@vfarcic/dot-ai 1.14.1 → 1.15.1

package/dist/core/circuit-breaker.d.ts

@@ -80,6 +80,10 @@ export declare class CircuitBreaker {
     private openedAt?;
     private halfOpenAttempts;
     private lastCircuitOpenLogTime?;
+    private lastFailureLogTime?;
+    private suppressedFailureLogCount;
+    /** Minimum interval between failure WARN logs (ms) */
+    private static readonly FAILURE_LOG_INTERVAL_MS;
     constructor(name: string, config?: CircuitBreakerConfig, logger?: Logger);
     /**
      * Execute an operation through the circuit breaker

package/dist/core/circuit-breaker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/core/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAEzD;;GAEG;AACH,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,mBAAmB,EAAE,MAAM,CAAC;IAC5C,SAAgB,KAAK,EAAE,YAAY,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM;CAO7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsG;IAC7H,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,mBAAmB,CAAa;IACxC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAO;IACxB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,sBAAsB,CAAC,CAAO;gBAE1B,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAWxE;;;;OAIG;IACG,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqCzD;;OAEG;IACH,aAAa,IAAI,IAAI;IAerB;;OAEG;IACH,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAyBlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAcb;;OAEG;IACH,QAAQ,IAAI,YAAY;IAWxB;;OAEG;IACH,QAAQ,IAAI,mBAAmB;IAa/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IASlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,YAAY;CAKrB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,aAAa,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAKjE;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc;IAexE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;OAEG;IACH,QAAQ,IAAI,IAAI;IAMhB;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;CAOnD"}
+{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/core/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAEzD;;GAEG;AACH,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,mBAAmB,EAAE,MAAM,CAAC;IAC5C,SAAgB,KAAK,EAAE,YAAY,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM;CAS7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAGuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,mBAAmB,CAAa;IACxC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAO;IACxB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,sBAAsB,CAAC,CAAO;IACtC,OAAO,CAAC,kBAAkB,CAAC,CAAO;IAClC,OAAO,CAAC,yBAAyB,CAAa;IAC9C,sDAAsD;IACtD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAS;gBAE5C,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAWxE;;;;OAIG;IACG,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA0CzD;;OAEG;IACH,aAAa,IAAI,IAAI;IAkBrB;;OAEG;IACH,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAiDlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAoBb;;OAEG;IACH,QAAQ,IAAI,YAAY;IAaxB;;OAEG;IACH,QAAQ,IAAI,mBAAmB;IAa/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IASlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,YAAY;CAKrB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,aAAa,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAKjE;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc;IAexE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;OAEG;IACH,QAAQ,IAAI,IAAI;IAMhB;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;CAOnD"}

