@elnora-ai/mcp-server 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to the Elnora MCP Server will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.4.0](https://github.com/Elnora-AI/elnora-mcp-server/compare/mcp-server-v0.3.0...mcp-server-v0.4.0) (2026-03-06)
+
+
+### Features
+
+* add API key auth, expand tool coverage, and harden security ([#11](https://github.com/Elnora-AI/elnora-mcp-server/issues/11)) ([3d51d39](https://github.com/Elnora-AI/elnora-mcp-server/commit/3d51d393b800f80f2489a5d49223015948f5b559))
+
+## [0.3.0](https://github.com/Elnora-AI/elnora-mcp-server/compare/mcp-server-v0.2.0...mcp-server-v0.3.0) (2026-03-05)
+
+
+### Features
+
+* add release-please for automatic changelog and npm publishing ([#9](https://github.com/Elnora-AI/elnora-mcp-server/issues/9)) ([3812bc2](https://github.com/Elnora-AI/elnora-mcp-server/commit/3812bc22cdfb832710d947895209b98aba178570))
+* **auth:** OAuth 2.1 proxy AS with SDK v1.27 ([#5](https://github.com/Elnora-AI/elnora-mcp-server/issues/5)) ([4151229](https://github.com/Elnora-AI/elnora-mcp-server/commit/41512290fa1c1690adeb08a32040c78fd712e175))
+* initial release of Elnora MCP Server ([a9a17f9](https://github.com/Elnora-AI/elnora-mcp-server/commit/a9a17f90a127aec7c98f62d43549a33a60ce893e))
+* prepare for MCP Registry registration ([#2](https://github.com/Elnora-AI/elnora-mcp-server/issues/2)) ([3ecf8fc](https://github.com/Elnora-AI/elnora-mcp-server/commit/3ecf8fc803b1b7dba4333faf5eca44766cc70c6a))
+
+
+### Bug Fixes
+
+* **ci:** re-add --provenance flag now that repo is public ([9da065b](https://github.com/Elnora-AI/elnora-mcp-server/commit/9da065bbd52859bd969f00c8604d596e2a889976))
+* **ci:** remove --provenance flag for private repo npm publish ([325d405](https://github.com/Elnora-AI/elnora-mcp-server/commit/325d4051ae19a760d0a84bcd3cf321ea8e802b30))
+* **ci:** skip CodeQL on private repos ([abdf017](https://github.com/Elnora-AI/elnora-mcp-server/commit/abdf017fb229c84a7f07c5d1a3e235c5ad7f1d93))
+* **docs:** correct MCP transport type in client setup instructions ([#4](https://github.com/Elnora-AI/elnora-mcp-server/issues/4)) ([191128a](https://github.com/Elnora-AI/elnora-mcp-server/commit/191128a0d609b2199520145bc8f0d2e7415d3ee0))
+* raise limits for real-world usage, add MCP spec-compliant 405 handlers ([#6](https://github.com/Elnora-AI/elnora-mcp-server/issues/6)) ([05c393c](https://github.com/Elnora-AI/elnora-mcp-server/commit/05c393cd7ce3c6a09962572dfb97e349b643806d))
+* use correct transport type key in server.json remotes ([#3](https://github.com/Elnora-AI/elnora-mcp-server/issues/3)) ([518fc62](https://github.com/Elnora-AI/elnora-mcp-server/commit/518fc62093cfa294950c8b1a0abc450aca6b4a49))
+
 ## [Unreleased]
 
