@fleetx_io/fleetx-mcp-server 1.1.7 → 2.0.0

package/dist/auth/oauth/pkce.d.ts

@@ -0,0 +1,3 @@
+/** Verifies that SHA-256(codeVerifier) == codeChallenge (base64url-encoded). */
+export declare function verifyCodeChallenge(codeVerifier: string, codeChallenge: string): boolean;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/auth/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/pkce.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAGxF"}

package/dist/auth/oauth/pkce.js

@@ -0,0 +1,7 @@
+import { createHash } from "node:crypto";
+/** Verifies that SHA-256(codeVerifier) == codeChallenge (base64url-encoded). */
+export function verifyCodeChallenge(codeVerifier, codeChallenge) {
+    const computed = createHash("sha256").update(codeVerifier).digest("base64url");
+    return computed === codeChallenge;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/auth/oauth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../src/auth/oauth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,aAAqB;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/E,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}

package/dist/auth/oauth/register.d.ts

@@ -0,0 +1,8 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+/**
+ * Dynamic Client Registration endpoint (RFC 7591).
+ * Accepts any well-formed registration (public clients only, no secret).
+ * Used by MCP Inspector and other clients that don't support CIMD.
+ */
+export declare function handleClientRegistration(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=register.d.ts.map

package/dist/auth/oauth/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAa5D;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/auth/oauth/register.js

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import { registerClient } from "../storage/oauth-client.js";
+import { log } from "../../utils.js";
+const registrationSchema = z.object({
+    redirect_uris: z.array(z.string().min(1)).min(1),
+    client_name: z.string().optional(),
+    token_endpoint_auth_method: z.string().optional(),
+    grant_types: z.array(z.string()).optional(),
+    response_types: z.array(z.string()).optional(),
+});
+/**
+ * Dynamic Client Registration endpoint (RFC 7591).
+ * Accepts any well-formed registration (public clients only, no secret).
+ * Used by MCP Inspector and other clients that don't support CIMD.
+ */
+export async function handleClientRegistration(request, reply) {
+    const parsed = registrationSchema.safeParse(request.body);
+    if (!parsed.success) {
+        return reply.status(400).send({
+            error: "invalid_client_metadata",
+            error_description: parsed.error.issues.map((i) => i.message).join("; "),
+        });
+    }
+    const { redirect_uris, client_name } = parsed.data;
+    const client = registerClient({ redirectUris: redirect_uris, clientName: client_name });
+    log(`DCR: registered client=${client.clientId} name=${client_name ?? "(none)"} uris=${redirect_uris.join(", ")}`);
+    return reply.status(201).send({
+        client_id: client.clientId,
+        client_id_issued_at: Math.floor(client.registeredAt / 1000),
+        redirect_uris,
+        client_name: client_name ?? undefined,
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+    });
+}
+//# sourceMappingURL=register.js.map

package/dist/auth/oauth/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/auth/oauth/register.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAuB,EACvB,KAAmB;IAEnB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC5B,KAAK,EAAE,yBAAyB;YAChC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC;IAExF,GAAG,CAAC,0BAA0B,MAAM,CAAC,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAElH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3D,aAAa;QACb,WAAW,EAAE,WAAW,IAAI,SAAS;QACrC,0BAA0B,EAAE,MAAM;QAClC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QACpD,cAAc,EAAE,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/oauth/token.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare function handleToken(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/oauth/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0B5D,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAc7F"}

