chatbot-nc 2.2.28 → 2.2.29

package/dist/cjs/type/index.d.ts

@@ -2,3 +2,64 @@ export type OAuthKeys = 'AuthURL' | 'AccessTokenURL' | 'CallBackURL' | 'CodeChal
 export type ApiKeys = 'AuthApiHeader' | 'AuthApiValue';
 export type BasicAuthKeys = 'AuthBasicUsername' | 'AuthBasicPassword';
 export type BearerAuthKeys = 'AuthBearerUsername' | 'AuthBearerPassword' | 'AuthBearerURL' | 'AuthBearerToken';
+export type OAuthProtectedResourceMetadata = {
+    /**
+     * Protected resource identifier
+     * Example:
+     * https://gmail.googleapis.com
+     */
+    resource?: string;
+    /**
+     * Authorization servers protecting this resource
+     */
+    authorization_servers: string[];
+    /**
+     * Supported bearer token methods
+     * Example:
+     * ["header"]
+     */
+    bearer_methods_supported?: string[];
+    /**
+     * Supported resource documentation
+     */
+    resource_documentation?: string;
+    /**
+     * Supported scopes for this resource
+     */
+    scopes_supported?: string[];
+    /**
+     * JWT signing algorithms supported for access tokens
+     */
+    resource_signing_alg_values_supported?: string[];
+    /**
+     * Additional custom fields
+     */
+    [key: string]: unknown;
+};
+export type OAuthMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    revocation_endpoint?: string;
+    code_challenge_methods_supported?: string[];
+    grant_types_supported?: string[];
+    response_types_supported?: string[];
+    scopes_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+};
+export type ClientRegistration = {
+    client_name: string;
+    client_uri?: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    token_endpoint_auth_method: string;
+    scope?: string;
+};
+export type ClientCredentials = {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at?: number;
+    client_secret_expires_at?: number;
+};

package/dist/cjs/utils/index.d.ts

@@ -51,4 +51,11 @@ export declare const Utils: {
         AttachClientHeaders: (clientHeaders?: string, contentType?: string, sessionAttributes?: Record<string, string>) => Promise<Record<string, string>>;
     };
     jwt: typeof jwt;
+    MCPOAuth: {
+        discoverOAuthResourceMetadata: (mcpServerUrl: string) => Promise<import("../type").OAuthProtectedResourceMetadata>;
+        discoverOAuthMetadata: (mcpServerUrl: string) => Promise<import("../type").OAuthMetadata>;
+        registerClient: (metadata: import("../type").OAuthMetadata, redirectUri: string) => Promise<import("../type").ClientCredentials>;
+        buildAuthorizationUrl: (metadata: import("../type").OAuthMetadata, clientId: string, redirectUri: string, state: string, codeChallenge?: string, codeChallengeMethod?: string, scopes?: string[], resource?: string) => Promise<string>;
+        handleCallBack: (callbackUrl: string, storedState: string, codeVerifier: string) => Promise<string>;
+    };
 };

package/dist/cjs/utils/index.js

@@ -29,11 +29,13 @@ const intent_1 = require("./intent");
 const date_format_1 = require("./date-format");
 const jwt = __importStar(require("jsonwebtoken"));
 const auth_1 = require("./auth");
+const mcp_oauth_1 = require("./mcp-oauth");
 exports.Utils = {
     Intents: intent_1.Intents,
     Common: common_1.Common,
     DateFormat: date_format_1.DateFormat,
     Auth: auth_1.Auth,
-    jwt
+    jwt,
+    MCPOAuth: mcp_oauth_1.MCPOAuth
 };
 //# sourceMappingURL=index.js.map

package/dist/cjs/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACA,qCAAkC;AAClC,qCAAmC;AACnC,+CAA2C;AAC3C,kDAAoC;AACpC,iCAA8B;AAEjB,QAAA,KAAK,GAAG;IACjB,OAAO,EAAP,gBAAO;IACP,MAAM,EAAN,eAAM;IACN,UAAU,EAAV,wBAAU;IACV,IAAI,EAAJ,WAAI;IACJ,GAAG;CACN,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AACA,qCAAkC;AAClC,qCAAmC;AACnC,+CAA2C;AAC3C,kDAAoC;AACpC,iCAA8B;AAC9B,2CAAuC;AAG1B,QAAA,KAAK,GAAG;IACjB,OAAO,EAAP,gBAAO;IACP,MAAM,EAAN,eAAM;IACN,UAAU,EAAV,wBAAU;IACV,IAAI,EAAJ,WAAI;IACJ,GAAG;IACH,QAAQ,EAAR,oBAAQ;CACX,CAAA"}