package/dist/core/circuit-breaker.js

@@ -65,13 +65,17 @@ class CircuitBreaker {
     openedAt;
     halfOpenAttempts = 0;
     lastCircuitOpenLogTime;
+    lastFailureLogTime;
+    suppressedFailureLogCount = 0;
+    /** Minimum interval between failure WARN logs (ms) */
+    static FAILURE_LOG_INTERVAL_MS = 30000;
     constructor(name, config, logger) {
         this.name = name;
         this.config = {
             failureThreshold: config?.failureThreshold ?? 3,
             cooldownPeriodMs: config?.cooldownPeriodMs ?? 30000,
             halfOpenMaxAttempts: config?.halfOpenMaxAttempts ?? 1,
-            onStateChange: config?.onStateChange
+            onStateChange: config?.onStateChange,
         };
         this.logger = logger ?? new error_handling_1.ConsoleLogger('CircuitBreaker');
     }
@@ -89,7 +93,7 @@ class CircuitBreaker {
                 this.lastCircuitOpenLogTime < this.openedAt) {
                 this.logger.warn(`Circuit '${this.name}' is open, blocking requests`, {
                     remainingCooldownMs: remainingCooldown,
-                    willRetryAt: new Date(Date.now() + remainingCooldown).toISOString()
+                    willRetryAt: new Date(Date.now() + remainingCooldown).toISOString(),
                 });
                 this.lastCircuitOpenLogTime = new Date();
             }
@@ -100,7 +104,7 @@ class CircuitBreaker {
             this.halfOpenAttempts++;
             this.logger.info(`Circuit '${this.name}' attempting request in half-open state`, {
                 attempt: this.halfOpenAttempts,
-                maxAttempts: this.config.halfOpenMaxAttempts
+                maxAttempts: this.config.halfOpenMaxAttempts,
             });
         }
         try {
@@ -125,7 +129,7 @@ class CircuitBreaker {
             this.transitionTo(CircuitState.CLOSED);
             this.halfOpenAttempts = 0;
             this.logger.info(`Circuit '${this.name}' recovered, transitioning to closed`, {
-                totalSuccesses: this.totalSuccesses
+                totalSuccesses: this.totalSuccesses,
             });
         }
     }
@@ -136,11 +140,27 @@ class CircuitBreaker {
         this.consecutiveFailures++;
         this.totalFailures++;
         this.lastFailureTime = new Date();
-        this.logger.warn(`Circuit '${this.name}' recorded failure`, {
-            consecutiveFailures: this.consecutiveFailures,
-            threshold: this.config.failureThreshold,
-            error: error?.message
-        });
+        // Rate-limit failure WARN logs to avoid log spam during sustained outages
+        const now = Date.now();
+        const shouldLogFailure = !this.lastFailureLogTime ||
+            now - this.lastFailureLogTime.getTime() >=
+                CircuitBreaker.FAILURE_LOG_INTERVAL_MS;
+        if (shouldLogFailure) {
+            const logData = {
+                consecutiveFailures: this.consecutiveFailures,
+                threshold: this.config.failureThreshold,
+                error: error?.message,
+            };
+            if (this.suppressedFailureLogCount > 0) {
+                logData.suppressedLogCount = this.suppressedFailureLogCount;
+            }
+            this.logger.warn(`Circuit '${this.name}' recorded failure`, logData);
+            this.lastFailureLogTime = new Date(now);
+            this.suppressedFailureLogCount = 0;
+        }
+        else {
+            this.suppressedFailureLogCount++;
+        }
         if (this.state === CircuitState.HALF_OPEN) {
             // Failure in half-open state opens the circuit again
             this.transitionTo(CircuitState.OPEN);
@@ -148,7 +168,8 @@ class CircuitBreaker {
             this.halfOpenAttempts = 0;
             this.logger.warn(`Circuit '${this.name}' failed in half-open state, reopening`);
         }
-        else if (this.state === CircuitState.CLOSED && this.consecutiveFailures >= this.config.failureThreshold) {
+        else if (this.state === CircuitState.CLOSED &&
+            this.consecutiveFailures >= this.config.failureThreshold) {
             // Threshold reached, open the circuit
             this.transitionTo(CircuitState.OPEN);
             this.openedAt = new Date();
@@ -165,6 +186,8 @@ class CircuitBreaker {
         this.halfOpenAttempts = 0;
         this.openedAt = undefined;
         this.lastCircuitOpenLogTime = undefined;
+        this.lastFailureLogTime = undefined;
+        this.suppressedFailureLogCount = 0;
         if (previousState !== CircuitState.CLOSED) {
             this.logger.info(`Circuit '${this.name}' manually reset to closed`);
             this.config.onStateChange?.(previousState, CircuitState.CLOSED, this.name);
@@ -194,7 +217,7 @@ class CircuitBreaker {
             lastFailureTime: this.lastFailureTime,
             lastSuccessTime: this.lastSuccessTime,
             openedAt: this.openedAt,
-            halfOpenAttempts: this.halfOpenAttempts
+            halfOpenAttempts: this.halfOpenAttempts,
         };
     }
     /**

package/dist/core/embedding-service.d.ts

@@ -50,6 +50,9 @@ export declare class VercelEmbeddingProvider implements EmbeddingProvider {
  */
 export declare class EmbeddingService {
     private provider;
+    private lastBatchFailureLogTime?;
+    private suppressedBatchFailureCount;
+    private static readonly BATCH_FAILURE_LOG_INTERVAL_MS;
     constructor(config?: EmbeddingConfig);
     /**
      * Generate embedding for text

