@dobbyai/mcp-external 1.0.3 → 1.1.0

package/dist/__tests__/workflow-tools.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Workflow Automation MCP Tools Tests — Phase 2 + Session 3 updates
+ *
+ * Tests for task classification, auto-assign with health check,
+ * dynamic agent mapping, workload monitoring, and assignment rules.
+ */
+export {};
+//# sourceMappingURL=workflow-tools.test.d.ts.map

package/dist/__tests__/workflow-tools.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-tools.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/workflow-tools.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/__tests__/workflow-tools.test.js

@@ -0,0 +1,268 @@
+/**
+ * Workflow Automation MCP Tools Tests — Phase 2 + Session 3 updates
+ *
+ * Tests for task classification, auto-assign with health check,
+ * dynamic agent mapping, workload monitoring, and assignment rules.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+// Mock DobbyClient with request method and tenantId
+const mockClient = {
+    apiUrl: 'http://localhost:3000',
+    apiKey: 'test-api-key',
+    tenantId: 'tenant_test123',
+    request: vi.fn(),
+};
+// Mock global fetch
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+// ============================================
+// Task Classification (Dynamic Agent Map)
+// ============================================
+describe('Workflow: Task Classification', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+        // Default: API unavailable — uses fallback defaults
+        mockClient.request.mockRejectedValue(new Error('Connection refused'));
+    });
+    it('classifies backend tasks correctly with markdown response', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Add new API endpoint for user management',
+            description: 'Create FastAPI route with pydantic validation',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('## Task Classification');
+        expect(text).toContain('**Category:** backend');
+        expect(text).toContain('**Worker:** dobby-backend-agent');
+        expect(text).toContain('### Next Steps');
+        expect(text).toContain('workflow_auto_assign');
+    });
+    it('classifies frontend tasks correctly', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Fix React component layout issue',
+            description: 'Update CSS with Tailwind for mobile responsiveness',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** frontend');
+        expect(text).toContain('**Worker:** dobby-frontend-agent');
+    });
+    it('classifies security tasks correctly', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Fix authentication vulnerability in OAuth flow',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** security');
+        expect(text).toContain('**Worker:** dobby-security-agent');
+    });
+    it('classifies database tasks correctly', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Create BigQuery migration for new table',
+            description: 'Add schema with partition by created_at',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** database');
+        expect(text).toContain('**Worker:** dobby-database-agent');
+    });
+    it('classifies testing tasks to QA lead coordinator', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Add pytest coverage for auth module',
+            description: 'Write vitest mock fixtures and e2e spec',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** testing');
+        expect(text).toContain('**Coordinator:** dobby-qa-lead-agent');
+        expect(text).toContain('**Worker:** dobby-test-writer-agent');
+    });
+    it('defaults to backend for unrecognized tasks', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Do something very generic',
+            description: 'This has no specific keywords at all',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** backend');
+        expect(text).toContain('**Confidence:** 30%');
+    });
+    it('uses dynamic agent map from API when available', async () => {
+        const { handleWorkflowClassifyTask } = await import('../tools/workflow.js');
+        mockClient.request.mockResolvedValueOnce({
+            data: {
+                agents: [
+                    { agent_id: 'custom-backend-v2', agent_layer: 'worker', group: 'dev' },
+                    { agent_id: 'custom-dev-lead', agent_layer: 'coordinator', group: 'dev' },
+                ],
+            },
+        });
+        const result = await handleWorkflowClassifyTask(mockClient, {
+            title: 'Add new API endpoint for user management',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Category:** backend');
+        // Should use dynamic coordinator from API
+        expect(text).toContain('**Coordinator:** custom-dev-lead');
+    });
+});
+// ============================================
+// Auto-Assign (API call + health check)
+// ============================================
+describe('Workflow: Auto-Assign', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+        mockClient.request.mockRejectedValue(new Error('Connection refused'));
+    });
+    it('calls API and returns markdown assignment result', async () => {
+        const { handleWorkflowAutoAssign } = await import('../tools/workflow.js');
+        // Health check call + auto-assign API call — both succeed
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({ agent_status: 'active' }),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({
+                task_id: 'task_abc123',
+                assigned_coordinator: 'dobby-dev-coordinator-agent',
+                assigned_worker: 'dobby-backend-agent',
+            }),
+        });
+        const result = await handleWorkflowAutoAssign(mockClient, {
+            task_id: 'task_abc123',
+            title: 'Add API endpoint',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('## Auto-Assignment Result');
+        expect(text).toContain('**Status:** assigned');