 ## [0.1.0] - 2026-02-27

package/dist/auth/clients-store.d.ts

@@ -7,6 +7,7 @@ import { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/aut
  */
 export declare class InMemoryClientsStore implements OAuthRegisteredClientsStore {
     private clients;
+    constructor();
     getClient(clientId: string): OAuthClientInformationFull | undefined;
     registerClient(client: Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at">): OAuthClientInformationFull;
 }

package/dist/auth/clients-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients-store.d.ts","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAGtF;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,2BAA2B;IACtE,OAAO,CAAC,OAAO,CAAiD;IAEhE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAYnE,cAAc,CACZ,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC5E,0BAA0B;CAgB9B"}
+{"version":3,"file":"clients-store.d.ts","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AAGtF;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,2BAA2B;IACtE,OAAO,CAAC,OAAO,CAAiD;;IAchE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS;IAanE,cAAc,CACZ,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC5E,0BAA0B;CAgB9B"}

package/dist/auth/clients-store.js

@@ -7,12 +7,24 @@ import { CLIENT_SECRET_TTL_SECONDS } from "../constants.js";
  */
 export class InMemoryClientsStore {
     clients = new Map();
+    constructor() {
+        // Periodically evict expired clients to prevent unbounded memory growth
+        setInterval(() => {
+            const now = Math.floor(Date.now() / 1000);
+            for (const [id, client] of this.clients) {
+                if (client.client_secret_expires_at && client.client_secret_expires_at < now) {
+                    this.clients.delete(id);
+                }
+            }
+        }, CLIENT_SECRET_TTL_SECONDS * 1000 / 10).unref(); // Run ~every 9 days
+    }
     getClient(clientId) {
         const client = this.clients.get(clientId);
         if (!client)
             return undefined;
-        // Check secret expiration (per SDK docs: don't delete, just check)
+        // Check secret expiration
         if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
+            this.clients.delete(clientId);
             return undefined;
         }
         return client;

package/dist/auth/clients-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients-store.js","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEhE,SAAS,CAAC,QAAgB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,mEAAmE;QACnE,IAAI,MAAM,CAAC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACvG,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CACZ,MAA6E;QAE7E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,UAAU,GAA+B;YAC7C,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,YAAY;YAC3B,wBAAwB,EAAE,GAAG,GAAG,yBAAyB;SAC1D,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"clients-store.js","sourceRoot":"","sources":["../../src/auth/clients-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACvB,OAAO,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEhE;QACE,wEAAwE;QACxE,WAAW,CAAC,GAAG,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,GAAG,GAAG,EAAE,CAAC;oBAC7E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC,EAAE,yBAAyB,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,oBAAoB;IACzE,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,0BAA0B;QAC1B,IAAI,MAAM,CAAC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACvG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CACZ,MAA6E;QAE7E,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,UAAU,GAA+B;YAC7C,GAAG,MAAM;YACT,SAAS,EAAE,QAAQ;YACnB,mBAAmB,EAAE,GAAG;YACxB,aAAa,EAAE,YAAY;YAC3B,wBAAwB,EAAE,GAAG,GAAG,yBAAyB;SAC1D,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}

package/dist/auth/provider.d.ts

@@ -4,29 +4,12 @@ import { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/au
 import { OAuthClientInformationFull, OAuthTokens, OAuthTokenRevocationRequest } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import { ElnoraConfig } from "../types.js";
-/**
- * OAuth 2.1 provider that proxies to the Elnora platform auth system.
- *
- * Flow:
- * 1. MCP client calls /authorize → provider redirects to Elnora platform login
- * 2. User authenticates on platform → platform redirects back with platform auth code
- * 3. MCP server exchanges platform code for platform token
- * 4. MCP server issues its own access + refresh tokens, mapped to the platform token
- * 5. On token validation, the provider checks its own token store and validates
- *    the underlying platform token hasn't been revoked
- *
- * CoSAI controls:
- * - MCP-T1: PKCE S256 mandatory (handled by SDK)
- * - MCP-T1: No token passthrough — MCP tokens are separate from platform tokens
- * - MCP-T7: Short-lived access tokens (1h), refresh token rotation
- * - MCP-T9: Audience binding via resource parameter
- * - MCP-T12: Auth event logging
- */
 export declare class ElnoraOAuthProvider implements OAuthServerProvider {
     private _clientsStore;
     private authSessions;
     private tokenRecords;
     private refreshTokenIndex;
+    private validationCache;
     private config;
     constructor(config: ElnoraConfig);
     get clientsStore(): OAuthRegisteredClientsStore;
@@ -37,7 +20,7 @@ export declare class ElnoraOAuthProvider implements OAuthServerProvider {
      */
     authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
     challengeForAuthorizationCode(_client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
-    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, _redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
     exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
     verifyAccessToken(token: string): Promise<AuthInfo>;
     revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;

