mcp4openapi 0.2.8 → 0.3.1

package/README.md

@@ -13,31 +13,7 @@ Universal MCP server that generates tools from any OpenAPI specification.
 Transform any OpenAPI specification into MCP tools **without writing code**.
 Configure everything via MCP profiles, reduce LLM context pollution, and get production-ready features out of the box.
 
-```
-+-------------------+
-|     MCP Client    |
-| (Claude/IDE etc.) |
-+---------+---------+
-          |
-          v
-+--+------+---------+
-|  |  MCP Profile   |
-|  | (autogenerated |
-|  |  if missing)   |
-|  +----------------+
-|                   |
-| MCP Server        |
-|                   |
-|  +----------------+
-|  |  OpenAPI Spec  |
-|  |  (YAML/JSON)   |
-+--+------+---------+
-          |
-          v
-+---------+---------+
-|    Service API    |
-+-------------------+
-```
+[![mcp4openapi-diagram](docs/mcp4openapi-principle.png)](docs/mcp4openapi-principle.png)
 
 ## Use Cases
 
@@ -45,19 +21,19 @@ Configure everything via MCP profiles, reduce LLM context pollution, and get pro
 2. **Multi-Environment**: Same server, different profiles (dev/staging/prod)
 3. **Custom Workflows**: Composite tools for common multi-step operations
 
-More about profiles: [docs/PROFILE-GUIDE.md](https://github.com/davidruzicka/mcp4openapi/blob/main/docs/PROFILE-GUIDE.md).
+More about MCP profiles: [docs/PROFILE-GUIDE.md](https://github.com/davidruzicka/mcp4openapi/blob/main/docs/PROFILE-GUIDE.md).
 
 ## Key Features
 
 ### Core
-- **Any OpenAPI API**: Works with OpenAPI 3.x specifications
-- **Profiles**: Create JSON configuration transforming API to MCP tools LLM friendly in profiles
-- **Tool Aggregation**: Reduce tool clutter - group related operations in profiles
-- **Composite Actions**: Chain API calls into workflows in profiles
+- **Any OpenAPI API**: Works with any OpenAPI 3.x specifications
+- **Profiles**: Create JSON configuration transforming API to MCP tools LLM friendly in [MCP profiles](docs/PROFILE-GUIDE.md)
+- **Tool Aggregation**: Reduce tool clutter - group related operations in MCP profiles
+- **Composite Actions**: Chain API calls into workflows in MCP profiles for saving context and requests with repetitive complex operations
 - **OAuth 2.0**: Browser-based authentication flow for HTTP transport (see [docs/OAUTH.md](./docs/OAUTH.md))
-- **Multi-Auth**: Support multiple auth methods (OAuth + Bearer) with priority-based fallback (see [docs/MULTI-AUTH.md](./docs/MULTI-AUTH.md))
+- **Multi-Auth**: Support multiple auth methods (OAuth + Bearer e.g.) with priority-based fallback (see [docs/MULTI-AUTH.md](./docs/MULTI-AUTH.md))
 - **Multipart uploads**: HttpClient handles `multipart/form-data` (file attachments and mixed fields)
-- **Observability**: Structured logging (console/JSON) with profile-aware token redaction, Prometheus metrics
+- **Observability**: Structured logging (console/JSON) with profile-aware secrets redaction, Prometheus metrics
 