+    });
+    it('returns local classification as fallback when API unavailable', async () => {
+        const { handleWorkflowAutoAssign } = await import('../tools/workflow.js');
+        // All fetch calls fail (health check + auto-assign API)
+        mockFetch.mockRejectedValue(new Error('Connection refused'));
+        const result = await handleWorkflowAutoAssign(mockClient, {
+            task_id: 'task_abc123',
+            title: 'Fix security vulnerability in authentication',
+        });
+        expect(result.isError).toBeUndefined();
+        const text = result.content[0].text;
+        expect(text).toContain('**Status:** suggestion_only');
+        expect(text).toContain('**Category:** security');
+        expect(text).toContain('**Worker:** dobby-security-agent');
+    });
+    it('shows health warning when agent is paused', async () => {
+        const { handleWorkflowAutoAssign } = await import('../tools/workflow.js');
+        // Health check returns paused status
+        mockFetch
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({ agent_status: 'paused' }),
+        })
+            // Auto-assign API call
+            .mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({ task_id: 'task_abc123', assigned: true }),
+        });
+        const result = await handleWorkflowAutoAssign(mockClient, {
+            task_id: 'task_abc123',
+            title: 'Add API endpoint for backend',
+        });
+        const text = result.content[0].text;
+        expect(text).toContain('**Health Warning:**');
+        expect(text).toContain('paused');
+    });
+    it('returns error when API returns non-ok response', async () => {
+        const { handleWorkflowAutoAssign } = await import('../tools/workflow.js');
+        // Health check fails (no problem)
+        mockFetch
+            .mockRejectedValueOnce(new Error('Health unavailable'))
+            // Auto-assign API returns 404
+            .mockResolvedValueOnce({
+            ok: false,
+            status: 404,
+            text: () => Promise.resolve('Task not found'),
+        });
+        const result = await handleWorkflowAutoAssign(mockClient, {
+            task_id: 'task_nonexistent',
+            title: 'Some task',
+        });
+        expect(result.isError).toBe(true);
+        const text = result.content[0].text;
+        expect(text).toContain('**Status:** error');
+        expect(text).toContain('### Error');
+    });
+});
+// ============================================
+// Agent Workload
+// ============================================
+describe('Workflow: Agent Workload', () => {
+    beforeEach(() => {
+        vi.resetAllMocks();
+        mockClient.request.mockRejectedValue(new Error('Connection refused'));
+    });
+    it('returns workload data from API', async () => {
+        const { handleWorkflowAgentWorkload } = await import('../tools/workflow.js');
+        mockFetch.mockResolvedValueOnce({
+            ok: true,
+            json: () => Promise.resolve({
+                agents: [
+                    { agent_id: 'dobby-backend-agent', active_tasks: 2 },
+                    { agent_id: 'dobby-frontend-agent', active_tasks: 0 },
+                ],
+            }),
+        });
+        const result = await handleWorkflowAgentWorkload(mockClient, {});
+        const data = JSON.parse(result.content[0].text);
+        expect(data.agents).toHaveLength(2);
+    });
+    it('returns dynamic agent hierarchy as fallback when API unavailable', async () => {
+        const { handleWorkflowAgentWorkload } = await import('../tools/workflow.js');
+        mockFetch.mockRejectedValueOnce(new Error('Connection refused'));
+        const result = await handleWorkflowAgentWorkload(mockClient, {});
+        const data = JSON.parse(result.content[0].text);
+        expect(data.note).toContain('Could not reach Dobby API');
+        expect(data.agents).toBeDefined();
+        expect(data.agents.length).toBeGreaterThan(0);
+        expect(data.agents.some((a) => a.category === 'backend')).toBe(true);
+        expect(data.agents.some((a) => a.category === 'security')).toBe(true);
+    });
+});
+// ============================================
+// Input Validation
+// ============================================
+describe('Workflow: Input Validation', () => {
+    it('auto_assign task_id has pattern validation', async () => {
+        const { workflowTools } = await import('../tools/workflow.js');
+        const autoAssignSchema = workflowTools.workflow_auto_assign.inputSchema;
+        expect(autoAssignSchema.properties.task_id.pattern).toBe('^task_[a-zA-Z0-9_-]+$');
+    });
+});
+// ============================================
+// Tool Registration
+// ============================================
+describe('Workflow: Tool Registration', () => {
+    it('all workflow tools are in allTools', async () => {
+        const { allTools } = await import('../tools/index.js');
+        expect(allTools.workflow_classify_task).toBeDefined();
+        expect(allTools.workflow_auto_assign).toBeDefined();
+        expect(allTools.workflow_agent_workload).toBeDefined();
+        expect(allTools.workflow_assignment_rules).toBeDefined();
+    });
+    it('workflow tools have correct schemas', async () => {
+        const { workflowTools } = await import('../tools/workflow.js');
+        for (const [name, tool] of Object.entries(workflowTools)) {
+            expect(tool.name).toBe(name);
+            expect(tool.description).toBeTruthy();
+            expect(tool.inputSchema.type).toBe('object');
+            expect(tool.inputSchema.properties).toBeDefined();
+        }
+    });
+    it('total tool count includes workflow tools', async () => {
+        const { allTools } = await import('../tools/index.js');
+        const toolCount = Object.keys(allTools).length;
+        expect(toolCount).toBeGreaterThanOrEqual(54);
+    });
+});
+//# sourceMappingURL=workflow-tools.test.js.map

