oauth/cimd/cimd-client-resolver.service.js

@@ -0,0 +1,109 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpCimdClientResolverService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@vendure/core");
+const constants_1 = require("../../constants");
+const mcp_oauth_client_entity_1 = require("../../entities/mcp-oauth-client.entity");
+const oauth_utils_1 = require("../oauth-utils");
+const cimd_document_1 = require("./cimd-document");
+const cimd_fetch_1 = require("./cimd-fetch");
+const cimd_url_1 = require("./cimd-url");
+/** Caches CIMD documents as client rows so they aren't refetched on every request; invalid documents are never cached. */
+let McpCimdClientResolverService = class McpCimdClientResolverService {
+    constructor(connection, options) {
+        this.connection = connection;
+        this.options = options;
+        /** Avoids firing off duplicate fetches when several requests for the same client_id arrive at once. */
+        this.inFlight = new Map();
+    }
+    // Documents on the local machine are a development-only convenience (draft §8.6), so the
+    // operator has to ask for them; `McpPlugin` refuses to start with them on in production.
+    get allowLoopback() {
+        var _a;
+        return ((_a = this.options.oauth) === null || _a === void 0 ? void 0 : _a.allowLoopbackCimdDocuments) === true;
+    }
+    async resolveClient(ctx, clientId) {
+        const url = (0, cimd_url_1.validateCimdClientIdUrl)(clientId, { allowLoopback: this.allowLoopback });
+        const cached = await this.findClientRow(ctx, clientId);
+        if (cached && this.isFresh(cached)) {
+            return cached;
+        }
+        const document = await this.resolveDocument(clientId, url);
+        return this.storeDocument(ctx, clientId, document);
+    }
+    /** Fetches and validates the document, sharing one request with any concurrent caller. */
+    resolveDocument(clientId, url) {
+        const running = this.inFlight.get(clientId);
+        if (running) {
+            return running;
+        }
+        const task = (0, cimd_fetch_1.fetchCimdDocument)(url, {
+            timeoutMs: constants_1.CIMD_FETCH_TIMEOUT_MS,
+            maxBytes: constants_1.CIMD_MAX_DOCUMENT_BYTES,
+            allowLoopback: this.allowLoopback,
+        })
+            .then(body => (0, cimd_document_1.parseCimdDocument)(clientId, body))
+            .finally(() => {
+            this.inFlight.delete(clientId);
+        });
+        this.inFlight.set(clientId, task);
+        return task;
+    }
+    async storeDocument(ctx, clientId, document) {
+        const repository = this.connection.getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient);
+        let client = await this.findClientRow(ctx, clientId);
+        if (!client) {
+            client = new mcp_oauth_client_entity_1.McpOauthClient();
+            client.clientId = clientId;
+            client.lastUsedAt = null;
+        }
+        client.clientName = document.clientName;
+        client.clientUri = document.clientUri;
+        client.logoUri = document.logoUri;
+        client.redirectUris = document.redirectUris;
+        client.grantTypes = document.grantTypes;
+        client.tokenEndpointAuthMethod = document.tokenEndpointAuthMethod;
+        client.cimdDocumentExpiresAt = (0, oauth_utils_1.addSeconds)(new Date(), constants_1.CIMD_CACHE_TTL_SECONDS);
+        try {
+            return await repository.save(client);
+        }
+        catch (error) {
+            // If two servers race to create the same client row, use whichever one won rather than
+            // failing; other errors must still surface, since the existing row could be stale.
+            const winner = await this.findClientRow(ctx, clientId);
+            if (winner && this.isFresh(winner)) {
+                return winner;
+            }
+            throw error;
+        }
+    }
+    async findClientRow(ctx, clientId) {
+        const row = await this.connection.getRepository(ctx, mcp_oauth_client_entity_1.McpOauthClient).findOne({ where: { clientId } });
+        // SQL equality follows the column collation (MySQL's default ignores case and trailing
+        // spaces), so the row is used only when its stored id is exactly the one asked for.
+        return (row === null || row === void 0 ? void 0 : row.clientId) === clientId ? row : undefined;
+    }
+    isFresh(client) {
+        return client.cimdDocumentExpiresAt != null && client.cimdDocumentExpiresAt > new Date();
+    }
+};
+exports.McpCimdClientResolverService = McpCimdClientResolverService;
+exports.McpCimdClientResolverService = McpCimdClientResolverService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(constants_1.MCP_PLUGIN_OPTIONS)),
+    __metadata("design:paramtypes", [core_1.TransactionalConnection, Object])
+], McpCimdClientResolverService);
+//# sourceMappingURL=cimd-client-resolver.service.js.map