package/dist/core/embedding-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedding-service.d.ts","sourceRoot":"","sources":["../../src/core/embedding-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAc3B;;GAEG;AACH,eAAO,MAAM,mBAAmB,iDAItB,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC;IACvB,aAAa,IAAI,MAAM,CAAC;IACxB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAgBD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,aAAa,CAA6B;gBAEtC,MAAM,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,qBAAqB,CAAA;KAAE;IAmFnE,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgElD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA2E9D,WAAW,IAAI,OAAO;IAItB,aAAa,IAAI,MAAM;IAIvB,QAAQ,IAAI,MAAM;IAIlB,eAAe,IAAI,MAAM;CAG1B;AAqCD;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAA2B;gBAE/B,MAAM,GAAE,eAAoB;IAKxC;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBxD;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAiB9D;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAqCD;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,MAAM;IAYV;;;OAGG;IACH,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;CAGrD"}
+{"version":3,"file":"embedding-service.d.ts","sourceRoot":"","sources":["../../src/core/embedding-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,EAEL,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAc3B;;GAEG;AACH,eAAO,MAAM,mBAAmB,iDAItB,CAAC;AACX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC;IACvB,aAAa,IAAI,MAAM,CAAC;IACxB,QAAQ,IAAI,MAAM,CAAC;CACpB;AAgBD;;;GAGG;AACH,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,aAAa,CAA6B;gBAEtC,MAAM,EAAE,eAAe,GAAG;QAAE,QAAQ,EAAE,qBAAqB,CAAA;KAAE;IAmFnE,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgElD,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA2E9D,WAAW,IAAI,OAAO;IAItB,aAAa,IAAI,MAAM;IAIvB,QAAQ,IAAI,MAAM;IAIlB,eAAe,IAAI,MAAM;CAG1B;AAqCD;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,uBAAuB,CAAC,CAAS;IACzC,OAAO,CAAC,2BAA2B,CAAa;IAChD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAS;gBAElD,MAAM,GAAE,eAAoB;IAKxC;;;OAGG;IACG,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgBxD;;;OAGG;IACG,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IA8B9D;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,aAAa,IAAI,MAAM;IAIvB;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB;IAqCD;;OAEG;IACH,uBAAuB,CAAC,OAAO,EAAE;QAC/B,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,MAAM;IAYV;;;OAGG;IACH,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;CAGrD"}

package/dist/core/embedding-service.js

@@ -272,6 +272,9 @@ function createEmbeddingProvider(config = {}) {
  */
 class EmbeddingService {
     provider;
+    lastBatchFailureLogTime;
+    suppressedBatchFailureCount = 0;
+    static BATCH_FAILURE_LOG_INTERVAL_MS = 30000;
     constructor(config = {}) {
         // Use factory to initialize appropriate provider
         this.provider = createEmbeddingProvider(config);
@@ -304,8 +307,19 @@ class EmbeddingService {
             return await this.provider.generateEmbeddings(texts);
         }
         catch (error) {
-            // Log error but don't throw - allow graceful fallback
-            console.warn('Batch embedding generation failed, falling back to keyword search:', error);
+            // Rate-limit fallback warnings to avoid log spam during sustained outages
+            const now = Date.now();
+            if (!this.lastBatchFailureLogTime ||
+                now - this.lastBatchFailureLogTime >=
+                    EmbeddingService.BATCH_FAILURE_LOG_INTERVAL_MS) {
+                const suppressed = this.suppressedBatchFailureCount;
+                this.suppressedBatchFailureCount = 0;
+                this.lastBatchFailureLogTime = now;
+                console.warn('Batch embedding generation failed, falling back to keyword search:', error instanceof Error ? error.message : String(error), suppressed > 0 ? `(${suppressed} similar warnings suppressed)` : '');
+            }
+            else {
+                this.suppressedBatchFailureCount++;
+            }
             return [];
         }
     }