package/dist/__tests__/workflow-tools.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-tools.test.js","sourceRoot":"","sources":["../../src/__tests__/workflow-tools.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE9D,oDAAoD;AACpD,MAAM,UAAU,GAAG;IACjB,MAAM,EAAE,uBAAuB;IAC/B,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,gBAAgB;IAC1B,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;CACV,CAAC;AAET,oBAAoB;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,+CAA+C;AAC/C,0CAA0C;AAC1C,+CAA+C;AAE/C,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,oDAAoD;QACpD,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,0CAA0C;YACjD,WAAW,EAAE,+CAA+C;SAC7D,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,oDAAoD;SAClE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,gDAAgD;SACxD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,yCAAyC;SACvD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,qCAAqC;YAC5C,WAAW,EAAE,yCAAyC;SACvD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,sCAAsC;SACpD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE5E,UAAU,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACvC,IAAI,EAAE;gBACJ,MAAM,EAAE;oBACN,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE;oBACtE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE;iBAC1E;aACF;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,UAAU,EAAE;YAC1D,KAAK,EAAE,0CAA0C;SAClD,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAChD,0CAA0C;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+CAA+C;AAC/C,wCAAwC;AACxC,+CAA+C;AAE/C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE1E,0DAA0D;QAC1D,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;aACD,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1B,OAAO,EAAE,aAAa;gBACtB,oBAAoB,EAAE,6BAA6B;gBACnD,eAAe,EAAE,qBAAqB;aACvC,CAAC;SACH,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE;YACxD,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,kBAAkB;SAC1B,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE1E,wDAAwD;QACxD,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE;YACxD,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,8CAA8C;SACtD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE1E,qCAAqC;QACrC,SAAS;aACN,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;SACxD,CAAC;YACF,uBAAuB;aACtB,qBAAqB,CAAC;YACrB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;SACxE,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE;YACxD,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,8BAA8B;SACtC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE1E,kCAAkC;QAClC,SAAS;aACN,qBAAqB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACvD,8BAA8B;aAC7B,qBAAqB,CAAC;YACrB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,UAAU,EAAE;YACxD,OAAO,EAAE,kBAAkB;YAC3B,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+CAA+C;AAC/C,iBAAiB;AACjB,+CAA+C;AAE/C,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE7E,SAAS,CAAC,qBAAqB,CAAC;YAC9B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1B,MAAM,EAAE;oBACN,EAAE,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,EAAE;oBACpD,EAAE,QAAQ,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,EAAE;iBACtD;aACF,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE7E,SAAS,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+CAA+C;AAC/C,mBAAmB;AACnB,+CAA+C;AAE/C,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE/D,MAAM,gBAAgB,GAAG,aAAa,CAAC,oBAAoB,CAAC,WAAW,CAAC;QACxE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,+CAA+C;AAC/C,oBAAoB;AACpB,+CAA+C;AAE/C,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAEvD,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,CAAC;QACtD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAE/D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/oauth-provider.d.ts