 ## Security Note
 
@@ -102,16 +78,15 @@ Access Token (Bearer) example:
             "command": "npx",
             "args": ["mcp4openapi"],
             "env": {
-                "MCP4_OPENAPI_SPEC_PATH": "path/to/openapi.yaml",
-                "MCP4_API_TOKEN": "${input:MCP4_API_TOKEN}",
+                "MCP4_API_TOKEN": "${input:api-token}",
                 "MCP4_API_BASE_URL": "https://api.example.com",
-                "MCP4_PROFILE_PATH": "path/to/mcp-profile.json" //optional
+                "MCP4_PROFILE_PATH": "path/to/mcp-profile.json"
             }
         },
         "inputs": [
             {
                 "type": "promptString",
-                "id": "MCP4_API_TOKEN",
+                "id": "api-token",
                 "description": "API Authorization Token",
                 "password": true
             }
@@ -131,29 +106,47 @@ _`inputs` section prompts you for the token when the server starts, so environme
             "command": "npx",
             "args": ["mcp4openapi"],
             "env": {
-                "MCP4_OPENAPI_SPEC_PATH": "path/to/openapi.yaml",
                 "MCP4_API_TOKEN": "${env:MCP4_API_TOKEN}",
                 "MCP4_API_BASE_URL": "https://api.example.com",
-                "MCP4_PROFILE_PATH": "path/to/mcp-profile.json" //optional
+                "MCP4_PROFILE_PATH": "path/to/mcp-profile.json"
             }
         }
     }
 }
 ```
 
+#### Profile shortcut
+
+If profile defines `profile_id` (or `profile_name` or `profile_alias`), you can start with:
+
+```bash
+npx mcp4openapi --profile (profile-id/name/alias)
+```
+
+List available profiles with:
+
+```bash
+npx mcp4openapi --list-profiles
+npx mcp4openapi -l
+```
+
+Predefined profiles in the `profiles/` directory contains names for easy reference:
+- GitLab profile: `gitlab`
+- YouTrack profile: `youtrack`
+- SemGrep profile: `semgrep`
+
+Profiles are resolved from `./profiles` path by default. If that directory is missing, the bundled npm package profiles are used. Override with `--profiles-dir` or `MCP4_PROFILES_DIR`.
+
 ##### ⚠️ Prerequisites
 
-- `MCP4_API_TOKEN` with access token (Bearer) must be set.
+- `MCP4_API_TOKEN` (or equivalent environment variable name defined in your profile) with access token (Bearer) must be set for stdio transport with authenticated APIs. OAuth authorization flow is supported for HTTP transport only.
 
 #### Claude Code example:
 