package/dist/cjs/utils/mcp-oauth.d.ts

@@ -0,0 +1,8 @@
+import { ClientCredentials, OAuthMetadata, OAuthProtectedResourceMetadata } from "../type";
+export declare const MCPOAuth: {
+    discoverOAuthResourceMetadata: (mcpServerUrl: string) => Promise<OAuthProtectedResourceMetadata>;
+    discoverOAuthMetadata: (mcpServerUrl: string) => Promise<OAuthMetadata>;
+    registerClient: (metadata: OAuthMetadata, redirectUri: string) => Promise<ClientCredentials>;
+    buildAuthorizationUrl: (metadata: OAuthMetadata, clientId: string, redirectUri: string, state: string, codeChallenge?: string, codeChallengeMethod?: string, scopes?: string[], resource?: string) => Promise<string>;
+    handleCallBack: (callbackUrl: string, storedState: string, codeVerifier: string) => Promise<string>;
+};

package/dist/cjs/utils/mcp-oauth.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCPOAuth = void 0;
+const discoverOAuthResourceMetadata = async (mcpServerUrl) => {
+    const url = new URL(mcpServerUrl);
+    const protectedResourceUrl = new URL("/.well-known/oauth-protected-resource", url);
+    // Step 1: RFC 9470 - Get Protected Resource Metadata
+    const protectedResourceResponse = await fetch(protectedResourceUrl.toString());
+    if (!protectedResourceResponse.ok) {
+        throw new Error(`Failed to fetch protected resource metadata: ` +
+            `${protectedResourceResponse.status}`);
+    }
+    const protectedResource = (await protectedResourceResponse.json());
+    return protectedResource;
+};
+/**
+ * Discovers OAuth configuration for an MCP server using RFC 9470 + RFC 8414.
+ */
+const discoverOAuthMetadata = async (mcpServerUrl) => {
+    var _a;
+    const protectedResource = (await discoverOAuthResourceMetadata(mcpServerUrl));
+    const authServers = protectedResource.authorization_servers;
+    if (!Array.isArray(authServers) || authServers.length === 0) {
+        throw new Error("No authorization servers found in protected resource metadata");
+    }
+    // Use the first authorization server
+    const authServerUrl = authServers[0];
+    // Step 2: RFC 8414 - Get Authorization Server Metadata
+    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authServerUrl);
+    const metadataResponse = await fetch(metadataUrl.toString());
+    if (!metadataResponse.ok) {
+        throw new Error(`Failed to fetch authorization server metadata: ` +
+            `${metadataResponse.status}`);
+    }
+    const metadata = (await metadataResponse.json());
+    // Validate required fields
+    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+        throw new Error("Missing required OAuth endpoints in metadata");
+    }
+    // Warn if PKCE support isn't advertised
+    if (!((_a = metadata.code_challenge_methods_supported) === null || _a === void 0 ? void 0 : _a.includes("S256"))) {
+        console.warn("Server does not advertise S256 PKCE support, " +
+            "but we will use it anyway");
+    }
+    return metadata;
+};
+const registerClient = async (metadata, redirectUri) => {
+    var _a, _b, _c, _d;
+    if (!metadata.registration_endpoint)
+        throw new Error("Server does not support dynamic client registration");
+    const registrationRequest = {
+        client_name: "Your MCP Client",
+        client_uri: "https://example.com",
+        redirect_uris: [redirectUri],
+        grant_types: (_a = metadata === null || metadata === void 0 ? void 0 : metadata.grant_types_supported) !== null && _a !== void 0 ? _a : ["authorization_code", "refresh_token"],
+        response_types: (_b = metadata === null || metadata === void 0 ? void 0 : metadata.response_types_supported) !== null && _b !== void 0 ? _b : ["code"],
+        token_endpoint_auth_method: ((_c = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) === null || _c === void 0 ? void 0 : _c.length) && ((_d = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) === null || _d === void 0 ? void 0 : _d.includes("none")) ? "none" : metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported[0],
+    };
+    const response = await fetch(metadata.registration_endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        },
+        body: JSON.stringify(registrationRequest),
+    });
+    if (!response.ok) {
+        const errorBody = await response.text();
+        throw new Error(`Client registration failed: ${response.status} - ${errorBody}`);
+    }
+    const credentials = (await response.json());
+    // Store credentials securely
+    return credentials;
+};
+const buildAuthorizationUrl = async (metadata, clientId, redirectUri, state, codeChallenge, codeChallengeMethod, scopes = [], resource) => {
+    let param = {
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        state: state,
+        prompt: "consent",
+    };
+    if (scopes.length)
+        param.scope = scopes.join(" ");
+    if (codeChallengeMethod)
+        param.code_challenge = codeChallenge;
+    if (codeChallengeMethod)
+        param.code_challenge_method = codeChallengeMethod;
+    if (resource)
+        param.resource = resource;
+    const params = new URLSearchParams(param);
+    return `${metadata.authorization_endpoint}?${params.toString()}`;
+};
+const handleCallBack = async (callbackUrl, storedState, codeVerifier) => {
+    const params = parseCallback(callbackUrl);
+    if (params.error) {
+        throw new Error(`OAuth error: ${params.error} - ` +
+            `${params.error_description || "Unknown error"}`);
+    }
+    if (params.state !== storedState) {
+        throw new Error("Invalid state parameter - possible CSRF attack");
+    }
+    if (!params.code) {
+        throw new Error("Missing authorization code");
+    }
+    return params.code;
+};
+const parseCallback = (url) => {
+    const urlParams = new URLSearchParams(new URL(url).search);
+    return {
+        code: urlParams.get("code") || undefined,
+        state: urlParams.get("state") || undefined,
+        error: urlParams.get("error") || undefined,
+        error_description: urlParams.get("error_description") || undefined,
+    };
+};
+exports.MCPOAuth = { discoverOAuthResourceMetadata, discoverOAuthMetadata, registerClient, buildAuthorizationUrl, handleCallBack };
+//# sourceMappingURL=mcp-oauth.js.map