@@ -0,0 +1,34 @@
+/**
+ * OAuth Proxy Provider
+ *
+ * Creates a ProxyOAuthServerProvider that delegates all OAuth operations
+ * to the web app (dobby-ai.com). The MCP server never stores tokens or
+ * client registrations — it only proxies.
+ *
+ * Flow:
+ *   Claude Code → MCP server (proxy) → Web app OAuth endpoints
+ */
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
+import { TokenVerifier } from './token-verifier.js';
+export interface OAuthProviderConfig {
+    /** Web app base URL where OAuth endpoints live (e.g. https://dobby-ai.com) */
+    issuerUrl: string;
+    /** MCP server public URL (e.g. https://mcp.dobby-ai.com) */
+    mcpPublicUrl: string;
+}
+/**
+ * Create a ProxyOAuthServerProvider that delegates to the web app.
+ *
+ * The provider:
+ * - Redirects /authorize to web app's /oauth/authorize
+ * - Proxies /token to web app's /oauth/token
+ * - Proxies /revoke to web app's /oauth/revoke
+ * - Proxies /register to web app's /oauth/register
+ * - Verifies tokens via TokenVerifier (with 60s LRU cache)
+ * - Fetches client info from web app's /oauth/register/:clientId
+ */
+export declare function createOAuthProvider(config: OAuthProviderConfig): {
+    provider: ProxyOAuthServerProvider;
+    tokenVerifier: TokenVerifier;
+};
+//# sourceMappingURL=oauth-provider.d.ts.map

package/dist/auth/oauth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAE5G,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAMpD,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IAChE,QAAQ,EAAE,wBAAwB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;CAC9B,CAoDA"}