package/dist/auth/oauth/token.js

@@ -0,0 +1,111 @@
+import { z } from "zod";
+import { consumeAuthorizationCode } from "../storage/authorization-code.js";
+import { createRefreshToken, rotateRefreshToken } from "../storage/refresh-token.js";
+import { findConnectedAccountByUserId } from "../storage/connected-account.js";
+import { signMcpAccessToken } from "../tokens/jwt.js";
+import { verifyCodeChallenge } from "./pkce.js";
+import { isKnownClient } from "./cimd.js";
+import { findClient } from "../storage/oauth-client.js";
+import { CLAUDE_CLIENT_ID, ACCESS_TOKEN_TTL_SECONDS } from "../../config/oauth.js";
+import { log } from "../../utils.js";
+const authCodeSchema = z.object({
+    grant_type: z.literal("authorization_code"),
+    code: z.string().min(1),
+    redirect_uri: z.string().url(),
+    client_id: z.string(),
+    code_verifier: z.string().min(43).max(128),
+});
+const refreshSchema = z.object({
+    grant_type: z.literal("refresh_token"),
+    refresh_token: z.string().min(1),
+    client_id: z.string(),
+});
+export async function handleToken(request, reply) {
+    const body = request.body;
+    if (body.grant_type === "authorization_code") {
+        return exchangeAuthCode(body, reply);
+    }
+    if (body.grant_type === "refresh_token") {
+        return exchangeRefreshToken(body, reply);
+    }
+    return reply.status(400).send({
+        error: "unsupported_grant_type",
+        error_description: "Supported grant types: authorization_code, refresh_token",
+    });
+}
+async function exchangeAuthCode(body, reply) {
+    const parsed = authCodeSchema.safeParse(body);
+    if (!parsed.success) {
+        return reply.status(400).send({ error: "invalid_request", error_description: parsed.error.message });
+    }
+    const { code, redirect_uri, client_id, code_verifier } = parsed.data;
+    if (!isKnownClient(client_id, [CLAUDE_CLIENT_ID], (id) => !!findClient(id))) {
+        return reply.status(401).send({ error: "invalid_client" });
+    }
+    const authCode = consumeAuthorizationCode(code);
+    if (!authCode) {
+        return reply
+            .status(400)
+            .send({ error: "invalid_grant", error_description: "Code expired, consumed, or not found" });
+    }
+    if (authCode.redirectUri !== redirect_uri) {
+        return reply.status(400).send({ error: "invalid_grant", error_description: "redirect_uri mismatch" });
+    }
+    if (authCode.clientId !== client_id) {
+        return reply.status(400).send({ error: "invalid_grant", error_description: "client_id mismatch" });
+    }
+    if (!verifyCodeChallenge(code_verifier, authCode.codeChallenge)) {
+        return reply
+            .status(400)
+            .send({ error: "invalid_grant", error_description: "PKCE verification failed" });
+    }
+    const account = findConnectedAccountByUserId(authCode.userId);
+    if (!account) {
+        return reply.status(400).send({ error: "invalid_grant", error_description: "User account not found" });
+    }
+    const accessToken = await signMcpAccessToken({
+        sub: account.userId,
+        email: account.email,
+        name: account.name,
+    });
+    const refreshToken = createRefreshToken({ userId: account.userId, clientId: client_id });
+    log(`MCP token issued for ${account.email}`);
+    return reply.send({
+        access_token: accessToken,
+        refresh_token: refreshToken.token,
+        token_type: "Bearer",
+        expires_in: ACCESS_TOKEN_TTL_SECONDS,
+    });
+}
+async function exchangeRefreshToken(body, reply) {
+    const parsed = refreshSchema.safeParse(body);
+    if (!parsed.success) {
+        return reply.status(400).send({ error: "invalid_request", error_description: parsed.error.message });
+    }
+    const { refresh_token, client_id } = parsed.data;
+    if (!isKnownClient(client_id, [CLAUDE_CLIENT_ID], (id) => !!findClient(id))) {
+        return reply.status(401).send({ error: "invalid_client" });
+    }
+    const newRefreshToken = rotateRefreshToken(refresh_token);
+    if (!newRefreshToken) {
+        return reply
+            .status(400)
+            .send({ error: "invalid_grant", error_description: "Refresh token expired or revoked" });
+    }
+    const account = findConnectedAccountByUserId(newRefreshToken.userId);
+    if (!account) {
+        return reply.status(400).send({ error: "invalid_grant", error_description: "User account not found" });
+    }
+    const accessToken = await signMcpAccessToken({
+        sub: account.userId,
+        email: account.email,
+        name: account.name,
+    });
+    return reply.send({
+        access_token: accessToken,
+        refresh_token: newRefreshToken.token,
+        token_type: "Bearer",
+        expires_in: ACCESS_TOKEN_TTL_SECONDS,
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/auth/oauth/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/auth/oauth/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAuB,EAAE,KAAmB;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;IAErD,IAAI,IAAI,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;QAC7C,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5B,KAAK,EAAE,wBAAwB;QAC/B,iBAAiB,EAAE,0DAA0D;KAC9E,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAA6B,EAAE,KAAmB;IAChF,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAErE,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC;QAC3C,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAEzF,GAAG,CAAC,wBAAwB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAE7C,OAAO,KAAK,CAAC,IAAI,CAAC;QAChB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,YAAY,CAAC,KAAK;QACjC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,wBAAwB;KACrC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAA6B,EAAE,KAAmB;IACpF,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAEjD,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,eAAe,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC;QAC3C,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,IAAI,CAAC;QAChB,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,eAAe,CAAC,KAAK;QACpC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,wBAAwB;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/oauth/types.d.ts