package/dist/auth/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAqC,MAAM,aAAa,CAAC;AAQ9E;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,mBAAoB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,YAAY;IAKhC,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BxG,6BAA6B,CACjC,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAoCjB,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA0BjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAyCnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IAwBhB;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAmBnE;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAc7C,OAAO,CAAC,WAAW;CAwCpB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAC7G,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,2BAA2B,EAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAqC,MAAM,aAAa,CAAC;AA8B9E,qBAAa,mBAAoB,YAAW,mBAAmB;IAC7D,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,eAAe,CAA6B;IACpD,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,YAAY;IAKhC,IAAI,YAAY,IAAI,2BAA2B,CAE9C;IAED;;;;OAIG;IACG,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BxG,6BAA6B,CACjC,OAAO,EAAE,0BAA0B,EACnC,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC;IAQZ,yBAAyB,CAC7B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IA8CjB,oBAAoB,CACxB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACb,OAAO,CAAC,WAAW,CAAC;IAsCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAgEnD,WAAW,CACf,MAAM,EAAE,0BAA0B,EAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAYnE;;OAEG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAc7C,OAAO,CAAC,WAAW;CAyCpB"}

package/dist/auth/provider.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import axios from "axios";
 import { InMemoryClientsStore } from "./clients-store.js";
+import { logAuthEvent } from "../middleware/tool-logging.js";
 import { ACCESS_TOKEN_TTL_SECONDS, REFRESH_TOKEN_TTL_SECONDS, AUTH_CODE_TTL_SECONDS, REQUEST_TIMEOUT_MS, } from "../constants.js";
 /**
  * OAuth 2.1 provider that proxies to the Elnora platform auth system.
@@ -20,11 +21,14 @@ import { ACCESS_TOKEN_TTL_SECONDS, REFRESH_TOKEN_TTL_SECONDS, AUTH_CODE_TTL_SECO
  * - MCP-T9: Audience binding via resource parameter
  * - MCP-T12: Auth event logging
  */
+/** TTL for platform token validation cache (seconds) */
+const VALIDATION_CACHE_TTL_SECONDS = 30;
 export class ElnoraOAuthProvider {
     _clientsStore;
     authSessions = new Map();
     tokenRecords = new Map();
     refreshTokenIndex = new Map(); // refreshToken -> accessToken
+    validationCache = new Map(); // accessToken -> validatedAt (epoch seconds)
     config;
     constructor(config) {
         this.config = config;
@@ -50,14 +54,14 @@ export class ElnoraOAuthProvider {
             resource: params.resource?.toString(),
             createdAt: Date.now(),
         });
-        // Schedule cleanup of expired sessions
-        setTimeout(() => this.authSessions.delete(authCode), AUTH_CODE_TTL_SECONDS * 1000);
+        // Schedule cleanup of expired sessions (unref so timer doesn't pin process)
+        setTimeout(() => this.authSessions.delete(authCode), AUTH_CODE_TTL_SECONDS * 1000).unref();
         // Redirect to Elnora platform login
         const loginUrl = new URL(this.config.loginUrl);
         loginUrl.searchParams.set("mcp_code", authCode);
         loginUrl.searchParams.set("redirect_uri", `${this.config.publicUrl}/oauth/callback`);
         loginUrl.searchParams.set("client_id", this.config.platformClientId);
-        console.error(`[auth] authorize: redirecting client ${client.client_id} to platform login`);
+        logAuthEvent("authorize_redirect", client.client_id);
         res.redirect(loginUrl.toString());
     }
     async challengeForAuthorizationCode(_client, authorizationCode) {
@@ -67,7 +71,7 @@ export class ElnoraOAuthProvider {
         }
         return session.codeChallenge;
     }
-    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, _redirectUri, resource) {