package/dist/auth/oauth-provider.js

@@ -0,0 +1,75 @@
+/**
+ * OAuth Proxy Provider
+ *
+ * Creates a ProxyOAuthServerProvider that delegates all OAuth operations
+ * to the web app (dobby-ai.com). The MCP server never stores tokens or
+ * client registrations — it only proxies.
+ *
+ * Flow:
+ *   Claude Code → MCP server (proxy) → Web app OAuth endpoints
+ */
+import { ProxyOAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/providers/proxyProvider.js';
+import { TokenVerifier } from './token-verifier.js';
+// ============================================
+// Create Provider
+// ============================================
+/**
+ * Create a ProxyOAuthServerProvider that delegates to the web app.
+ *
+ * The provider:
+ * - Redirects /authorize to web app's /oauth/authorize
+ * - Proxies /token to web app's /oauth/token
+ * - Proxies /revoke to web app's /oauth/revoke
+ * - Proxies /register to web app's /oauth/register
+ * - Verifies tokens via TokenVerifier (with 60s LRU cache)
+ * - Fetches client info from web app's /oauth/register/:clientId
+ */
+export function createOAuthProvider(config) {
+    const { issuerUrl } = config;
+    const baseOAuthUrl = issuerUrl.replace(/\/$/, '');
+    // Token verifier with LRU cache
+    const tokenVerifier = new TokenVerifier(issuerUrl);
+    const provider = new ProxyOAuthServerProvider({
+        endpoints: {
+            authorizationUrl: `${baseOAuthUrl}/oauth/authorize`,
+            tokenUrl: `${baseOAuthUrl}/oauth/token`,
+            revocationUrl: `${baseOAuthUrl}/oauth/revoke`,
+            registrationUrl: `${baseOAuthUrl}/oauth/register`,
+        },
+        /**
+         * Verify access token — called by requireBearerAuth middleware.
+         * Uses LRU cache (60s TTL) for performance.
+         */
+        verifyAccessToken: async (token) => {
+            return tokenVerifier.verifyAccessToken(token);
+        },
+        /**
+         * Fetch client information from the web app.
+         * Called during OAuth flow to validate client_id.
+         */
+        getClient: async (clientId) => {
+            try {
+                const response = await fetch(`${baseOAuthUrl}/oauth/register/${clientId}`, {
+                    method: 'GET',
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+                if (!response.ok) {
+                    if (response.status === 404)
+                        return undefined;
+                    console.error(`[OAuth] Failed to fetch client ${clientId}: ${response.status}`);
+                    return undefined;
+                }
+                return await response.json();
+            }
+            catch (error) {
+                const msg = error instanceof Error ? error.message : 'Unknown error';
+                console.error(`[OAuth] Error fetching client ${clientId}:`, msg);
+                return undefined;
+            }
+        },
+    });
+    return { provider, tokenVerifier };
+}
+//# sourceMappingURL=oauth-provider.js.map

package/dist/auth/oauth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider.js","sourceRoot":"","sources":["../../src/auth/oauth-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAE5G,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAapD,+CAA+C;AAC/C,kBAAkB;AAClB,+CAA+C;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAI7D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC7B,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAElD,gCAAgC;IAChC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC;QAC5C,SAAS,EAAE;YACT,gBAAgB,EAAE,GAAG,YAAY,kBAAkB;YACnD,QAAQ,EAAE,GAAG,YAAY,cAAc;YACvC,aAAa,EAAE,GAAG,YAAY,eAAe;YAC7C,eAAe,EAAE,GAAG,YAAY,iBAAiB;SAClD;QAED;;;WAGG;QACH,iBAAiB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;YACzC,OAAO,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAED;;;WAGG;QACH,SAAS,EAAE,KAAK,EAAE,QAAgB,EAAmD,EAAE;YACrF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,mBAAmB,QAAQ,EAAE,EAAE;oBACzE,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;qBACnC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;wBAAE,OAAO,SAAS,CAAC;oBAC9C,OAAO,CAAC,KAAK,CAAC,kCAAkC,QAAQ,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAChF,OAAO,SAAS,CAAC;gBACnB,CAAC;gBAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAgC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;gBACjE,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AACrC,CAAC"}

package/dist/auth/token-verifier.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Token Verifier
+ *
+ * Validates OAuth access tokens (dobby_at_*) by calling the web app's
+ * token validation endpoint. Results are cached locally with 60s TTL
+ * to avoid per-request latency.
+ */
+import { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+export interface TokenInfo {
+    user_id: string;
+    org_id: string;
+    tenant_id: string;
+    scope: string;
+    client_id: string;
+    expires_at?: number;
+}
+export declare class TokenVerifier {
+    private cache;
+    private issuerUrl;
+    constructor(issuerUrl: string);
+    /**
+     * Verify an access token and return AuthInfo for the MCP SDK.
+     * Uses LRU cache with 60s TTL.
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Get the resolved tenant context from a cached token.
+     * Returns undefined if token is not cached (call verifyAccessToken first).
+     */
+    getTokenInfo(token: string): TokenInfo | undefined;
+    /**
+     * Validate token against the web app's OAuth introspection endpoint.
+     */
+    private validateRemote;
+    /** Clear the token cache (for testing) */
+    clearCache(): void;
+    /** Get cache size (for monitoring) */
+    get cacheSize(): number;
+}
+//# sourceMappingURL=token-verifier.d.ts.map