@@ -0,0 +1,11 @@
+export interface PendingAuthSession {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+    expiresAt: number;
+    /** The MCP server base URL as seen by the incoming request — used for the Google redirect_uri. */
+    serverBaseUrl: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/auth/oauth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/auth/oauth/types.ts"],"names":[],"mappings":""}

package/dist/auth/oauth/userinfo.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyRequest, FastifyReply } from "fastify";
+export declare function handleUserInfo(request: FastifyRequest, reply: FastifyReply): Promise<void>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/auth/oauth/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/userinfo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5D,wBAAsB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhG"}

package/dist/auth/oauth/userinfo.js

@@ -0,0 +1,29 @@
+import { verifyMcpAccessToken } from "../tokens/jwt.js";
+import { findConnectedAccountByUserId } from "../storage/connected-account.js";
+export async function handleUserInfo(request, reply) {
+    const header = request.headers.authorization;
+    if (!header?.startsWith("Bearer ")) {
+        return reply
+            .status(401)
+            .header("WWW-Authenticate", "Bearer")
+            .send({ error: "unauthorized" });
+    }
+    const token = header.slice(7).trim();
+    const payload = await verifyMcpAccessToken(token);
+    if (!payload) {
+        return reply
+            .status(401)
+            .header("WWW-Authenticate", 'Bearer error="invalid_token"')
+            .send({ error: "invalid_token" });
+    }
+    const account = findConnectedAccountByUserId(payload.sub);
+    if (!account) {
+        return reply.status(404).send({ error: "user_not_found" });
+    }
+    return reply.send({
+        sub: account.userId,
+        email: account.email,
+        name: account.name,
+    });
+}
+//# sourceMappingURL=userinfo.js.map

package/dist/auth/oauth/userinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.js","sourceRoot":"","sources":["../../../src/auth/oauth/userinfo.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,KAAmB;IAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC;aACpC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK;aACT,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;aAC1D,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC;QAChB,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/storage/authorization-code.d.ts

@@ -0,0 +1,19 @@
+export interface AuthorizationCode {
+    id: string;
+    code: string;
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    expiresAt: number;
+    consumedAt: number | null;
+}
+export declare function createAuthorizationCode(params: {
+    userId: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+}): AuthorizationCode;
+/** Finds the code, marks it consumed (one-time), and returns it. Returns null if invalid. */
+export declare function consumeAuthorizationCode(code: string): AuthorizationCode | null;
+//# sourceMappingURL=authorization-code.d.ts.map

package/dist/auth/storage/authorization-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/authorization-code.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AA0BD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,GAAG,iBAAiB,CAapB;AAED,6FAA6F;AAC7F,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAmB/E"}

package/dist/auth/storage/authorization-code.js

@@ -0,0 +1,44 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { getDb } from "./db.js";
+import { AUTH_CODE_TTL_SECONDS } from "../../config/oauth.js";
+function rowToCode(row) {
+    return {
+        id: row.id,
+        code: row.code,
+        userId: row.user_id,
+        clientId: row.client_id,
+        redirectUri: row.redirect_uri,
+        codeChallenge: row.code_challenge,
+        expiresAt: row.expires_at,
+        consumedAt: row.consumed_at,
+    };
+}
+export function createAuthorizationCode(params) {
+    const db = getDb();
+    const id = randomUUID();
+    const code = randomBytes(32).toString("base64url");
+    const expiresAt = Date.now() + AUTH_CODE_TTL_SECONDS * 1000;
+    db.prepare(`
+    INSERT INTO authorization_codes
+      (id, code, user_id, client_id, redirect_uri, code_challenge, expires_at, consumed_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, NULL)
+  `).run(id, code, params.userId, params.clientId, params.redirectUri, params.codeChallenge, expiresAt);
+    return { id, code, ...params, expiresAt, consumedAt: null };
+}
+/** Finds the code, marks it consumed (one-time), and returns it. Returns null if invalid. */
+export function consumeAuthorizationCode(code) {
+    const db = getDb();
+    const row = db
+        .prepare("SELECT * FROM authorization_codes WHERE code = ?")
+        .get(code);
+    if (!row)
+        return null;
+    const authCode = rowToCode(row);
+    if (authCode.consumedAt !== null)
+        return null;
+    if (authCode.expiresAt < Date.now())
+        return null;
+    db.prepare("UPDATE authorization_codes SET consumed_at = ? WHERE id = ?").run(Date.now(), authCode.id);
+    return authCode;
+}
+//# sourceMappingURL=authorization-code.js.map