 ```bash
 claude mcp add --transport stdio mcp4openapi \
   --env MCP4_API_TOKEN="${MCP4_API_TOKEN}" \
-  --env MCP4_OPENAPI_SPEC_PATH=path/to/openapi.yaml \
-  --env MCP4_API_BASE_URL=https://api.example.com \
-  --env MCP4_PROFILE_PATH=path/to/mcp-profile.json \
-  -- npx mcp4openapi
+  -- npx mcp4openapi --profile mcp-profile --api-base-url https://api.example.com
 ```
 
 ##### ⚠️ Prerequisites
@@ -167,12 +160,15 @@ claude mcp add --transport stdio mcp4openapi \
     "servers": {
         "mcp4openapi": {
             "command": "npx",
-            "args": ["mcp4openapi"],
+            "args": [
+                "mcp4openapi",
+                "--profile",
+                "mcp-profile",
+                "--api-base-url",
+                "https://api.example.com"
+            ],
             "env": {
-                "MCP4_OPENAPI_SPEC_PATH": "path/to/openapi.yaml",
-                "MCP4_API_TOKEN": "${input:api_token}",
-                "MCP4_API_BASE_URL": "https://api.example.com",
-                "MCP4_PROFILE_PATH": "path/to/mcp-profile.json" //optional
+                "MCP4_API_TOKEN": "${input:api-token}",
             }
         }
     }
@@ -181,7 +177,7 @@ claude mcp add --transport stdio mcp4openapi \
 
 ##### Note
 
-- JetBrains IDEs show ⚠️ right next to `${input:api_token}` to indicate that you need to enter the token manually in the IDE dialog.
+- JetBrains IDEs show ⚠️ right next to `${input:api-token}` to indicate that you need to enter the token manually in the IDE dialog.
 
 ### Option B: Docker
 
@@ -209,9 +205,16 @@ cp env.example .env
 
 **4. Run:**
 ```bash
+# uses .env for configuration
 npm start
 ```
 
+- alternatively, run with CLI flags:
+```bash
+export MCP4_API_TOKEN=glpat-xxxxxxxxxxxx
+npm start --profile mcp-profile
+```
+
 See [docs/HTTP-TRANSPORT.md](./docs/HTTP-TRANSPORT.md) for transport options (stdio vs HTTP) and authentication modes.
 
 ## Custom CA Certificates
@@ -283,19 +286,45 @@ echo 'export NODE_EXTRA_CA_CERTS="$HOME/ca-bundle.pem"' >> $HOME/.bash_profile
 ## Environment Variables
 
 ### Required
-- `MCP4_OPENAPI_SPEC_PATH`: Path or URL to OpenAPI spec (YAML/JSON, supports local files and HTTP/HTTPS URLs)
 - `MCP4_API_TOKEN`: API token (default env var name; customizable via `MCP4_AUTH_ENV_VAR`)
   - **Required for stdio** mode with authenticated APIs
   - **Optional for HTTP** mode with per-session tokens sent in HTTP headers
   - When using no profile mode, auth type is auto-detected from OpenAPI `security` schemes if present
 
 ### Optional - Core
+- `MCP4_PROFILE`: Profile ID for resolving profiles from a directory (used by `--profile`)
+- `MCP4_PROFILES_DIR`: Profiles root directory for profile ID resolution (default: `./profiles`)
 - `MCP4_PROFILE_PATH`: Profile JSON path (default: auto-generate tools from OpenAPI spec; warning logged if tool exceeds 60 parameters)
+- `MCP4_OPENAPI_SPEC_PATH`: Path or URL to OpenAPI spec (YAML/JSON, supports local files and HTTP/HTTPS URLs). Required when profile does not provide `openapi_spec_path`. In HTTP profile routing, this acts as a global fallback for profiles without `openapi_spec_path`.
 - `MCP4_TRANSPORT`: `stdio` (default) or `http`
 - `MCP4_API_BASE_URL`: Override OpenAPI server URL
 
+**Profile auth env vars**: Use profile-specific names for `value_from_env` (for example, `GITLAB_TOKEN`, `YOUTRACK_TOKEN`) instead of the generic `MCP4_API_TOKEN`.
+
+**CLI mapping rule**: Documented `MCP4_*` env vars can be passed as a CLI flag by dropping the `MCP4_` prefix and using kebab-case. Example: `MCP4_PROFILE_PATH` -> `--profile-path`, `MCP4_OPENAPI_SPEC_PATH` -> `--openapi-spec-path`. Unknown flags cause startup to fail.
+
+### Optional - Tool Filtering
+Global tool filtering removes tools during profile load for every session.
+
+- `MCP4_TOOL_FILTER_ALLOW_NAMES`: Comma-separated tool names to keep (exact match, case-sensitive)
+- `MCP4_TOOL_FILTER_ALLOW_NAME_REGEX`: Comma-separated regex patterns to allow (auto-anchored unless already wrapped with `^` and `$`)
+- `MCP4_TOOL_FILTER_DENY_NAMES`: Comma-separated tool names to exclude
+- `MCP4_TOOL_FILTER_DENY_NAME_REGEX`: Comma-separated regex patterns to exclude (auto-anchored)
+- `MCP4_TOOL_FILTER_ALLOW_CATEGORIES`: Comma-separated operation categories to allow (`list` and/or `read`). Composite tools are allowed only if all steps are within the allowed categories.
+- `MCP4_TOOL_FILTER_WARN_THRESHOLD_PCT`: Warn when filtered percentage exceeds this threshold (default: `90`)
+- `MCP4_TOOL_FILTER_SESSION_MAX_TOOLS`: Max entries in `X-Mcp4-Tools` header (default: `100`)
+
+Regex patterns are validated for length, nested quantifiers, and alternations with quantifiers to reduce ReDoS risk.
+
+#### Tool Filtering Troubleshooting
+- If startup fails with "Tool filter configuration has no effect", ensure allow or deny patterns actually change the tool set.
+- If startup fails with "All tools filtered out", relax allow or deny settings to leave at least one tool.
+- If session initialization fails with "X-Mcp4-Tools filter has no effect", remove empty headers or adjust entries to restrict tools.
+- If session initialization fails with "X-Mcp4-Tools filtered out all tools", verify tool names or regex patterns match available tools.
+- If regex validation fails, shorten patterns and avoid nested quantifiers or alternations with quantifiers.
+
 ### Optional - Authentication (No-Profile Mode)
-When running without a profile, authentication is automatically configured from OpenAPI spec's `security` schemes:
+When running without a profile (OpenAPI spec only), authentication is automatically configured from OpenAPI spec's `security` schemes:
 
 - `MCP4_AUTH_ENV_VAR`: Environment variable name for auth token (default: `MCP4_API_TOKEN`)
 
@@ -308,12 +337,12 @@ When running without a profile, authentication is automatically configured from
 
 **Example**: Use custom env var for GitLab own instance token:
 ```bash
-export MCP4_API_TOKEN=glpat-xxxxxxxxxxxx
-export MCP4_API_BASE_URL=https://gitlab.example.com/api/v4
-export MCP4_OPENAPI_SPEC_PATH=profiles/gitlab/openapi.yaml
-export MCP4_PROFILE_PATH=profiles/gitlab/developer-profile.json
-npm start
+export MCP4_API_TOKEN=xxxxxxxxxxxx
+npm start \
+  --api-base-url https://gitlab.example.com/api/v4 \
+  --openapi-spec-path https://gitlab.example.com/api/v4/openapi.yaml
 ```
+_⚠️ Warning: Running without a profile may generate many tools with many parameters, leading to LLM context pollution._
 
 #### Force Authentication Override
 For APIs with incomplete OpenAPI specs (missing `security` definition but requiring authentication):
@@ -332,13 +361,13 @@ export MCP4_OPENAPI_SPEC_PATH=./incomplete-spec.yaml
 npm start
 ```
 