+    async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier, redirectUri, resource) {
         const session = this.authSessions.get(authorizationCode);
         if (!session) {
             throw new Error("Invalid or expired authorization code");
@@ -75,21 +79,29 @@ export class ElnoraOAuthProvider {
         if (session.clientId !== client.client_id) {
             throw new Error("Authorization code was not issued to this client");
         }
+        // Validate redirect_uri matches the one from the authorization request (RFC 6749 §4.1.3)
+        if (redirectUri && redirectUri !== session.redirectUri) {
+            logAuthEvent("redirect_uri_mismatch", client.client_id);
+            throw new Error("redirect_uri does not match the authorization request");
+        }
         // Delete the auth code — single use only
         this.authSessions.delete(authorizationCode);
+        if (!session.platformCode) {
+            throw new Error("Platform authentication not completed — user must authenticate on the platform first");
+        }
         // Exchange with Elnora platform for a platform token
         let platformToken;
         try {
             const response = await axios.post(this.config.tokenExchangeUrl, {
                 grant_type: "authorization_code",
-                code: session.platformCode || authorizationCode,
+                code: session.platformCode,
                 client_id: this.config.platformClientId,
                 client_secret: this.config.platformClientSecret,
             }, { timeout: REQUEST_TIMEOUT_MS });
             platformToken = response.data.access_token;
         }
         catch (error) {
-            console.error("[auth] platform token exchange failed:", error);
+            logAuthEvent("platform_token_exchange_failed", client.client_id, { error: String(error) });
             throw new Error("Failed to exchange authorization code with platform");
         }
         // Issue MCP tokens (separate from platform token — CoSAI MCP-T1)
@@ -104,10 +116,21 @@ export class ElnoraOAuthProvider {
         if (!record || record.clientId !== client.client_id) {
             throw new Error("Invalid refresh token");
         }
+        // Validate scope subset constraint (OAuth 2.1: refresh MUST NOT escalate scopes)
+        if (scopes && scopes.length > 0) {
+            const escalated = scopes.filter((s) => !record.scopes.includes(s));
+            if (escalated.length > 0) {
+                throw new Error(`Scope escalation not allowed. Requested scopes not in original grant: ${escalated.join(", ")}`);
+            }
+        }
         // Rotate: delete old tokens
         this.tokenRecords.delete(accessTokenKey);
         this.refreshTokenIndex.delete(refreshToken);
-        console.error(`[auth] refresh token rotation for client ${client.client_id}`);
+        this.validationCache.delete(accessTokenKey);
+        logAuthEvent("refresh_token_rotation", client.client_id, {
+            previousScopes: record.scopes,
+            requestedScopes: scopes || record.scopes,
+        });
         // Issue new tokens with the same platform token
         return this.issueTokens(client.client_id, scopes || record.scopes, record.platformToken, resource?.toString() || record.resource);
     }
@@ -118,23 +141,45 @@ export class ElnoraOAuthProvider {
         }
         if (record.expiresAt < Math.floor(Date.now() / 1000)) {
             this.tokenRecords.delete(token);
+            this.validationCache.delete(token);
             throw new Error("Access token expired");
         }
+        // Check validation cache — skip platform round-trip if recently validated
+        const now = Math.floor(Date.now() / 1000);
+        const cachedAt = this.validationCache.get(token);
+        if (cachedAt && (now - cachedAt) < VALIDATION_CACHE_TTL_SECONDS) {
+            return {
+                token,
+                clientId: record.clientId,
+                scopes: record.scopes,
+                expiresAt: record.expiresAt,