package/dist/auth/storage/authorization-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-code.js","sourceRoot":"","sources":["../../../src/auth/storage/authorization-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAwB9D,SAAS,SAAS,CAAC,GAAU;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAE5D,EAAE,CAAC,OAAO,CAAC;;;;GAIV,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAEtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAkB,kDAAkD,CAAC;SAC5E,GAAG,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAEjD,EAAE,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC,GAAG,CAC3E,IAAI,CAAC,GAAG,EAAE,EACV,QAAQ,CAAC,EAAE,CACZ,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/auth/storage/connected-account.d.ts

@@ -0,0 +1,24 @@
+export interface ConnectedAccount {
+    id: string;
+    userId: string;
+    fleetxAccessToken: string;
+    fleetxTokenExpiry: number | null;
+    email: string;
+    name: string;
+    createdAt: number;
+    updatedAt: number;
+}
+export declare function upsertConnectedAccount(params: {
+    userId: string;
+    fleetxAccessToken: string;
+    fleetxTokenExpiry?: number;
+    email: string;
+    name: string;
+}): ConnectedAccount;
+export declare function findConnectedAccountByUserId(userId: string): ConnectedAccount | null;
+/**
+ * Clears the stored FleetX access token for a user.
+ * Called when FleetX returns 401 — forces re-authentication on next MCP connect.
+ */
+export declare function expireConnectedAccountToken(userId: string): void;
+//# sourceMappingURL=connected-account.d.ts.map

package/dist/auth/storage/connected-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-account.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/connected-account.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AA2BD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,gBAAgB,CA4CnB;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAMpF;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKhE"}

package/dist/auth/storage/connected-account.js

@@ -0,0 +1,60 @@
+import { randomUUID } from "node:crypto";
+import { getDb } from "./db.js";
+import { encryptToken, decryptToken } from "../tokens/encryption.js";
+import { getOAuthConfig } from "../../config/oauth.js";
+function decrypt(row) {
+    const { TOKEN_ENCRYPTION_KEY: key } = getOAuthConfig();
+    return {
+        id: row.id,
+        userId: row.user_id,
+        fleetxAccessToken: decryptToken(row.fleetx_access_token, key),
+        fleetxTokenExpiry: row.fleetx_token_expiry,
+        email: row.email,
+        name: row.name,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}
+export function upsertConnectedAccount(params) {
+    const db = getDb();
+    const { TOKEN_ENCRYPTION_KEY: key } = getOAuthConfig();
+    const now = Date.now();
+    const existing = db
+        .prepare("SELECT id FROM connected_accounts WHERE user_id = ?")
+        .get(params.userId);
+    if (existing) {
+        db.prepare(`
+      UPDATE connected_accounts
+      SET fleetx_access_token = ?,
+          fleetx_token_expiry = ?,
+          email               = ?,
+          name                = ?,
+          updated_at          = ?
+      WHERE user_id = ?
+    `).run(encryptToken(params.fleetxAccessToken, key), params.fleetxTokenExpiry ?? null, params.email, params.name, now, params.userId);
+    }
+    else {
+        db.prepare(`
+      INSERT INTO connected_accounts
+        (id, user_id, fleetx_access_token, fleetx_token_expiry, email, name, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(randomUUID(), params.userId, encryptToken(params.fleetxAccessToken, key), params.fleetxTokenExpiry ?? null, params.email, params.name, now, now);
+    }
+    return findConnectedAccountByUserId(params.userId);
+}
+export function findConnectedAccountByUserId(userId) {
+    const db = getDb();
+    const row = db
+        .prepare("SELECT * FROM connected_accounts WHERE user_id = ?")
+        .get(userId);
+    return row ? decrypt(row) : null;
+}
+/**
+ * Clears the stored FleetX access token for a user.
+ * Called when FleetX returns 401 — forces re-authentication on next MCP connect.
+ */
+export function expireConnectedAccountToken(userId) {
+    const db = getDb();
+    db.prepare("UPDATE connected_accounts SET fleetx_access_token = '', updated_at = ? WHERE user_id = ?").run(Date.now(), userId);
+}
+//# sourceMappingURL=connected-account.js.map