package/dist/cjs/utils/mcp-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../../../utils/mcp-oauth.ts"],"names":[],"mappings":";;;AAEA,MAAM,6BAA6B,GAAG,KAAK,EAAE,YAAoB,EAA2C,EAAE;IAC7G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;IACjC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CACnC,uCAAuC,EACvC,GAAG,CACH,CAAA;IAED,qDAAqD;IACrD,MAAM,yBAAyB,GAAG,MAAM,KAAK,CAC5C,oBAAoB,CAAC,QAAQ,EAAE,CAC/B,CAAA;IACD,IAAI,CAAC,yBAAyB,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,+CAA+C;YAC/C,GAAG,yBAAyB,CAAC,MAAM,EAAE,CACrC,CAAA;IACF,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,CAAmC,CAAA;IACpG,OAAO,iBAAiB,CAAA;AACzB,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,KAAK,EAAE,YAAoB,EAA0B,EAAE;;IACpF,MAAM,iBAAiB,GAAG,CAAC,MAAM,6BAA6B,CAAC,YAAY,CAAC,CAAmC,CAAA;IAC/G,MAAM,WAAW,GAAG,iBAAiB,CAAC,qBAAqB,CAAC;IAE5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAA;IACF,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEpC,uDAAuD;IACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAC1B,yCAAyC,EACzC,aAAa,CACb,CAAA;IACD,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE5D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,iDAAiD;YACjD,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAC5B,CAAA;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAkB,CAAC;IAGlE,2BAA2B;IAC3B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAChE,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,gCAAgC,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACX,+CAA+C;YAC/C,2BAA2B,CAC3B,CAAA;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAuB,EAAE,WAAmB,EAA8B,EAAE;;IACzG,IAAI,CAAC,QAAQ,CAAC,qBAAqB;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAEvE,MAAM,mBAAmB,GAAuB;QAC/C,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qBAAqB,mCAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACvF,cAAc,EAAE,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,wBAAwB,mCAAI,CAAC,MAAM,CAAC;QAC9D,0BAA0B,EAAE,CAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,0CAAE,MAAM,MAAI,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,CAAE,CAAC,CAAC;KACvN,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;KACzC,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACvC,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAC/D,CAAA;IACF,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAA;IAEhE,6BAA6B;IAC7B,OAAO,WAAW,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,KAAK,EAClC,QAAuB,EACvB,QAAgB,EAChB,WAAmB,EACnB,KAAa,EACb,aAAsB,EACtB,mBAA4B,EAC5B,SAAmB,EAAE,EACrB,QAAiB,EACC,EAAE;IACpB,IAAI,KAAK,GAAG;QACX,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,SAAS;KACM,CAAA;IACxB,IAAI,MAAM,CAAC,MAAM;QAChB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,mBAAmB;QACtB,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,mBAAmB;QACtB,KAAK,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;IACnD,IAAI,QAAQ;QACX,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;IAEzC,OAAO,GAAG,QAAQ,CAAC,sBAAsB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,KAAK,EAAE,WAAmB,EAAE,WAAmB,EAAE,YAAoB,EAAE,EAAE;IAC/F,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IAEzC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,gBAAgB,MAAM,CAAC,KAAK,KAAK;YACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,eAAe,EAAE,CAChD,CAAA;IACF,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA;AASD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAkB,EAAE;IACpD,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QACxC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QAC1C,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QAC1C,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;KACnE,CAAA;AACH,CAAC,CAAA;AAEY,QAAA,QAAQ,GAAG,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC"}