-**Example**: Force custom header authentication:
+CLI alternative:
 ```bash
-export MCP4_AUTH_FORCE=true
-export MCP4_AUTH_TYPE=custom-header
-export MCP4_AUTH_HEADER_NAME=X-API-Key
-export MCP4_API_TOKEN=your_api_key_here
-npm start
+export MCP4_API_TOKEN=your_token_here
+npm start \
+  --auth-force true \
+  --auth-type bearer \
+  --openapi-spec-path ./incomplete-spec.yaml
 ```
 
 **Note**: If OpenAPI spec has `security` defined, it takes precedence over force auth settings.
@@ -400,6 +429,56 @@ export MCP4_TOOLNAME_MAX=30
 - `MCP4_OAUTH_REFRESH_THRESHOLD_MS`: Refresh access tokens this many ms before expiry (default: `60000` = 60s)
 - `MCP4_HEARTBEAT_ENABLED`, `MCP4_HEARTBEAT_INTERVAL_MS`: SSE heartbeat settings
 - `MCP4_TOKEN_MAX_LENGTH`: Maximum token length in characters (default: `1000`)
+- `MCP4_FILTER_MAX_VALUES`: Max values per filtering key (default: `10`)
+- `MCP4_HTTP_PROFILE_ROUTING`: Enable profile routing (`/profile/:id/mcp`). If enabled without a default profile, `/mcp` is not registered.
+
+**Profile routing example**:
+```bash
+export MCP4_TRANSPORT=http
+export MCP4_HTTP_PROFILE_ROUTING=true
+export MCP4_PROFILES_DIR=./profiles
+npx mcp4openapi
+```
+
+CLI alternative:
+```bash
+npx mcp4openapi --transport http \
+  --http-profile-routing true \
+  --profiles-dir ./profiles
+```
+
+**Test with curl**:
+```bash
+curl -X POST http://localhost:3003/profile/mcp-profile-name/mcp -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"initialize"}'
+```
+
+If `MCP4_PROFILE_PATH` (or `--profile-path`) is set, `/mcp` remains available alongside `/profile/:id/mcp`.
+
+#### Parameter Filtering (HTTP: X-Mcp4-Params)
+
+`X-Mcp4-Params` is a per-session header for constraining tool call parameters (not tool selection). It is parsed on session initialization and then enforced for the lifetime of the session: subsequent requests may omit the header, but if provided it must match the session value or the server returns a `400` validation error.
+
+**Format**: comma-separated `key=value` pairs. Repeat keys to allow multiple values.
+
+**Example for GitLab profile**:
+```
+X-Mcp4-Params: project_id=123, project_id=mcp/mcp-gitlab, _allow_list, _allow_read
+```
+
+**What this means**:
+- The session is constrained to the GitLab project identified by either `123` or `mcp/mcp-gitlab` (both refer to the same project) for tools that accept `project_id` (or an alias mapped to it). If a tool call provides a different `project_id`, the server rejects it.
+- This is useful for agent-style workflows (e.g., "code review only within project 123/456") because the client can enforce the scope at session init instead of relying on the agent to always remember to pass the correct project parameter.
+- `_allow_list` and `_allow_read` relax filter enforcement for list and read operations; use them if you want list/read calls to be allowed even when they omit the filtered key, or when they pass a different value.
+
+**Notes**:
+- Keys are validated against the currently available tool parameters (including parameter aliases).
+- Max values per key are limited by `MCP4_FILTER_MAX_VALUES`.
+- Control keys (no value):
+  - `_allow_list`: allows list operations to omit the filtered key (only affects presence enforcement).
+  - `_allow_read`: allows read operations to omit the filtered key (only affects presence enforcement).
+  - If the filtered key is present in arguments, its value is not constrained for list/read operations.
+  - Control keys do not relax modify operations.
+  - Control keys are only meaningful when at least one `key=value` filter is present (otherwise there is nothing to enforce).
 