+                resource: record.resource ? new URL(record.resource) : undefined,
+                extra: { platformToken: record.platformToken },
+            };
+        }
         // Validate platform token is still valid
         try {
             const validation = await axios.post(this.config.tokenValidationUrl, { token: record.platformToken }, { timeout: REQUEST_TIMEOUT_MS });
             if (!validation.data.valid) {
                 this.tokenRecords.delete(token);
+                this.validationCache.delete(token);
                 throw new Error("Underlying platform token revoked");
             }
+            // Cache successful validation
+            this.validationCache.set(token, Math.floor(Date.now() / 1000));
         }
         catch (error) {
+            // Re-throw our own revocation errors (from the valid:false check above)
+            if (error instanceof Error && error.message === "Underlying platform token revoked") {
+                throw error;
+            }
             if (axios.isAxiosError(error) && error.response?.status === 401) {
                 this.tokenRecords.delete(token);
+                this.validationCache.delete(token);
                 throw new Error("Underlying platform token revoked");
             }
             // Network errors — don't invalidate, just log
-            console.error("[auth] platform token validation failed (non-fatal):", error);
+            logAuthEvent("platform_validation_network_error", record.clientId, { error: String(error) });
         }
         return {
             token,
@@ -152,7 +197,8 @@ export class ElnoraOAuthProvider {
         if (record && record.clientId === client.client_id) {
             this.refreshTokenIndex.delete(record.refreshToken);
             this.tokenRecords.delete(token);
-            console.error(`[auth] revoked access token for client ${client.client_id}`);
+            this.validationCache.delete(token);
+            logAuthEvent("access_token_revoked", client.client_id);
             return;
         }
         // Check if it's a refresh token
@@ -161,8 +207,9 @@ export class ElnoraOAuthProvider {
             const rec = this.tokenRecords.get(accessTokenKey);
             if (rec && rec.clientId === client.client_id) {
                 this.tokenRecords.delete(accessTokenKey);
+                this.validationCache.delete(accessTokenKey);
                 this.refreshTokenIndex.delete(token);
-                console.error(`[auth] revoked refresh token for client ${client.client_id}`);
+                logAuthEvent("refresh_token_revoked", client.client_id);
             }
         }
     }
@@ -177,13 +224,7 @@ export class ElnoraOAuthProvider {
         }
         // Store the platform code for later exchange
         session.platformCode = platformCode;
-        // Build the redirect back to the MCP client
-        const redirectUrl = new URL(session.redirectUri);
-        redirectUrl.searchParams.set("code", mcpCode);
-        if (session.state) {
-            redirectUrl.searchParams.set("state", session.state);
-        }
-        console.error(`[auth] platform callback: completing auth for client ${session.clientId}`);
+        logAuthEvent("platform_callback_completed", session.clientId);
     }
     /**
      * Get redirect URL for MCP client after platform callback.
@@ -221,8 +262,9 @@ export class ElnoraOAuthProvider {
         setTimeout(() => {
             this.tokenRecords.delete(accessToken);
             this.refreshTokenIndex.delete(refreshToken);
-        }, cleanupMs);
-        console.error(`[auth] issued tokens for client ${clientId} (expires ${new Date((now + ACCESS_TOKEN_TTL_SECONDS) * 1000).toISOString()})`);
+            this.validationCache.delete(accessToken);
+        }, cleanupMs).unref();
+        logAuthEvent("tokens_issued", clientId, { expiresAt: new Date((now + ACCESS_TOKEN_TTL_SECONDS) * 1000).toISOString() });
         return {
             access_token: accessToken,
             token_type: "Bearer",