package/dist/esm/type/index.d.ts

@@ -2,3 +2,64 @@ export type OAuthKeys = 'AuthURL' | 'AccessTokenURL' | 'CallBackURL' | 'CodeChal
 export type ApiKeys = 'AuthApiHeader' | 'AuthApiValue';
 export type BasicAuthKeys = 'AuthBasicUsername' | 'AuthBasicPassword';
 export type BearerAuthKeys = 'AuthBearerUsername' | 'AuthBearerPassword' | 'AuthBearerURL' | 'AuthBearerToken';
+export type OAuthProtectedResourceMetadata = {
+    /**
+     * Protected resource identifier
+     * Example:
+     * https://gmail.googleapis.com
+     */
+    resource?: string;
+    /**
+     * Authorization servers protecting this resource
+     */
+    authorization_servers: string[];
+    /**
+     * Supported bearer token methods
+     * Example:
+     * ["header"]
+     */
+    bearer_methods_supported?: string[];
+    /**
+     * Supported resource documentation
+     */
+    resource_documentation?: string;
+    /**
+     * Supported scopes for this resource
+     */
+    scopes_supported?: string[];
+    /**
+     * JWT signing algorithms supported for access tokens
+     */
+    resource_signing_alg_values_supported?: string[];
+    /**
+     * Additional custom fields
+     */
+    [key: string]: unknown;
+};
+export type OAuthMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint?: string;
+    revocation_endpoint?: string;
+    code_challenge_methods_supported?: string[];
+    grant_types_supported?: string[];
+    response_types_supported?: string[];
+    scopes_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+};
+export type ClientRegistration = {
+    client_name: string;
+    client_uri?: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types: string[];
+    token_endpoint_auth_method: string;
+    scope?: string;
+};
+export type ClientCredentials = {
+    client_id: string;
+    client_secret?: string;
+    client_id_issued_at?: number;
+    client_secret_expires_at?: number;
+};

package/dist/esm/utils/index.d.ts

@@ -51,4 +51,11 @@ export declare const Utils: {
         AttachClientHeaders: (clientHeaders?: string, contentType?: string, sessionAttributes?: Record<string, string>) => Promise<Record<string, string>>;
     };
     jwt: typeof jwt;
+    MCPOAuth: {
+        discoverOAuthResourceMetadata: (mcpServerUrl: string) => Promise<import("../type").OAuthProtectedResourceMetadata>;
+        discoverOAuthMetadata: (mcpServerUrl: string) => Promise<import("../type").OAuthMetadata>;
+        registerClient: (metadata: import("../type").OAuthMetadata, redirectUri: string) => Promise<import("../type").ClientCredentials>;
+        buildAuthorizationUrl: (metadata: import("../type").OAuthMetadata, clientId: string, redirectUri: string, state: string, codeChallenge?: string, codeChallengeMethod?: string, scopes?: string[], resource?: string) => Promise<string>;
+        handleCallBack: (callbackUrl: string, storedState: string, codeVerifier: string) => Promise<string>;
+    };
 };