 See [docs/HTTP-TRANSPORT.md](./docs/HTTP-TRANSPORT.md) for detailed HTTP transport configuration.
 
@@ -418,7 +497,7 @@ See [docs/OAUTH.md](./docs/OAUTH.md#ssltls-support) for SSL configuration with O
 export MCP4_API_BASE_URL=https://www.gitlab.com/api/v4
 export MCP4_OAUTH_CLIENT_ID=your_dcr_client_id
 export MCP4_OAUTH_CLIENT_SECRET=your_dcr_client_secret
-export MCP4_OAUTH_REDIRECT_URI=http://mcp.local:3003/oauth/callback
+export MCP4_OAUTH_REDIRECT_URI=http://127.0.0.1:3003/oauth/callback
 # OAuth endpoints are automatically discovered from API base URL
 ```
 **Note**: DCR and OAuth callback must be registered with the OAuth provider.
@@ -495,6 +574,7 @@ npm run validate:schema
 ### Run Tests
 ```bash
 npm test
+npm run test:e2e
 ```
 
 ## Troubleshooting MCP

package/dist/scripts/validate-profile.js

@@ -8,9 +8,9 @@
 import fs from 'fs/promises';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { ProfileLoader } from '../src/profile-loader.js';
-import { OpenAPIParser } from '../src/openapi-parser.js';
-import { ToolGenerator } from '../src/tool-generator.js';
+import { ProfileLoader } from '../src/profile/profile-loader.js';
+import { OpenAPIParser } from '../src/openapi/openapi-parser.js';
+import { ToolGenerator } from '../src/tooling/tool-generator.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 async function validateProfile(profilePath, specPath) {

package/dist/scripts/validate-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-profile.js","sourceRoot":"","sources":["../../scripts/validate-profile.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAc3C,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,QAAiB;IAEjB,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,IAAI,CAAC;QACH,kCAAkC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8BAA8B;QAC9B,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA8B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,6BAA6B;QAE7B,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBACxD,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,SAAS,WAAW,uCAAuC,CAC9E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,sBAAsB,SAAS,2BAA2B,CAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE/B,4CAA4C;YAC5C,gEAAgE;YAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,sCAAsC;gBAE/D,4DAA4D;gBAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACvC,iDAAiD;oBACjD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;wBACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,aAAa,SAAS,oBAAoB,MAAM,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1I,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAE1B,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAE5B,IAAI,cAAc,GAAG,CAAC,CAAC;gBACvB,MAAM,UAAU,GAAa,EAAE,CAAC;gBAEhC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACpB,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;4BACrE,cAAc,EAAE,CAAC;4BAEjB,gDAAgD;4BAChD,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;4BAErG,IAAI,CAAC;gCACH,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;4BACnC,CAAC;4BAAC,MAAM,CAAC;gCACP,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,WAAW,EAAE,CAAC,CAAC;4BAC7D,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BAC9B,cAAc,EAAE,CAAC;4BACjB,IAAI,CAAC;gCACH,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BACjC,CAAC;4BAAC,MAAM,CAAC;gCACP,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;4BACtD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;gBAExC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;oBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,4CAA4C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,4CAA6C,CAAW,CAAC,OAAO,EAAE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;gBAE5C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACH,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;oBAClC,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,+BAA+B,OAAO,CAAC,IAAI,MAAO,CAAW,CAAC,OAAO,EAAE,CACxE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QAED,8BAA8B;QAE9B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,eAAe,OAAO,CAAC,KAAK,CAAC,MAAM,kFAAkF,CACtH,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,iEAAiE,CAClE,CAAC;QACJ,CAAC;IAEH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAsB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO;IACP,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,WAAW;IACX,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;CAwBf,CAAC,CAAC;QACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5D,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"validate-profile.js","sourceRoot":"","sources":["../../scripts/validate-profile.