package/dist/auth/storage/connected-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-account.js","sourceRoot":"","sources":["../../../src/auth/storage/connected-account.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwBvD,SAAS,OAAO,CAAC,GAAU;IACzB,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACvD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,iBAAiB,EAAE,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC;QAC7D,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;QAC1C,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAMtC;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,EAAE;SAChB,OAAO,CAA2B,qDAAqD,CAAC;SACxF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEtB,IAAI,QAAQ,EAAE,CAAC;QACb,EAAE,CAAC,OAAO,CAAC;;;;;;;;KAQV,CAAC,CAAC,GAAG,CACJ,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAC3C,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAChC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,GAAG,EACH,MAAM,CAAC,MAAM,CACd,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,OAAO,CAAC;;;;KAIV,CAAC,CAAC,GAAG,CACJ,UAAU,EAAE,EACZ,MAAM,CAAC,MAAM,EACb,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAC3C,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAChC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,IAAI,EACX,GAAG,EACH,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAkB,oDAAoD,CAAC;SAC9E,GAAG,CAAC,MAAM,CAAC,CAAC;IACf,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,EAAE,CAAC,OAAO,CACR,0FAA0F,CAC3F,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/auth/storage/db.d.ts

@@ -0,0 +1,3 @@
+import Database from "better-sqlite3";
+export declare function getDb(): Database.Database;
+//# sourceMappingURL=db.d.ts.map

package/dist/auth/storage/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAQtC,wBAAgB,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAiBzC"}

package/dist/auth/storage/db.js

@@ -0,0 +1,110 @@
+import Database from "better-sqlite3";
+import path from "node:path";
+import fs from "node:fs";
+import { getOAuthConfig } from "../../config/oauth.js";
+import { log } from "../../utils.js";
+let _db = null;
+export function getDb() {
+    if (_db)
+        return _db;
+    const { DATABASE_PATH } = getOAuthConfig();
+    const dir = path.dirname(DATABASE_PATH);
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    _db = new Database(DATABASE_PATH);
+    _db.pragma("journal_mode = WAL");
+    _db.pragma("foreign_keys = ON");
+    runMigrations(_db);
+    log("SQLite database ready:", DATABASE_PATH);
+    return _db;
+}
+function runMigrations(db) {
+    // M001: drop NOT NULL on fleetx_refresh_token (FleetX API no longer returns one)
+    migrateConnectedAccountsSchema(db);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS connected_accounts (
+      id                   TEXT PRIMARY KEY,
+      user_id              TEXT NOT NULL UNIQUE,
+      fleetx_access_token  TEXT NOT NULL,
+      fleetx_refresh_token TEXT,
+      fleetx_token_expiry  INTEGER,
+      email                TEXT NOT NULL,
+      name                 TEXT NOT NULL,
+      created_at           INTEGER NOT NULL,
+      updated_at           INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS authorization_codes (
+      id             TEXT PRIMARY KEY,
+      code           TEXT NOT NULL UNIQUE,
+      user_id        TEXT NOT NULL,
+      client_id      TEXT NOT NULL,
+      redirect_uri   TEXT NOT NULL,
+      code_challenge TEXT NOT NULL,
+      expires_at     INTEGER NOT NULL,
+      consumed_at    INTEGER
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_auth_codes_code
+      ON authorization_codes(code);
+    CREATE INDEX IF NOT EXISTS idx_auth_codes_expires
+      ON authorization_codes(expires_at);
+
+    CREATE TABLE IF NOT EXISTS refresh_tokens (
+      id         TEXT PRIMARY KEY,
+      token      TEXT NOT NULL UNIQUE,
+      user_id    TEXT NOT NULL,
+      client_id  TEXT NOT NULL,
+      expires_at INTEGER NOT NULL,
+      revoked_at INTEGER
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_refresh_tokens_token
+      ON refresh_tokens(token);
+
+    CREATE TABLE IF NOT EXISTS oauth_clients (
+      client_id     TEXT PRIMARY KEY,
+      redirect_uris TEXT NOT NULL,
+      client_name   TEXT,
+      registered_at INTEGER NOT NULL
+    );
+  `);
+}
+/**
+ * SQLite cannot ALTER COLUMN to drop NOT NULL.
+ * If connected_accounts has fleetx_refresh_token as NOT NULL, recreate the table.
+ */
+function migrateConnectedAccountsSchema(db) {
+    const cols = db.pragma("table_info(connected_accounts)");
+    if (cols.length === 0)
+        return; // table doesn't exist yet — nothing to migrate
+    const col = cols.find((c) => c.name === "fleetx_refresh_token");
+    if (!col || col.notnull === 0)
+        return; // already nullable — no migration needed
+    log("M001: migrating connected_accounts to drop NOT NULL on fleetx_refresh_token");
+    db.exec(`
+    ALTER TABLE connected_accounts RENAME TO connected_accounts_old;
+
+    CREATE TABLE connected_accounts (
+      id                   TEXT PRIMARY KEY,
+      user_id              TEXT NOT NULL UNIQUE,
+      fleetx_access_token  TEXT NOT NULL,
+      fleetx_refresh_token TEXT,
+      fleetx_token_expiry  INTEGER,
+      email                TEXT NOT NULL,
+      name                 TEXT NOT NULL,
+      created_at           INTEGER NOT NULL,
+      updated_at           INTEGER NOT NULL
+    );
+
+    INSERT INTO connected_accounts
+      SELECT id, user_id, fleetx_access_token, fleetx_refresh_token,
+             fleetx_token_expiry, email, name, created_at, updated_at
+      FROM connected_accounts_old;
+
+    DROP TABLE connected_accounts_old;
+  `);
+    log("M001: migration complete");
+}
+//# sourceMappingURL=db.js.map