package/dist/auth/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,mBAAmB;IACtB,aAAa,CAAuB;IACpC,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IAC7E,MAAM,CAAe;IAE7B,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE9D,mCAAmC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,uCAAuC;QACvC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC;QAEnF,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAC;QACrF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAErE,OAAO,CAAC,KAAK,CAAC,wCAAwC,MAAM,CAAC,SAAS,oBAAoB,CAAC,CAAC;QAC5F,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,OAAmC,EACnC,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,YAAqB,EACrB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE5C,qDAAqD;QACrD,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAC/B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAC5B;gBACE,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,iBAAiB;gBAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACvC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;aAChD,EACD,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE5C,OAAO,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAE9E,gDAAgD;QAChD,OAAO,IAAI,CAAC,WAAW,CACrB,MAAM,CAAC,SAAS,EAChB,MAAM,IAAI,MAAM,CAAC,MAAM,EACvB,MAAM,CAAC,aAAa,EACpB,QAAQ,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,QAAQ,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,EAC/B,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,8CAA8C;YAC9C,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,gCAAgC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,CAAC,KAAK,CAAC,0CAA0C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,OAAO,CAAC,KAAK,CAAC,2CAA2C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,OAAe,EAAE,YAAoB;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,6CAA6C;QAC7C,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QAEpC,4CAA4C;QAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,wDAAwD,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,CACjB,QAAgB,EAChB,MAAgB,EAChB,aAAqB,EACrB,QAAiB;QAEjB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAgB;YAC1B,WAAW;YACX,YAAY;YACZ,aAAa;YACb,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,GAAG,GAAG,wBAAwB;YACzC,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtD,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,OAAO,CAAC,KAAK,CAAC,mCAAmC,QAAQ,aAAa,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAE1I,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,wBAAwB;YACpC,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,KAAK,MAAM,OAAO,CAAC;AAS1B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;GAiBG;AACH,wDAAwD;AACxD,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAExC,MAAM,OAAO,mBAAmB;IACtB,aAAa,CAAuB;IACpC,YAAY,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,8BAA8B;IAC7E,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,6CAA6C;IAC1F,MAAM,CAAe;IAE7B,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAkC,EAAE,MAA2B,EAAE,GAAa;QAC5F,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE9D,mCAAmC;QACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE;YAC9B,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,4EAA4E;QAC5E,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAE3F,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAChD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,iBAAiB,CAAC,CAAC;QACrF,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAErE,YAAY,CAAC,oBAAoB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,OAAmC,EACnC,iBAAyB;QAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,MAAkC,EAClC,iBAAyB,EACzB,aAAsB,EACtB,WAAoB,EACpB,QAAc;QAEd,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,yFAAyF;QACzF,IAAI,WAAW,IAAI,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YACvD,YAAY,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC1G,CAAC;QAED,qDAAqD;QACrD,IAAI,aAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAC/B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAC5B;gBACE,UAAU,EAAE,oBAAoB;gBAChC,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBACvC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;aAChD,EACD,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,gCAAgC,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,iEAAiE;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,MAAkC,EAClC,YAAoB,EACpB,MAAiB,EACjB,QAAc;QAEd,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,iFAAiF;QACjF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,yEAAyE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAE5C,YAAY,CAAC,wBAAwB,EAAE,MAAM,CAAC,SAAS,EAAE;YACvD,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,eAAe,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM;SACzC,CAAC,CAAC;QAEH,gDAAgD;QAChD,OAAO,IAAI,CAAC,WAAW,CACrB,MAAM,CAAC,SAAS,EAChB,MAAM,IAAI,MAAM,CAAC,MAAM,EACvB,MAAM,CAAC,aAAa,EACpB,QAAQ,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC,QAAQ,CACxC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,0EAA0E;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,QAAQ,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,4BAA4B,EAAE,CAAC;YAChE,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;gBAChE,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;aAC/C,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,IAAI,CACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAC9B,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,EAC/B,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAChC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,8BAA8B;YAC9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,mCAAmC,EAAE,CAAC;gBACpF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;gBAChE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACvD,CAAC;YACD,8CAA8C;YAC9C,YAAY,CAAC,mCAAmC,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;YAChE,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAkC,EAClC,OAAoC;QAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5B,gCAAgC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,YAAY,CAAC,sBAAsB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACzC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC5C,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrC,YAAY,CAAC,uBAAuB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,OAAe,EAAE,YAAoB;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,6CAA6C;QAC7C,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;QAEpC,YAAY,CAAC,6BAA6B,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,OAAe;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACjD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAEO,WAAW,CACjB,QAAgB,EAChB,MAAgB,EAChB,aAAqB,EACrB,QAAiB;QAEjB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAgB;YAC1B,WAAW;YACX,YAAY;YACZ,aAAa;YACb,QAAQ;YACR,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,GAAG,GAAG,wBAAwB;YACzC,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtD,8FAA8F;QAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAyB,GAAG,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtB,YAAY,CAAC,eAAe,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAExH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,wBAAwB;YACpC,aAAa,EAAE,YAAY;SAC5B,CAAC;IACJ,CAAC;CACF"}