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAc3C,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,QAAiB;IAEjB,MAAM,MAAM,GAAqB;QAC/B,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,IAAI,CAAC;QACH,kCAAkC;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;YAC7D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8BAA8B;QAC9B,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,iDAAiD;QACjD,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA8B,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,6BAA6B;QAE7B,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;gBACxD,IAAI,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;oBAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,SAAS,WAAW,uCAAuC,CAC9E,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;wBAChC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,sBAAsB,SAAS,2BAA2B,CAC7E,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE/B,4CAA4C;YAC5C,gEAAgE;YAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,sCAAsC;gBAE/D,4DAA4D;gBAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACvC,iDAAiD;oBACjD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;YAED,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjE,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;wBACxC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,SAAS,IAAI,CAAC,IAAI,aAAa,SAAS,oBAAoB,MAAM,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1I,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAE1B,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAE5B,IAAI,cAAc,GAAG,CAAC,CAAC;gBACvB,MAAM,UAAU,GAAa,EAAE,CAAC;gBAEhC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACpB,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;4BACrE,cAAc,EAAE,CAAC;4BAEjB,gDAAgD;4BAChD,MAAM,WAAW,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC;4BAErG,IAAI,CAAC;gCACH,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;4BACnC,CAAC;4BAAC,MAAM,CAAC;gCACP,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,MAAM,WAAW,EAAE,CAAC,CAAC;4BAC7D,CAAC;wBACH,CAAC;oBACH,CAAC;oBAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BAC9B,cAAc,EAAE,CAAC;4BACjB,IAAI,CAAC;gCACH,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4BACjC,CAAC;4BAAC,MAAM,CAAC;gCACP,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;4BACtD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC;gBAExC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;oBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAChB,4CAA4C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,4CAA6C,CAAW,CAAC,OAAO,EAAE,CACnE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5B,MAAM,SAAS,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;gBAE5C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACH,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;oBAClC,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,+BAA+B,OAAO,CAAC,IAAI,MAAO,CAAW,CAAC,OAAO,EAAE,CACxE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QAED,8BAA8B;QAE9B,6CAA6C;QAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,eAAe,OAAO,CAAC,KAAK,CAAC,MAAM,kFAAkF,CACtH,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAClB,iEAAiE,CAClE,CAAC;QACJ,CAAC;IAEH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAsB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,OAAO;IACP,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,iBAAiB,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,SAAS;IACT,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,WAAW;IACX,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;CAwBf,CAAC,CAAC;QACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE5E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5D,WAAW,CAAC,MAAM,CAAC,CAAC;IAEpB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;IACjB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/argument-normalizer.d.ts

@@ -0,0 +1,5 @@
+import type { ToolDefinition } from './types/profile.js';
+type NormalizedArguments = Record<string, unknown>;
+export declare function normalizeArguments(toolDef: ToolDefinition, args: Record<string, unknown>): NormalizedArguments;
+export {};
+//# sourceMappingURL=argument-normalizer.d.ts.map

package/dist/src/argument-normalizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argument-normalizer.d.ts","sourceRoot":"","sources":["../../src/argument-normalizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAuB,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAE7E,KAAK,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAElD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,mBAAmB,CAsBrB"}

package/dist/src/argument-normalizer.js

@@ -0,0 +1,61 @@
+export function normalizeArguments(toolDef, args) {
+    const normalized = { ...args };
+    for (const [paramName, paramDef] of Object.entries(toolDef.parameters)) {
+        const value = normalized[paramName];
+        if (value === undefined) {
+            continue;
+        }
+        const mappedEntries = normalizeObjectEntries(paramDef, value);
+        if (mappedEntries !== undefined) {