package/lib/oauth/cimd/cimd-client-resolver.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-client-resolver.service.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-client-resolver.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAAwE;AAExE,+CAKyB;AACzB,oFAAwE;AAExE,gDAA4C;AAE5C,mDAAkE;AAClE,6CAAiD;AACjD,yCAAqD;AAErD,0HAA0H;AAEnH,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAIrC,YACqB,UAAmC,EACxB,OAAkD;QAD7D,eAAU,GAAV,UAAU,CAAyB;QACP,YAAO,GAAP,OAAO,CAA0B;QALlF,uGAAuG;QACtF,aAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;IAKlE,CAAC;IAEJ,yFAAyF;IACzF,yFAAyF;IACzF,IAAY,aAAa;;QACrB,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,KAAK,0CAAE,0BAA0B,MAAK,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAmB,EAAE,QAAgB;QACrD,MAAM,GAAG,GAAG,IAAA,kCAAuB,EAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,0FAA0F;IAClF,eAAe,CAAC,QAAgB,EAAE,GAAQ;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,8BAAiB,EAAC,GAAG,EAAE;YAChC,SAAS,EAAE,iCAAqB;YAChC,QAAQ,EAAE,mCAAuB;YACjC,aAAa,EAAE,IAAI,CAAC,aAAa;SACpC,CAAC;aACG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAA,iCAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;aAC/C,OAAO,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CACvB,GAAmB,EACnB,QAAgB,EAChB,QAAsB;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,wCAAc,CAAC,CAAC;QACtE,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,GAAG,IAAI,wCAAc,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC3B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACxC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACtC,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAClC,MAAM,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;QAC5C,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACxC,MAAM,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;QAClE,MAAM,CAAC,qBAAqB,GAAG,IAAA,wBAAU,EAAC,IAAI,IAAI,EAAE,EAAE,kCAAsB,CAAC,CAAC;QAC9E,IAAI,CAAC;YACD,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,uFAAuF;YACvF,mFAAmF;YACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,OAAO,MAAM,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAmB,EAAE,QAAgB;QAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,wCAAc,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtG,uFAAuF;QACvF,oFAAoF;QACpF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,QAAQ,MAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAEO,OAAO,CAAC,MAAsB;QAClC,OAAO,MAAM,CAAC,qBAAqB,IAAI,IAAI,IAAI,MAAM,CAAC,qBAAqB,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7F,CAAC;CACJ,CAAA;AAtFY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;IAOJ,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;qCADE,8BAAuB;GAL/C,4BAA4B,CAsFxC"}

package/lib/oauth/cimd/cimd-document.d.ts

@@ -0,0 +1,11 @@
+/** The subset of a fetched CIMD document that this authorization server stores. */
+export interface CimdDocument {
+    clientId: string;
+    clientName: string;
+    redirectUris: string[];
+    clientUri: string | null;
+    logoUri: string | null;
+    grantTypes: string[];
+    tokenEndpointAuthMethod: 'none';
+}
+export declare function parseCimdDocument(clientId: string, rawBody: string): CimdDocument;