package/dist/constants.d.ts

@@ -1,11 +1,10 @@
 export declare const CHARACTER_LIMIT = 100000;
-export declare const DEFAULT_PAGE_SIZE = 50;
-export declare const MAX_PAGE_SIZE = 100;
 export declare const REQUEST_TIMEOUT_MS = 30000;
 export declare const LONG_REQUEST_TIMEOUT_MS = 120000;
 export declare const ACCESS_TOKEN_TTL_SECONDS = 3600;
 export declare const REFRESH_TOKEN_TTL_SECONDS: number;
 export declare const AUTH_CODE_TTL_SECONDS = 300;
 export declare const CLIENT_SECRET_TTL_SECONDS: number;
-export declare const SUPPORTED_SCOPES: readonly ["tasks:read", "tasks:write", "files:read", "files:write", "messages:read", "messages:write"];
+export declare const SUPPORTED_SCOPES: readonly ["tasks:read", "tasks:write", "files:read", "files:write", "messages:read", "messages:write", "projects:read", "projects:write", "search:read", "orgs:read", "orgs:write", "folders:read", "folders:write", "library:read", "library:write", "api-keys:read", "api-keys:write", "audit:read", "account:read", "account:write", "feedback:write"];
+export declare const ALL_SCOPES: string[];
 //# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,SAAU,CAAC;AACvC,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,aAAa,MAAM,CAAC;AACjC,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAG/C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAGxD,eAAO,MAAM,gBAAgB,wGAOnB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,SAAU,CAAC;AACvC,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAG/C,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AACxD,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,eAAO,MAAM,yBAAyB,QAAiB,CAAC;AAGxD,eAAO,MAAM,gBAAgB,2VAsBnB,CAAC;AAGX,eAAO,MAAM,UAAU,EAA4B,MAAM,EAAE,CAAC"}

package/dist/constants.js

@@ -1,6 +1,4 @@
 export const CHARACTER_LIMIT = 100_000;
-export const DEFAULT_PAGE_SIZE = 50;
-export const MAX_PAGE_SIZE = 100;
 export const REQUEST_TIMEOUT_MS = 30_000;
 export const LONG_REQUEST_TIMEOUT_MS = 120_000;
 // Auth constants
@@ -8,7 +6,7 @@ export const ACCESS_TOKEN_TTL_SECONDS = 3600; // 1 hour
 export const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 3600; // 30 days
 export const AUTH_CODE_TTL_SECONDS = 300; // 5 minutes
 export const CLIENT_SECRET_TTL_SECONDS = 90 * 24 * 3600; // 90 days
-// MCP scopes
+// MCP scopes — all supported scopes for OAuth clients
 export const SUPPORTED_SCOPES = [
     "tasks:read",
     "tasks:write",
@@ -16,5 +14,22 @@ export const SUPPORTED_SCOPES = [
     "files:write",
     "messages:read",
     "messages:write",
+    "projects:read",
+    "projects:write",
+    "search:read",
+    "orgs:read",
+    "orgs:write",
+    "folders:read",
+    "folders:write",
+    "library:read",
+    "library:write",
+    "api-keys:read",
+    "api-keys:write",
+    "audit:read",
+    "account:read",
+    "account:write",
+    "feedback:write",
 ];
+// All scopes — used for API key auth (API keys get full access)
+export const ALL_SCOPES = [...SUPPORTED_SCOPES];
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AACjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,iBAAiB;AACjB,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,CAAC,SAAS;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEnE,aAAa;AACb,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;CACR,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,iBAAiB;AACjB,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,CAAC,SAAS;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC,CAAC,YAAY;AACtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAEnE,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,WAAW;IACX,YAAY;IACZ,cAAc;IACd,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,eAAe;IACf,gBAAgB;CACR,CAAC;AAEX,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAa,CAAC"}