+            normalized[paramName] = mappedEntries;
+            continue;
+        }
+        const mappedArrayItems = normalizeArrayItems(paramDef, value);
+        if (mappedArrayItems !== undefined) {
+            normalized[paramName] = mappedArrayItems;
+        }
+    }
+    return normalized;
+}
+function normalizeObjectEntries(paramDef, value) {
+    if (!paramDef.object_entries_to_array) {
+        return undefined;
+    }
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const { key_field, value_field, wrap_value_field } = paramDef.object_entries_to_array;
+    const entries = Object.entries(value);
+    return entries.map(([key, entryValue]) => ({
+        [key_field]: key,
+        [value_field]: wrapObjectValue(entryValue, wrap_value_field),
+    }));
+}
+function wrapObjectValue(value, wrapValueField) {
+    if (!wrapValueField) {
+        return value;
+    }
+    if (typeof value === 'object' && value !== null) {
+        return value;
+    }
+    return { [wrapValueField]: value };
+}
+function normalizeArrayItems(paramDef, value) {
+    if (!paramDef.array_item_to_object) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const { key_field } = paramDef.array_item_to_object;
+    return value.map(item => {
+        if (typeof item === 'object' && item !== null && !Array.isArray(item)) {
+            return item;
+        }
+        if (['string', 'number', 'boolean'].includes(typeof item)) {
+            return { [key_field]: item };
+        }
+        return item;
+    });
+}
+//# sourceMappingURL=argument-normalizer.js.map

package/dist/src/argument-normalizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argument-normalizer.js","sourceRoot":"","sources":["../../src/argument-normalizer.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,kBAAkB,CAChC,OAAuB,EACvB,IAA6B;IAE7B,MAAM,UAAU,GAAwB,EAAE,GAAG,IAAI,EAAE,CAAA;IAEnD,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAQ;QACV,CAAC;QAED,MAAM,aAAa,GAAG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC7D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,UAAU,CAAC,SAAS,CAAC,GAAG,aAAa,CAAA;YACrC,SAAQ;QACV,CAAC;QAED,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC7D,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,UAAU,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAA;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAA6B,EAC7B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,CAAC;QACtC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,uBAAuB,CAAA;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAA;IAEhE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC,SAAS,CAAC,EAAE,GAAG;QAChB,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,UAAU,EAAE,gBAAgB,CAAC;KAC7D,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,cAAuB;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAA6B,EAC7B,KAAc;IAEd,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,oBAAoB,CAAA;IAEnD,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAA;QAC9B,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/src/auth/oauth-provider.d.ts

@@ -0,0 +1,131 @@
+/**
+ * OAuth 2.0 Provider Adapter
+ *
+ * Implements MCP SDK OAuthServerProvider interface to integrate with external
+ * OAuth 2.0 authorization servers (e.g., GitLab, GitHub, etc.)
+ *
+ * Architecture:
+ * - This server acts as an OAuth client to the external provider (Proxy/Gateway)
+ * - Implements "Callback Mode":
+ *   1. Client -> MCP (Authorize) -> MCP redirects to Provider (with MCP callback URL)
+ *   2. Provider -> MCP (Callback) -> MCP exchanges code for tokens
+ *   3. MCP redirects to Client (with Internal Code)
+ *   4. Client -> MCP (Token) -> MCP returns stored tokens
+ */
+import { Request, Response } from 'express';
+import type { OAuthServerProvider, AuthorizationParams } from '@modelcontextprotocol/sdk/server/auth/provider.js';
+import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
+import type { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from '@modelcontextprotocol/sdk/shared/auth.js';
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+import type { OAuthConfig } from '../types/profile.js';
+import type { Logger } from '../core/logger.js';
+/**
+ * In-memory store for OAuth client registrations
+ */
+export declare class InMemoryClientsStore implements OAuthRegisteredClientsStore {
+    private clients;
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(clientMetadata: OAuthClientInformationFull): Promise<OAuthClientInformationFull>;
+}
+/**
+ * OAuth Provider Adapter for external OAuth servers
+ */
+export declare class ExternalOAuthProvider implements OAuthServerProvider {
+    private config;
+    private logger;
+    private _clientsStore;
+    private authorizationCodes;
+    private accessTokens;
+    private stateStore;
+    private endpointsInitialized;