package/dist/core/mcp-client-manager.d.ts

@@ -6,10 +6,47 @@
  * the attachTo routing mechanism.
  *
  * PRD #358: MCP Server Integration
+ * PRD #414: MCP Client Outbound Authentication
  */
-import { McpServerConfig, DiscoveredMcpServer, McpServerStats, McpAttachableOperation } from './mcp-client-types';
+import type { StreamableHTTPClientTransportOptions } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import type { OAuthClientProvider, OAuthDiscoveryState } from '@modelcontextprotocol/sdk/client/auth.js';
+import type { OAuthTokens, OAuthClientMetadata } from '@modelcontextprotocol/sdk/shared/auth.js';
+import { McpServerConfig, McpServerAuthConfig, DiscoveredMcpServer, McpServerStats, McpAttachableOperation } from './mcp-client-types';
 import { Logger } from './error-handling';
 import { AITool, ToolExecutor } from './ai-provider.interface';
+/**
+ * Minimal OAuthClientProvider that returns a static bearer token.
+ *
+ * Used when the MCP server expects MCP-spec-compliant auth (authProvider)
+ * but the token is a pre-provisioned service account JWT or API key
+ * rather than an interactive OAuth flow.
+ *
+ * PRD #414: MCP Client Outbound Authentication (M1)
+ */
+export declare class StaticTokenAuthProvider implements OAuthClientProvider {
+    private readonly token;
+    constructor(token: string);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): undefined;
+    tokens(): Promise<OAuthTokens>;
+    saveTokens(): Promise<void>;
+    redirectToAuthorization(): Promise<void>;
+    saveCodeVerifier(): Promise<void>;
+    codeVerifier(): Promise<string>;
+    invalidateCredentials(_scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): Promise<void>;
+    saveDiscoveryState(_state: OAuthDiscoveryState): Promise<void>;
+    discoveryState(): Promise<OAuthDiscoveryState | undefined>;
+}
+/**
+ * Resolve transport options (authProvider and/or requestInit) from auth config.
+ *
+ * Reads token/header values from environment variables (sourced from K8s Secrets).
+ * Returns partial options to merge into StreamableHTTPClientTransportOptions.
+ *
+ * PRD #414: MCP Client Outbound Authentication (M1 + M2 + M4)
+ */
+export declare function resolveTransportAuth(auth: McpServerAuthConfig | undefined, serverName: string, logger: Logger): Pick<StreamableHTTPClientTransportOptions, 'authProvider' | 'requestInit'>;
 /**
  * Manages MCP server connections, tool discovery, and tool routing.
  *

package/dist/core/mcp-client-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-client-manager.d.ts","sourceRoot":"","sources":["../../src/core/mcp-client-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,eAAe,EAEf,mBAAmB,EACnB,cAAc,EAEd,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAW/D;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyD;IAEpF,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+C;IAEjF,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;gBAEnD,MAAM,EAAE,MAAM;IAI1B;;;;;;OAMG;IACH,MAAM,CAAC,oBAAoB,IAAI,eAAe,EAAE;IA+DhD;;;;;OAKG;IACG,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCnE;;OAEG;YACW,kBAAkB;IAmGhC;;;;OAIG;IACH,oBAAoB,CAAC,SAAS,EAAE,sBAAsB,GAAG,MAAM,EAAE;IAoBjE;;OAEG;IACH,qBAAqB,IAAI,MAAM,EAAE;IAejC;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;;OAMG;IACH,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,YAAY,GAAG,YAAY;IA6DjE;;OAEG;IACH,QAAQ,IAAI,cAAc;IAQ1B;;OAEG;IACH,oBAAoB,IAAI,mBAAmB,EAAE;IAI7C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB5B;;OAEG;IACH,OAAO,CAAC,eAAe;CAYxB"}
+{"version":3,"file":"mcp-client-manager.d.ts","sourceRoot":"","sources":["../../src/core/mcp-client-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,oDAAoD,CAAC;AAC/G,OAAO,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAEzG,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACjG,OAAO,EACL,eAAe,EACf,mBAAmB,EAEnB,mBAAmB,EACnB,cAAc,EAEd,sBAAsB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAW/D;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,YAAW,mBAAmB;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAEnB,KAAK,EAAE,MAAM;IAIzB,IAAI,WAAW,IAAI,SAAS,CAAsB;IAElD,IAAI,cAAc,IAAI,mBAAmB,CAKxC;IAED,iBAAiB;IAEX,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC;IAO9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAC3B,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC;IACxC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAGjC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAE/B,qBAAqB,CAAC,MAAM,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpG,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IAC9D,cAAc,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EACrC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,IAAI,CAAC,oCAAoC,EAAE,cAAc,GAAG,aAAa,CAAC,CAsF5E;AAED;;;;;GAKG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAE1D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyD;IAEpF,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+C;IAEjF,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAkC;gBAEnD,MAAM,EAAE,MAAM;IAI1B;;;;;;OAMG;IACH,MAAM,CAAC,oBAAoB,IAAI,eAAe,EAAE;IAwIhD;;;;;OAKG;IACG,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAwCnE;;OAEG;YACW,kBAAkB;IAwGhC;;;;OAIG;IACH,oBAAoB,CAAC,SAAS,EAAE,sBAAsB,GAAG,MAAM,EAAE;IAoBjE;;OAEG;IACH,qBAAqB,IAAI,MAAM,EAAE;IAejC;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIpC;;;;;;OAMG;IACH,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,YAAY,GAAG,YAAY;IA6DjE;;OAEG;IACH,QAAQ,IAAI,cAAc;IAQ1B;;OAEG;IACH,oBAAoB,IAAI,mBAAmB,EAAE;IAI7C;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB5B;;OAEG;IACH,OAAO,CAAC,eAAe;CAYxB"}