package/dist/esm/utils/index.js

@@ -3,11 +3,13 @@ import { Intents } from "./intent";
 import { DateFormat } from "./date-format";
 import * as jwt from 'jsonwebtoken';
 import { Auth } from "./auth";
+import { MCPOAuth } from "./mcp-oauth";
 export const Utils = {
     Intents,
     Common,
     DateFormat,
     Auth,
-    jwt
+    jwt,
+    MCPOAuth
 };
 //# sourceMappingURL=index.js.map

package/dist/esm/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../utils/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAE9B,MAAM,CAAC,MAAM,KAAK,GAAG;IACjB,OAAO;IACP,MAAM;IACN,UAAU;IACV,IAAI;IACJ,GAAG;CACN,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../utils/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,CAAC,MAAM,KAAK,GAAG;IACjB,OAAO;IACP,MAAM;IACN,UAAU;IACV,IAAI;IACJ,GAAG;IACH,QAAQ;CACX,CAAA"}

package/dist/esm/utils/mcp-oauth.d.ts

@@ -0,0 +1,8 @@
+import { ClientCredentials, OAuthMetadata, OAuthProtectedResourceMetadata } from "../type";
+export declare const MCPOAuth: {
+    discoverOAuthResourceMetadata: (mcpServerUrl: string) => Promise<OAuthProtectedResourceMetadata>;
+    discoverOAuthMetadata: (mcpServerUrl: string) => Promise<OAuthMetadata>;
+    registerClient: (metadata: OAuthMetadata, redirectUri: string) => Promise<ClientCredentials>;
+    buildAuthorizationUrl: (metadata: OAuthMetadata, clientId: string, redirectUri: string, state: string, codeChallenge?: string, codeChallengeMethod?: string, scopes?: string[], resource?: string) => Promise<string>;
+    handleCallBack: (callbackUrl: string, storedState: string, codeVerifier: string) => Promise<string>;
+};