package/dist/auth/token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAM1E,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAyDD,qBAAa,aAAa;IACxB,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,SAAS,CAAS;gBAEd,SAAS,EAAE,MAAM;IAK7B;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgCzD;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIlD;;OAEG;YACW,cAAc;IAgD5B,0CAA0C;IAC1C,UAAU,IAAI,IAAI;IAIlB,sCAAsC;IACtC,IAAI,SAAS,IAAI,MAAM,CAEtB;CACF"}

package/dist/auth/token-verifier.js

@@ -0,0 +1,138 @@
+/**
+ * Token Verifier
+ *
+ * Validates OAuth access tokens (dobby_at_*) by calling the web app's
+ * token validation endpoint. Results are cached locally with 60s TTL
+ * to avoid per-request latency.
+ */
+// ============================================
+// LRU Cache
+// ============================================
+const CACHE_TTL_MS = 60_000; // 60 seconds
+const CACHE_MAX_SIZE = 1000;
+class TokenCache {
+    cache = new Map();
+    get(token) {
+        const entry = this.cache.get(token);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.cache.delete(token);
+            return undefined;
+        }
+        // Move to end (LRU)
+        this.cache.delete(token);
+        this.cache.set(token, entry);
+        return entry;
+    }
+    set(token, entry) {
+        // Evict oldest if at capacity
+        if (this.cache.size >= CACHE_MAX_SIZE) {
+            const firstKey = this.cache.keys().next().value;
+            if (firstKey !== undefined) {
+                this.cache.delete(firstKey);
+            }
+        }
+        this.cache.set(token, entry);
+    }
+    clear() {
+        this.cache.clear();
+    }
+    get size() {
+        return this.cache.size;
+    }
+}
+// ============================================
+// Token Verifier
+// ============================================
+export class TokenVerifier {
+    cache = new TokenCache();
+    issuerUrl;
+    constructor(issuerUrl) {
+        // Remove trailing slash
+        this.issuerUrl = issuerUrl.replace(/\/$/, '');
+    }
+    /**
+     * Verify an access token and return AuthInfo for the MCP SDK.
+     * Uses LRU cache with 60s TTL.
+     */
+    async verifyAccessToken(token) {
+        // Check cache first
+        const cached = this.cache.get(token);
+        if (cached) {
+            return cached.authInfo;
+        }
+        // Validate against web app
+        const tokenInfo = await this.validateRemote(token);
+        const authInfo = {
+            token,
+            clientId: tokenInfo.client_id,
+            scopes: tokenInfo.scope ? tokenInfo.scope.split(' ') : [],
+            expiresAt: tokenInfo.expires_at,
+            extra: {
+                user_id: tokenInfo.user_id,
+                org_id: tokenInfo.org_id,
+                tenant_id: tokenInfo.tenant_id,
+            },
+        };
+        // Cache the result
+        this.cache.set(token, {
+            authInfo,
+            tokenInfo,
+            expiresAt: Date.now() + CACHE_TTL_MS,
+        });
+        return authInfo;
+    }
+    /**
+     * Get the resolved tenant context from a cached token.
+     * Returns undefined if token is not cached (call verifyAccessToken first).
+     */
+    getTokenInfo(token) {
+        return this.cache.get(token)?.tokenInfo;
+    }
+    /**
+     * Validate token against the web app's OAuth introspection endpoint.
+     */
+    async validateRemote(token) {
+        const url = `${this.issuerUrl}/oauth/token/introspect`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${token}`,
+            },
+            body: JSON.stringify({ token }),
+        });
+        if (!response.ok) {
+            const status = response.status;
+            if (status === 401 || status === 403) {
+                throw new Error('Invalid or expired access token');
+            }
+            throw new Error(`Token validation failed (${status})`);
+        }
+        const data = await response.json();
+        if (!data.active) {
+            throw new Error('Token is not active');
+        }
+        if (!data.org_id || !data.tenant_id) {
+            throw new Error('Token missing org_id or tenant_id — cannot resolve tenant context');
+        }
+        return {
+            user_id: data.user_id || '',
+            org_id: data.org_id,
+            tenant_id: data.tenant_id,
+            scope: data.scope || '',
+            client_id: data.client_id || '',
+            expires_at: data.exp,
+        };
+    }
+    /** Clear the token cache (for testing) */
+    clearCache() {
+        this.cache.clear();
+    }
+    /** Get cache size (for monitoring) */
+    get cacheSize() {
+        return this.cache.size;
+    }
+}
+//# sourceMappingURL=token-verifier.js.map