package/dist/core/mcp-client-manager.js

@@ -7,12 +7,15 @@
  * the attachTo routing mechanism.
  *
  * PRD #358: MCP Server Integration
+ * PRD #414: MCP Client Outbound Authentication
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpClientManager = void 0;
+exports.McpClientManager = exports.StaticTokenAuthProvider = void 0;
+exports.resolveTransportAuth = resolveTransportAuth;
 const node_fs_1 = require("node:fs");
 const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const auth_extensions_js_1 = require("@modelcontextprotocol/sdk/client/auth-extensions.js");
 const mcp_client_types_1 = require("./mcp-client-types");
 /** Path for MCP servers config file (mounted from ConfigMap in K8s) */
 const MCP_SERVERS_CONFIG_PATH = '/etc/dot-ai-mcp/mcp-servers.json';
@@ -20,6 +23,135 @@ const MCP_SERVERS_CONFIG_PATH = '/etc/dot-ai-mcp/mcp-servers.json';
 const TOOL_NAME_SEPARATOR = '__';
 /** Default timeout for MCP requests in milliseconds */
 const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Minimal OAuthClientProvider that returns a static bearer token.
+ *
+ * Used when the MCP server expects MCP-spec-compliant auth (authProvider)
+ * but the token is a pre-provisioned service account JWT or API key
+ * rather than an interactive OAuth flow.
+ *
+ * PRD #414: MCP Client Outbound Authentication (M1)
+ */
+class StaticTokenAuthProvider {
+    token;
+    constructor(token) {
+        this.token = token;
+    }
+    get redirectUrl() { return undefined; }
+    get clientMetadata() {
+        return {
+            redirect_uris: [],
+            client_name: 'dot-ai',
+        };
+    }
+    clientInformation() { return undefined; }
+    async tokens() {
+        return {
+            access_token: this.token,
+            token_type: 'bearer',
+        };
+    }
+    async saveTokens() { }
+    async redirectToAuthorization() { }
+    async saveCodeVerifier() { }
+    // Returns empty string because the SDK type requires string (not undefined).
+    // Static tokens do not use PKCE, so the verifier is never meaningful.
+    async codeVerifier() { return ''; }
+    async invalidateCredentials(_scope) {
+        // No-op for all scopes: static tokens are pre-provisioned and cannot be refreshed.
+        // 'client'/'verifier' are for interactive OAuth (authorization_code + PKCE).
+        // 'tokens'/'discovery' have no effect since the token is fixed at construction.
+    }
+    async saveDiscoveryState(_state) { }
+    async discoveryState() { return undefined; }
+}
+exports.StaticTokenAuthProvider = StaticTokenAuthProvider;
+/**
+ * Resolve transport options (authProvider and/or requestInit) from auth config.
+ *
+ * Reads token/header values from environment variables (sourced from K8s Secrets).
+ * Returns partial options to merge into StreamableHTTPClientTransportOptions.
+ *
+ * PRD #414: MCP Client Outbound Authentication (M1 + M2 + M4)
+ */
+function resolveTransportAuth(auth, serverName, logger) {
+    if (!auth)
+        return {};
+    const result = {};
+    // M1: Static token → authProvider
+    if (auth.tokenEnvVar) {
+        const token = process.env[auth.tokenEnvVar];
+        if (token) {
+            result.authProvider = new StaticTokenAuthProvider(token);
+            logger.info('MCP server auth configured via authProvider (static token)', {
+                server: serverName,
+                envVar: auth.tokenEnvVar,
+            });
+        }
+        else {
+            throw new Error(`MCP server '${serverName}' auth.tokenEnvVar references env var '${auth.tokenEnvVar}' but it is empty or unset — fix the K8s Secret or remove the auth config`);
+        }
+    }
+    // M2: Custom headers → requestInit
+    if (auth.headersEnvVar) {
+        const headersJson = process.env[auth.headersEnvVar];
+        if (headersJson) {
+            try {
+                const headers = JSON.parse(headersJson);