package/dist/esm/utils/mcp-oauth.js

@@ -0,0 +1,124 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const discoverOAuthResourceMetadata = (mcpServerUrl) => __awaiter(void 0, void 0, void 0, function* () {
+    const url = new URL(mcpServerUrl);
+    const protectedResourceUrl = new URL("/.well-known/oauth-protected-resource", url);
+    // Step 1: RFC 9470 - Get Protected Resource Metadata
+    const protectedResourceResponse = yield fetch(protectedResourceUrl.toString());
+    if (!protectedResourceResponse.ok) {
+        throw new Error(`Failed to fetch protected resource metadata: ` +
+            `${protectedResourceResponse.status}`);
+    }
+    const protectedResource = (yield protectedResourceResponse.json());
+    return protectedResource;
+});
+/**
+ * Discovers OAuth configuration for an MCP server using RFC 9470 + RFC 8414.
+ */
+const discoverOAuthMetadata = (mcpServerUrl) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const protectedResource = (yield discoverOAuthResourceMetadata(mcpServerUrl));
+    const authServers = protectedResource.authorization_servers;
+    if (!Array.isArray(authServers) || authServers.length === 0) {
+        throw new Error("No authorization servers found in protected resource metadata");
+    }
+    // Use the first authorization server
+    const authServerUrl = authServers[0];
+    // Step 2: RFC 8414 - Get Authorization Server Metadata
+    const metadataUrl = new URL("/.well-known/oauth-authorization-server", authServerUrl);
+    const metadataResponse = yield fetch(metadataUrl.toString());
+    if (!metadataResponse.ok) {
+        throw new Error(`Failed to fetch authorization server metadata: ` +
+            `${metadataResponse.status}`);
+    }
+    const metadata = (yield metadataResponse.json());
+    // Validate required fields
+    if (!metadata.authorization_endpoint || !metadata.token_endpoint) {
+        throw new Error("Missing required OAuth endpoints in metadata");
+    }
+    // Warn if PKCE support isn't advertised
+    if (!((_a = metadata.code_challenge_methods_supported) === null || _a === void 0 ? void 0 : _a.includes("S256"))) {
+        console.warn("Server does not advertise S256 PKCE support, " +
+            "but we will use it anyway");
+    }
+    return metadata;
+});
+const registerClient = (metadata, redirectUri) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b, _c, _d;
+    if (!metadata.registration_endpoint)
+        throw new Error("Server does not support dynamic client registration");
+    const registrationRequest = {
+        client_name: "Your MCP Client",
+        client_uri: "https://example.com",
+        redirect_uris: [redirectUri],
+        grant_types: (_a = metadata === null || metadata === void 0 ? void 0 : metadata.grant_types_supported) !== null && _a !== void 0 ? _a : ["authorization_code", "refresh_token"],
+        response_types: (_b = metadata === null || metadata === void 0 ? void 0 : metadata.response_types_supported) !== null && _b !== void 0 ? _b : ["code"],
+        token_endpoint_auth_method: ((_c = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) === null || _c === void 0 ? void 0 : _c.length) && ((_d = metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported) === null || _d === void 0 ? void 0 : _d.includes("none")) ? "none" : metadata === null || metadata === void 0 ? void 0 : metadata.token_endpoint_auth_methods_supported[0],
+    };
+    const response = yield fetch(metadata.registration_endpoint, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        },
+        body: JSON.stringify(registrationRequest),
+    });
+    if (!response.ok) {
+        const errorBody = yield response.text();
+        throw new Error(`Client registration failed: ${response.status} - ${errorBody}`);
+    }
+    const credentials = (yield response.json());
+    // Store credentials securely
+    return credentials;
+});
+const buildAuthorizationUrl = (metadata_1, clientId_1, redirectUri_1, state_1, codeChallenge_1, codeChallengeMethod_1, ...args_1) => __awaiter(void 0, [metadata_1, clientId_1, redirectUri_1, state_1, codeChallenge_1, codeChallengeMethod_1, ...args_1], void 0, function* (metadata, clientId, redirectUri, state, codeChallenge, codeChallengeMethod, scopes = [], resource) {
+    let param = {
+        response_type: "code",
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        state: state,
+        prompt: "consent",
+    };
+    if (scopes.length)
+        param.scope = scopes.join(" ");
+    if (codeChallengeMethod)
+        param.code_challenge = codeChallenge;
+    if (codeChallengeMethod)
+        param.code_challenge_method = codeChallengeMethod;
+    if (resource)
+        param.resource = resource;
+    const params = new URLSearchParams(param);
+    return `${metadata.authorization_endpoint}?${params.toString()}`;
+});
+const handleCallBack = (callbackUrl, storedState, codeVerifier) => __awaiter(void 0, void 0, void 0, function* () {
+    const params = parseCallback(callbackUrl);
+    if (params.error) {
+        throw new Error(`OAuth error: ${params.error} - ` +
+            `${params.error_description || "Unknown error"}`);
+    }
+    if (params.state !== storedState) {
+        throw new Error("Invalid state parameter - possible CSRF attack");
+    }
+    if (!params.code) {
+        throw new Error("Missing authorization code");
+    }
+    return params.code;
+});
+const parseCallback = (url) => {
+    const urlParams = new URLSearchParams(new URL(url).search);
+    return {
+        code: urlParams.get("code") || undefined,
+        state: urlParams.get("state") || undefined,
+        error: urlParams.get("error") || undefined,
+        error_description: urlParams.get("error_description") || undefined,
+    };
+};
+export const MCPOAuth = { discoverOAuthResourceMetadata, discoverOAuthMetadata, registerClient, buildAuthorizationUrl, handleCallBack };
+//# sourceMappingURL=mcp-oauth.js.map