package/dist/auth/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../src/auth/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH,+CAA+C;AAC/C,YAAY;AACZ,+CAA+C;AAE/C,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,aAAa;AAC1C,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,UAAU;IACN,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE9C,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,KAAa,EAAE,KAAiB;QAClC,8BAA8B;QAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAED,+CAA+C;AAC/C,iBAAiB;AACjB,+CAA+C;AAE/C,MAAM,OAAO,aAAa;IAChB,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IACzB,SAAS,CAAS;IAE1B,YAAY,SAAiB;QAC3B,wBAAwB;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,2BAA2B;QAC3B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAa;YACzB,KAAK;YACL,QAAQ,EAAE,SAAS,CAAC,SAAS;YAC7B,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACzD,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,KAAK,EAAE;gBACL,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC;QAEF,mBAAmB;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;YACpB,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;SACrC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC1C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,yBAAyB,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,KAAK,EAAE;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAQ/B,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,UAAU,EAAE,IAAI,CAAC,GAAG;SACrB,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF"}

package/dist/http-server.d.ts

@@ -0,0 +1,35 @@
+/**
+ * HTTP Server for Dobby MCP
+ *
+ * Express app serving MCP over Streamable HTTP transport with OAuth 2.1 auth.
+ * Runs alongside the existing STDIO mode — selected via --transport http.
+ *
+ * Endpoints:
+ *   GET  /.well-known/oauth-authorization-server — OAuth metadata (via mcpAuthRouter)
+ *   GET  /authorize — Redirect to web app consent page (via mcpAuthRouter)
+ *   POST /token — Token exchange proxy (via mcpAuthRouter)
+ *   POST /register — Dynamic client registration proxy (via mcpAuthRouter)
+ *   POST /revoke — Token revocation proxy (via mcpAuthRouter)
+ *   POST /mcp — Streamable HTTP MCP endpoint (Bearer auth required)
+ *   GET  /mcp — SSE stream for Streamable HTTP (Bearer auth required)
+ *   DELETE /mcp — Session termination (Bearer auth required)
+ *   GET  /health — Health check (no auth)
+ */
+import express from 'express';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { TokenVerifier } from './auth/token-verifier.js';
+export interface HttpServerConfig {
+    /** Port to listen on (default: 8080) */
+    port: number;
+    /** Web app base URL where OAuth endpoints live */
+    issuerUrl: string;
+    /** MCP server public URL */
+    mcpPublicUrl: string;
+    /** Factory to create a connected MCP Server for each session */
+    createMcpServer: () => Promise<Server>;
+}
+export declare function startHttpServer(config: HttpServerConfig): Promise<{
+    app: express.Express;
+    tokenVerifier: TokenVerifier;
+}>;
+//# sourceMappingURL=http-server.d.ts.map

package/dist/http-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAM9D,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACxC;AAaD,wBAAsB,eAAe,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;IACvE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;IACrB,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC,CAoKD"}