+                if (typeof headers !== 'object' || headers === null || Array.isArray(headers)) {
+                    throw new Error('Headers must be a JSON object of key-value pairs');
+                }
+                // Validate all header values are strings — non-string values cause HTTP errors
+                for (const [key, value] of Object.entries(headers)) {
+                    if (typeof value !== 'string') {
+                        throw new Error(`Header "${key}" value must be a string, got ${typeof value}`);
+                    }
+                }
+                result.requestInit = { headers };
+                logger.info('MCP server auth configured via requestInit headers', {
+                    server: serverName,
+                    envVar: auth.headersEnvVar,
+                    headerCount: Object.keys(headers).length,
+                });
+            }
+            catch (err) {
+                throw new Error(`MCP server '${serverName}' auth.headersEnvVar env var '${auth.headersEnvVar}' contains invalid JSON: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+            }
+        }
+        else {
+            throw new Error(`MCP server '${serverName}' auth.headersEnvVar references env var '${auth.headersEnvVar}' but it is empty or unset — fix the K8s Secret or remove the auth config`);
+        }
+    }
+    // M4: OAuth client_credentials → authProvider (takes precedence over tokenEnvVar)
+    // Uses SDK built-in ClientCredentialsProvider (@modelcontextprotocol/sdk ^1.27.1)
+    // instead of custom implementation. The SDK handles:
+    //   - prepareTokenRequest() → sets grant_type=client_credentials + scope
+    //   - client_secret_basic auth method (RFC 6749 §2.3.1)
+    //   - Token caching and automatic refresh on 401
+    // No PKCE: client_credentials is non-interactive (RFC 6749 §4.4), PKCE is for
+    // authorization_code grants only (RFC 7636 §1).
+    if (auth.oauth) {
+        const clientSecret = process.env[auth.oauth.clientSecretEnvVar];
+        if (clientSecret) {
+            result.authProvider = new auth_extensions_js_1.ClientCredentialsProvider({
+                clientId: auth.oauth.clientId,
+                clientSecret,
+                clientName: 'dot-ai',
+                scope: auth.oauth.scope,
+            });
+            logger.info('MCP server auth configured via authProvider (OAuth client_credentials)', {
+                server: serverName,
+                clientId: auth.oauth.clientId,
+                clientSecretEnvVar: auth.oauth.clientSecretEnvVar,
+                scope: auth.oauth.scope,
+            });
+        }
+        else {
+            throw new Error(`MCP server '${serverName}' auth.oauth.clientSecretEnvVar references env var '${auth.oauth.clientSecretEnvVar}' but it is empty or unset — fix the K8s Secret or remove the auth config`);
+        }
+    }
+    return result;
+}
 /**
  * Manages MCP server connections, tool discovery, and tool routing.
  *
@@ -83,11 +215,65 @@ class McpClientManager {
                     throw new Error(`MCP server at index ${index} (${s.name || 'unnamed'}) has invalid attachTo value '${op}'. Must be one of: ${validOperations.join(', ')}`);
                 }
             }
+            // Parse optional auth config (PRD #414)
+            // Fail-fast on malformed auth — silent degradation to unauthenticated is a security risk
+            let auth;
+            const serverLabel = s.name || 'unnamed';
+            if (s.auth !== undefined) {
+                if (!s.auth || typeof s.auth !== 'object' || Array.isArray(s.auth)) {
+                    throw new Error(`MCP server at index ${index} (${serverLabel}) auth must be an object`);
+                }
+                const rawAuth = s.auth;
+                auth = {};
+                if ('tokenEnvVar' in rawAuth) {