package/dist/auth/storage/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/auth/storage/db.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAErC,IAAI,GAAG,GAA6B,IAAI,CAAC;AAEzC,MAAM,UAAU,KAAK;IACnB,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,EAAE,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAExC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,GAAG,GAAG,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAEhC,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,EAAqB;IAC1C,iFAAiF;IACjF,8BAA8B,CAAC,EAAE,CAAC,CAAC;IAEnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CP,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,8BAA8B,CAAC,EAAqB;IAE3D,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,gCAAgC,CAAc,CAAC;IACtE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,+CAA+C;IAE9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,CAAC,yCAAyC;IAEhF,GAAG,CAAC,6EAA6E,CAAC,CAAC;IAEnF,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;GAqBP,CAAC,CAAC;IAEH,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAClC,CAAC"}

package/dist/auth/storage/oauth-client.d.ts

@@ -0,0 +1,12 @@
+export interface OAuthClient {
+    clientId: string;
+    redirectUris: string[];
+    clientName: string | null;
+    registeredAt: number;
+}
+export declare function registerClient(params: {
+    redirectUris: string[];
+    clientName?: string;
+}): OAuthClient;
+export declare function findClient(clientId: string): OAuthClient | null;
+//# sourceMappingURL=oauth-client.d.ts.map

package/dist/auth/storage/oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.d.ts","sourceRoot":"","sources":["../../../src/auth/storage/oauth-client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAkBD,wBAAgB,cAAc,CAAC,MAAM,EAAE;IACrC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,WAAW,CAWd;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM/D"}

package/dist/auth/storage/oauth-client.js

@@ -0,0 +1,28 @@
+import { randomUUID } from "node:crypto";
+import { getDb } from "./db.js";
+function rowToClient(row) {
+    return {
+        clientId: row.client_id,
+        redirectUris: JSON.parse(row.redirect_uris),
+        clientName: row.client_name,
+        registeredAt: row.registered_at,
+    };
+}
+export function registerClient(params) {
+    const db = getDb();
+    const clientId = randomUUID();
+    const now = Date.now();
+    db.prepare(`
+    INSERT INTO oauth_clients (client_id, redirect_uris, client_name, registered_at)
+    VALUES (?, ?, ?, ?)
+  `).run(clientId, JSON.stringify(params.redirectUris), params.clientName ?? null, now);
+    return { clientId, redirectUris: params.redirectUris, clientName: params.clientName ?? null, registeredAt: now };
+}
+export function findClient(clientId) {
+    const db = getDb();
+    const row = db
+        .prepare("SELECT * FROM oauth_clients WHERE client_id = ?")
+        .get(clientId);
+    return row ? rowToClient(row) : null;
+}
+//# sourceMappingURL=oauth-client.js.map

package/dist/auth/storage/oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client.js","sourceRoot":"","sources":["../../../src/auth/storage/oauth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAgBhC,SAAS,WAAW,CAAC,GAAU;IAC7B,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAa;QACvD,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,YAAY,EAAE,GAAG,CAAC,aAAa;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAG9B;IACC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,EAAE,CAAC,OAAO,CAAC;;;GAGV,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,GAAG,CAAC,CAAC;IAEtF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAkB,iDAAiD,CAAC;SAC3E,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC"}