package/dist/esm/utils/mcp-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth.js","sourceRoot":"","sources":["../../../utils/mcp-oauth.ts"],"names":[],"mappings":";;;;;;;;;AAEA,MAAM,6BAA6B,GAAG,CAAO,YAAoB,EAA2C,EAAE;IAC7G,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;IACjC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CACnC,uCAAuC,EACvC,GAAG,CACH,CAAA;IAED,qDAAqD;IACrD,MAAM,yBAAyB,GAAG,MAAM,KAAK,CAC5C,oBAAoB,CAAC,QAAQ,EAAE,CAC/B,CAAA;IACD,IAAI,CAAC,yBAAyB,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACd,+CAA+C;YAC/C,GAAG,yBAAyB,CAAC,MAAM,EAAE,CACrC,CAAA;IACF,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,CAAmC,CAAA;IACpG,OAAO,iBAAiB,CAAA;AACzB,CAAC,CAAA,CAAA;AAED;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAO,YAAoB,EAA0B,EAAE;;IACpF,MAAM,iBAAiB,GAAG,CAAC,MAAM,6BAA6B,CAAC,YAAY,CAAC,CAAmC,CAAA;IAC/G,MAAM,WAAW,GAAG,iBAAiB,CAAC,qBAAqB,CAAC;IAE5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACd,+DAA+D,CAC/D,CAAA;IACF,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAEpC,uDAAuD;IACvD,MAAM,WAAW,GAAG,IAAI,GAAG,CAC1B,yCAAyC,EACzC,aAAa,CACb,CAAA;IACD,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAA;IAE5D,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACd,iDAAiD;YACjD,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAC5B,CAAA;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAkB,CAAC;IAGlE,2BAA2B;IAC3B,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IAChE,CAAC;IAED,wCAAwC;IACxC,IAAI,CAAC,CAAA,MAAA,QAAQ,CAAC,gCAAgC,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CACX,+CAA+C;YAC/C,2BAA2B,CAC3B,CAAA;IACF,CAAC;IAED,OAAO,QAAQ,CAAA;AAChB,CAAC,CAAA,CAAA;AAED,MAAM,cAAc,GAAG,CAAO,QAAuB,EAAE,WAAmB,EAA8B,EAAE;;IACzG,IAAI,CAAC,QAAQ,CAAC,qBAAqB;QAClC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAEvE,MAAM,mBAAmB,GAAuB;QAC/C,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,WAAW,EAAE,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qBAAqB,mCAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACvF,cAAc,EAAE,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,wBAAwB,mCAAI,CAAC,MAAM,CAAC;QAC9D,0BAA0B,EAAE,CAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,0CAAE,MAAM,MAAI,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,qCAAqC,CAAE,CAAC,CAAC;KACvN,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;KACzC,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACvC,MAAM,IAAI,KAAK,CACd,+BAA+B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAC/D,CAAA;IACF,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAA;IAEhE,6BAA6B;IAC7B,OAAO,WAAW,CAAA;AACnB,CAAC,CAAA,CAAA;AAED,MAAM,qBAAqB,GAAG,oGASX,EAAE,2IARpB,QAAuB,EACvB,QAAgB,EAChB,WAAmB,EACnB,KAAa,EACb,aAAsB,EACtB,mBAA4B,EAC5B,SAAmB,EAAE,EACrB,QAAiB;IAEjB,IAAI,KAAK,GAAG;QACX,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,SAAS;KACM,CAAA;IACxB,IAAI,MAAM,CAAC,MAAM;QAChB,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,mBAAmB;QACtB,KAAK,CAAC,cAAc,GAAG,aAAa,CAAC;IACtC,IAAI,mBAAmB;QACtB,KAAK,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;IACnD,IAAI,QAAQ;QACX,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;IAEzC,OAAO,GAAG,QAAQ,CAAC,sBAAsB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AACjE,CAAC,CAAA,CAAA;AAED,MAAM,cAAc,GAAG,CAAO,WAAmB,EAAE,WAAmB,EAAE,YAAoB,EAAE,EAAE;IAC/F,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAA;IAEzC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACd,gBAAgB,MAAM,CAAC,KAAK,KAAK;YACjC,GAAG,MAAM,CAAC,iBAAiB,IAAI,eAAe,EAAE,CAChD,CAAA;IACF,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC9C,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA,CAAA;AASD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAkB,EAAE;IACpD,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO;QACL,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;QACxC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QAC1C,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;QAC1C,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;KACnE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,cAAc,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chatbot-nc",
-  "version": "2.2.28",
+  "version": "2.2.29",
   "description": "",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",