+                    if (typeof rawAuth.tokenEnvVar !== 'string' || rawAuth.tokenEnvVar.trim() === '') {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.tokenEnvVar must be a non-empty string`);
+                    }
+                    auth.tokenEnvVar = rawAuth.tokenEnvVar;
+                }
+                if ('headersEnvVar' in rawAuth) {
+                    if (typeof rawAuth.headersEnvVar !== 'string' || rawAuth.headersEnvVar.trim() === '') {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.headersEnvVar must be a non-empty string`);
+                    }
+                    auth.headersEnvVar = rawAuth.headersEnvVar;
+                }
+                // M4: OAuth client_credentials config
+                if ('oauth' in rawAuth) {
+                    if (!rawAuth.oauth || typeof rawAuth.oauth !== 'object' || Array.isArray(rawAuth.oauth)) {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.oauth must be an object`);
+                    }
+                    const rawOAuth = rawAuth.oauth;
+                    if (!rawOAuth.clientId || typeof rawOAuth.clientId !== 'string') {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.oauth is missing required 'clientId' field`);
+                    }
+                    if (!rawOAuth.clientSecretEnvVar || typeof rawOAuth.clientSecretEnvVar !== 'string') {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.oauth is missing required 'clientSecretEnvVar' field`);
+                    }
+                    if ('scope' in rawOAuth && (typeof rawOAuth.scope !== 'string' || rawOAuth.scope.trim() === '')) {
+                        throw new Error(`MCP server at index ${index} (${serverLabel}) auth.oauth.scope must be a non-empty string`);
+                    }
+                    auth.oauth = {
+                        clientId: rawOAuth.clientId,
+                        clientSecretEnvVar: rawOAuth.clientSecretEnvVar,
+                        scope: typeof rawOAuth.scope === 'string' ? rawOAuth.scope : undefined,
+                    };
+                }
+                // Fail-fast: auth block present but no valid fields configured
+                if (!auth.tokenEnvVar && !auth.headersEnvVar && !auth.oauth) {
+                    throw new Error(`MCP server at index ${index} (${serverLabel}) auth is present but contains no valid auth fields (tokenEnvVar, headersEnvVar, or oauth)`);
+                }
+                // Mutual exclusivity: tokenEnvVar and oauth cannot both be specified
+                // because both set authProvider — oauth would silently overwrite the static token
+                if (auth.tokenEnvVar && auth.oauth) {
+                    throw new Error(`MCP server at index ${index} (${serverLabel}) auth specifies both 'tokenEnvVar' and 'oauth' — these are mutually exclusive (both set authProvider)`);
+                }
+            }
             return {
                 name: s.name || `mcp-server-${index}`,
                 endpoint: s.endpoint,
                 attachTo: s.attachTo,
                 timeout: s.timeout,
+                auth,
             };
         });
     }
@@ -134,7 +320,10 @@ class McpClientManager {
             name: config.name,
             endpoint: config.endpoint,
             attachTo: config.attachTo,
+            hasAuth: !!config.auth,
         });
+        // Resolve authentication options from config + env vars (PRD #414)
+        const authOptions = resolveTransportAuth(config.auth, config.name, this.logger);
         const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(config.endpoint), {
             reconnectionOptions: {
                 maxReconnectionDelay: 30_000,
@@ -142,6 +331,7 @@ class McpClientManager {
                 reconnectionDelayGrowFactor: 1.5,
                 maxRetries: 2,
             },
+            ...authOptions,
         });
         const client = new index_js_1.Client({ name: 'dot-ai', version: '1.0.0' }, { capabilities: {} });
         // Connect with timeout