package/lib/oauth/cimd/cimd-document.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCimdDocument = parseCimdDocument;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../../constants");
+const oauth_utils_1 = require("../oauth-utils");
+function parseCimdDocument(clientId, rawBody) {
+    var _a;
+    let parsed;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch (_b) {
+        throw new common_1.BadRequestException('client_id metadata document is not valid JSON');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new common_1.BadRequestException('client_id metadata document must be a JSON object');
+    }
+    const document = parsed;
+    if (document.client_id !== clientId) {
+        throw new common_1.BadRequestException('client_id metadata document client_id must exactly match the client_id URL');
+    }
+    if (typeof document.client_name !== 'string' || document.client_name.length === 0) {
+        throw new common_1.BadRequestException('client_id metadata document must include client_name');
+    }
+    if (document.client_name.length > constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH) {
+        throw new common_1.BadRequestException(`client_id metadata document client_name must be at most ${constants_1.MAX_CLIENT_METADATA_FIELD_LENGTH} characters`);
+    }
+    const redirectUris = document.redirect_uris;
+    if (!Array.isArray(redirectUris) ||
+        redirectUris.length === 0 ||
+        !redirectUris.every(uri => typeof uri === 'string')) {
+        throw new common_1.BadRequestException('client_id metadata document must include redirect_uris');
+    }
+    for (const uri of redirectUris) {
+        (0, oauth_utils_1.assertSafeRedirectUri)(uri);
+    }
+    if ('client_secret' in document || 'client_secret_expires_at' in document) {
+        throw new common_1.BadRequestException('client_id metadata document must not contain a client secret');
+    }
+    const declaredMethod = (_a = document.token_endpoint_auth_method) !== null && _a !== void 0 ? _a : 'none';
+    const supportedMethods = Array.isArray(document.token_endpoint_auth_methods_supported)
+        ? document.token_endpoint_auth_methods_supported
+        : [];
+    if (declaredMethod !== 'none' && !supportedMethods.includes('none')) {
+        throw new common_1.BadRequestException('client_id metadata document must support token_endpoint_auth_method "none"');
+    }
+    // A document may list grant types meant for other servers too, so only keep the ones we support.
+    const declaredGrantTypes = Array.isArray(document.grant_types)
+        ? document.grant_types.filter((grant) => typeof grant === 'string')
+        : constants_1.SUPPORTED_OAUTH_GRANT_TYPES;
+    const grantTypes = declaredGrantTypes.filter(grant => constants_1.SUPPORTED_OAUTH_GRANT_TYPES.includes(grant));
+    if (!grantTypes.includes('authorization_code')) {
+        throw new common_1.BadRequestException('client_id metadata document must allow the authorization_code grant');
+    }
+    return {
+        clientId,
+        clientName: document.client_name,
+        redirectUris,
+        clientUri: (0, oauth_utils_1.httpsUrlOrNull)(document.client_uri),
+        logoUri: (0, oauth_utils_1.httpsUrlOrNull)(document.logo_uri),
+        grantTypes,
+        tokenEndpointAuthMethod: 'none',
+    };
+}
+//# sourceMappingURL=cimd-document.js.map

package/lib/oauth/cimd/cimd-document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd-document.js","sourceRoot":"","sources":["../../../src/oauth/cimd/cimd-document.ts"],"names":[],"mappings":";;AAgBA,8CAgEC;AAhFD,2CAAqD;AAErD,+CAAgG;AAChG,gDAAuE;AAavE,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,OAAe;;IAC/D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,WAAM,CAAC;QACL,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,4BAAmB,CAAC,mDAAmD,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,4BAAmB,CACzB,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,4BAAmB,CAAC,sDAAsD,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,4CAAgC,EAAE,CAAC;QACjE,MAAM,IAAI,4BAAmB,CACzB,2DAA2D,4CAAgC,aAAa,CAC3G,CAAC;IACN,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,aAAa,CAAC;IAC5C,IACI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QAC5B,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EACrD,CAAC;QACC,MAAM,IAAI,4BAAmB,CAAC,wDAAwD,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAA,mCAAqB,EAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,eAAe,IAAI,QAAQ,IAAI,0BAA0B,IAAI,QAAQ,EAAE,CAAC;QACxE,MAAM,IAAI,4BAAmB,CAAC,8DAA8D,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,cAAc,GAAG,MAAA,QAAQ,CAAC,0BAA0B,mCAAI,MAAM,CAAC;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QAClF,CAAC,CAAC,QAAQ,CAAC,qCAAqC;QAChD,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,cAAc,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,4BAAmB,CACzB,4EAA4E,CAC/E,CAAC;IACN,CAAC;IACD,iGAAiG;IACjG,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1D,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACpF,CAAC,CAAC,uCAA2B,CAAC;IAClC,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,uCAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,4BAAmB,CAAC,qEAAqE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACH,QAAQ;QACR,UAAU,EAAE,QAAQ,CAAC,WAAW;QAChC,YAAY;QACZ,SAAS,EAAE,IAAA,4BAAc,EAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,OAAO,EAAE,IAAA,4BAAc,EAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1C,UAAU;QACV,uBAAuB,EAAE,MAAM;KAClC,CAAC;AACN,CAAC"}

package/lib/oauth/cimd/cimd-fetch.d.ts

@@ -0,0 +1,14 @@
+import * as dns from 'node:dns';
+export interface CimdFetchOptions {
+    /** Whole-request deadline — connection plus body — in milliseconds. */
+    timeoutMs: number;
+    /** Hard cap on the response body size, in bytes. */
+    maxBytes: number;
+    /** Permit loopback destinations. Development only (draft §8.6). */
+    allowLoopback: boolean;
+    /** DNS lookup used by the socket; injectable for tests. */
+    lookup?: typeof dns.lookup;
+}
+/** True when a resolved address may be dialed. Loopback is only allowed in development. */
+export declare function isAllowedCimdAddress(address: string, family: number, allowLoopback: boolean): boolean;
+export declare function fetchCimdDocument(url: URL, options: CimdFetchOptions): Promise<string>;