+    private initializationPromise;
+    constructor(config: OAuthConfig, logger: Logger);
+    /**
+     * Lazy initialization of OAuth endpoints (async)
+     * Public method to allow HttpTransport to ensure initialization before client validation
+     */
+    ensureEndpointsInitialized(): Promise<void>;
+    get clientsStore(): OAuthRegisteredClientsStore;
+    get authorizationEndpoint(): string | undefined;
+    get redirectUri(): string | undefined;
+    get scopes(): string[];
+    /**
+     * Fetch OAuth Authorization Server Metadata (RFC 8414)
+     */
+    private fetchOAuthMetadata;
+    /**
+     * Resolve environment variable references in OAuth config
+     */
+    private resolveEnvVars;
+    /**
+     * Derive OAuth endpoints from issuer if needed
+     */
+    private deriveEndpointsFromIssuer;
+    /**
+     * Check if redirect URI host is allowed
+     * Prevents open redirect vulnerabilities (CWE-601)
+     */
+    private isAllowedRedirectHost;
+    /**
+     * Match hostname against allowlist entry
+     *
+     * Supports:
+     * - Exact hostnames
+     * - Wildcard subdomains (*.example.com)
+     * - IPv4 exact matches
+     * - IPv4 CIDR ranges (e.g., 10.0.0.0/8)
+     * - IPv6 exact matches
+     * - IPv6 CIDR ranges (e.g., 2001:db8::/32)
+     */
+    private matchRedirectHost;
+    /**
+     * Check if IP address is within CIDR range
+     *
+     * Example: '192.168.1.50' matches '192.168.1.0/24'
+     *          '2001:db8::1' matches '2001:db8::/32'
+     */
+    private matchCIDR;
+    /**
+     * Convert IPv4 address to 32-bit integer
+     */
+    private ipv4ToInt;
+    /**
+     * Convert IPv6 address to 128-bit BigInt
+     */
+    private ipv6ToBigInt;
+    private ipv6Mask;
+    private stripIpv6Brackets;
+    /**
+     * Begin authorization flow
+     * Stores state and redirects to External Provider with MCP Callback URI
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Handle callback from External Provider
+     * Exchanges code for tokens and redirects to Client with Internal Code
+     */
+    handleCallback(req: Request, res: Response): Promise<void>;
+    /**
+     * Get code challenge for authorization code (Internal)
+     */
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    /**
+     * Exchange authorization code for access token (Internal)
+     */
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Exchange authorization code with external OAuth provider
+     */
+    private exchangeCodeWithProvider;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    private introspectToken;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    private revokeTokenWithProvider;
+    /**
+     * Cleanup expired states, codes, and tokens
+     * Called periodically by HttpTransport
+     */
+    cleanup(): void;
+}
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/src/auth/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EACV,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AACpG,OAAO,KAAK,EACV,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAIhD;;GAEG;AACH,qBAAa,oBAAqB,YAAW,2BAA2B;IACtE,OAAO,CAAC,OAAO,CAAiD;IAE1D,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC;IAI5E,cAAc,CAAC,cAAc,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC;CAItG;AAmCD;;GAEG;AACH,qBAAa,qBAAsB,YAAW,mBAAmB;IAC/D,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAuB;IAG5C,OAAO,CAAC,kBAAkB,CAA4C;IACtE,OAAO,CAAC,YAAY,CAAsC;IAC1D,OAAO,CAAC,UAAU,CAAyC;IAE3D,OAAO,CAAC,oBAAoB,CAAkB;IAC9C,OAAO,CAAC,qBAAqB,CAA8B;gBAE/C,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;IAuB/C;;;OAGG;IACU,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;IA6DxD,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED,IAAI,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAI9C;IAED,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED,IAAI,MAAM,IAAI,MAAM,EAAE,CAErB;IAED;;OAEG;YACW,kBAAkB;IAwBhC;;OAEG;IACH,OAAO,CAAC,cAAc;IA8BtB;;OAEG;YACW,yBAAyB;IAyCvC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAqB7B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAoBzB;;;;;OAKG;IACH,OAAO,CAAC,SAAS;IA+CjB;;OAEG;IACH,OAAO,CAAC,SAAS;IAmBjB;;OAEG;IACH,OAAO,CAAC,YAAY;IA6EpB,OAAO,CAAC,QAAQ;IAQhB,OAAO,CAAC,iBAAiB;IAIzB;;;OAGG;IACG,SAAS,CACb,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,mBAAmB,EAC3B,GAAG,EAAE,QAAQ,GACZ,OAAO,CAAC,IAAI,CAAC;IAyEhB;;;OAGG;IACG,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA8GhE;;OAEG;IACG,6BAA6B,CACjC,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAclB;;OAEG;IACG,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAkEvB;;OAEG;YACW,wBAAwB;IAkDhC,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA2DjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAwB3C,eAAe;IAmDvB,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;YAQF,uBAAuB;IA2BrC;;;OAGG;IACI,OAAO,IAAI,IAAI;CA0BvB"}