package/dist/core/mcp-client-types.d.ts

@@ -6,11 +6,70 @@
  * that augment dot-ai's built-in kubectl/helm tools.
  *
  * PRD #358: MCP Server Integration
+ * PRD #414: MCP Client Outbound Authentication
  */
 /**
  * Valid dot-ai operations that MCP servers can attach to
  */
 export type McpAttachableOperation = 'remediate' | 'operate' | 'query';
+/**
+ * Authentication configuration for an MCP server connection.
+ *
+ * Four modes are supported:
+ * 1. Static token via `tokenEnvVar` — reads bearer token from env var, passed as authProvider
+ * 2. Custom headers via `headersEnvVar` — reads JSON headers from env var, passed as requestInit
+ * 3. OAuth via `oauth` — client_credentials grant using the MCP SDK's OAuthClientProvider
+ * 4. No auth (omit `auth`) — current behavior, backward compatible
+ *
+ * Credentials are injected via environment variables sourced from K8s Secrets.
+ * Never store tokens in ConfigMaps or Helm values.
+ *
+ * PRD #414: MCP Client Outbound Authentication
+ */
+export interface McpServerAuthConfig {
+    /**
+     * Environment variable name containing a bearer token for authProvider.
+     * The token is passed to StreamableHTTPClientTransport via a static authProvider
+     * that returns `{ access_token: tokenValue, token_type: 'bearer' }`.
+     *
+     * Example env var: MCP_AUTH_CONTEXT_FORGE=eyJhbGciOi...
+     */
+    tokenEnvVar?: string;
+    /**
+     * Environment variable name containing JSON-encoded HTTP headers for requestInit.
+     * Used for non-MCP-spec-compliant servers that require custom auth headers.
+     * The value must be a JSON object of header name → value pairs.
+     *
+     * Example env var: MCP_HEADERS_LEGACY_SERVER={"X-API-Key":"abc123"}
+     */
+    headersEnvVar?: string;
+    /**
+     * OAuth client_credentials configuration for MCP-spec-compliant servers.
+     * Uses the MCP SDK's OAuthClientProvider interface with client_credentials grant.
+     * The SDK handles discovery (RFC 9728), token exchange, and automatic refresh.
+     *
+     * PRD #414: MCP Client Outbound Authentication (M4)
+     */
+    oauth?: McpOAuthConfig;
+}
+/**
+ * OAuth client_credentials configuration for outbound MCP connections.
+ *
+ * dot-ai acts as an OAuth client authenticating to an MCP server's authorization
+ * server using the client_credentials grant (non-interactive, server-to-server).
+ * The MCP SDK discovers the authorization server via RFC 9728 metadata.
+ */
+export interface McpOAuthConfig {
+    /** OAuth client ID for this MCP server connection */
+    clientId: string;
+    /**
+     * Environment variable name containing the OAuth client secret.
+     * Example: MCP_OAUTH_SECRET_DOT_AI_UPSTREAM
+     */
+    clientSecretEnvVar: string;
+    /** Optional OAuth scope to request (e.g., "mcp:tools mcp:read") */
+    scope?: string;
+}
 /**
  * Configuration for an MCP server connection.
  * Loaded from /etc/dot-ai-mcp/mcp-servers.json (mounted via Helm ConfigMap).
@@ -24,6 +83,12 @@ export interface McpServerConfig {
     attachTo: McpAttachableOperation[];
     /** Optional timeout in milliseconds for MCP requests (default: 30000) */
     timeout?: number;
+    /**
+     * Optional authentication configuration for this MCP server.
+     * When omitted, no authentication is used (backward compatible).
+     * PRD #414: MCP Client Outbound Authentication
+     */
+    auth?: McpServerAuthConfig;
 }
 /**
  * Tool definition discovered from an MCP server via client.listTools()

package/dist/core/mcp-client-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-client-types.d.ts","sourceRoot":"","sources":["../../src/core/mcp-client-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,YAAY,EAAE,IAAI,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;gBADrE,OAAO,EAAE,MAAM,EACC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxE"}
+{"version":3,"file":"mcp-client-types.d.ts","sourceRoot":"","sources":["../../src/core/mcp-client-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAE3B,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,WAAW,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,0BAA0B;IAC1B,YAAY,EAAE,IAAI,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;gBADrE,OAAO,EAAE,MAAM,EACC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxE"}

package/dist/core/mcp-client-types.js

@@ -7,6 +7,7 @@
  * that augment dot-ai's built-in kubectl/helm tools.
  *
  * PRD #358: MCP Server Integration
+ * PRD #414: MCP Client Outbound Authentication
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpDiscoveryError = void 0;

package/dist/mcp/server.js

@@ -180,6 +180,9 @@ async function main() {
                 process.stderr.write(`MCP server discovery complete: ${stats.serverCount} server(s), ${stats.toolCount} tool(s)\n`);
             }
             catch (error) {
+                // Fail-fast: in Kubernetes, crash + backoff is easier to detect than a Running
+                // pod silently missing MCP tools. Config errors (bad endpoint, missing auth)
+                // surface immediately via CrashLoopBackOff events and alerts.
                 process.stderr.write(`FATAL: MCP server discovery failed: ${error instanceof Error ? error.message : String(error)}\n`);
                 process.exit(1);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vfarcic/dot-ai",
-  "version": "1.14.1",
+  "version": "1.15.1",
   "description": "AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance",
   "mcpName": "io.github.vfarcic/dot-ai",
   "main": "dist/index.js",