@prmichaelsen/mcp-auth 0.1.0 → 0.1.1

package/README.md

@@ -6,42 +6,60 @@ Authentication and multi-tenancy framework for MCP (Model Context Protocol) serv
 
 `@prmichaelsen/mcp-auth` provides a pluggable authentication system for MCP servers, enabling:
 
+- **Zero modification**: Wrap existing MCP servers without code changes
 - **Multi-tenancy**: Multiple users with separate resource tokens
-- **Auth-agnostic**: Support for JWT, OAuth, API Keys, or custom auth schemes
+- **Auth-agnostic**: Support for JWT, environment variables, or custom auth schemes
 - **Transport-agnostic**: Works with stdio, HTTP, and SSE transports
 - **Type-safe**: Full TypeScript support
-- **Composable**: Middleware for rate limiting, logging, etc.
+- **Composable**: Middleware for rate limiting, logging, timeouts, retries
 
-## Installation
+## Two Patterns
 
-```bash
-npm install @prmichaelsen/mcp-auth @modelcontextprotocol/sdk
+### Pattern 1: Server Wrapping (Recommended for Production)
+
+Wrap existing MCP servers without modification:
+
+```typescript
+import { wrapServer, JWTAuthProvider, APITokenResolver } from '@prmichaelsen/mcp-auth';
+import { createServer } from '@myorg/my-mcp-server';
+
+const wrapped = wrapServer({
+  serverFactory: createServer,
+  
+  // Validates JWT from tenant manager
+  authProvider: new JWTAuthProvider({
+    jwtSecret: process.env.JWT_SECRET
+  }),
+  
+  // Resolves tokens via tenant manager API (recommended)
+  tokenResolver: new APITokenResolver({
+    tenantManagerUrl: process.env.TENANT_MANAGER_URL,
+    serviceToken: process.env.SERVICE_TOKEN
+  }),
+  
+  resourceType: 'myapi',
+  transport: { type: 'sse', port: 3000 }
+});
+
+await wrapped.start();
 ```
 
-## Quick Start
+### Pattern 2: Tool-Level Auth
 
-### Simple Function-Based Tool
+Build new servers with integrated authentication:
 
 ```typescript
-import { withAuth, AuthenticatedMCPServer } from '@prmichaelsen/mcp-auth';
-import { EnvAuthProvider, SimpleTokenResolver } from '@prmichaelsen/mcp-auth/providers/env';
-
-// Setup auth provider
-const authProvider = new EnvAuthProvider();
-const tokenResolver = new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' });
+import { AuthenticatedMCPServer, withAuth, EnvAuthProvider, SimpleTokenResolver } from '@prmichaelsen/mcp-auth';
 
-// Create server
 const server = new AuthenticatedMCPServer({
-  name: 'my-mcp-server',
-  authProvider,
-  tokenResolver,
+  name: 'my-server',
+  authProvider: new EnvAuthProvider(),
+  tokenResolver: new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' }),
   resourceType: 'myapi',
   transport: { type: 'stdio' }
 });
 
-// Register tool with automatic auth
 server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {
-  // accessToken and userId are automatically injected
   const client = new MyAPIClient(accessToken);
   return client.getData(args);
 }));
@@ -49,77 +67,123 @@ server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {
 await server.start();
 ```
 
-### Class-Based Tool
+## Installation
 
-```typescript
-import { Tool, AuthenticatedTool } from '@prmichaelsen/mcp-auth';
+```bash
+# Core package
+npm install @prmichaelsen/mcp-auth @modelcontextprotocol/sdk
 
-class GetDataTool implements Tool {
-  name = 'get_data';
-  description = 'Fetch data from API';
-  
-  async execute(args, accessToken, userId) {
-    const client = new MyAPIClient(accessToken);
-    return client.getData(args);
-  }
-}
+# For JWT support
+npm install jsonwebtoken
 
-server.registerTool(new AuthenticatedTool(new GetDataTool()));
+# For SSE/HTTP transports
+npm install express cors
 ```
 
 ## Authentication Providers
 
-### Environment Variable (Simple)
+### EnvAuthProvider (Single-User)
+
+For local development and single-user scenarios:
 
 ```typescript
-import { EnvAuthProvider, SimpleTokenResolver } from '@prmichaelsen/mcp-auth/providers/env';
+import { EnvAuthProvider, SimpleTokenResolver } from '@prmichaelsen/mcp-auth';
 
-const authProvider = new EnvAuthProvider();
-const tokenResolver = new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' });
+const authProvider = new EnvAuthProvider({
+  userIdEnvVar: 'MCP_USER_ID',
+  defaultUserId: 'local-user'
+});
+
+const tokenResolver = new SimpleTokenResolver({
+  tokenEnvVar: 'API_TOKEN'
+});
 ```
 
-### JWT (Multi-tenant)
+### JWTAuthProvider + APITokenResolver (Multi-Tenant Production) ⭐ RECOMMENDED
+
+For production multi-tenant deployments:
 
 ```typescript
-import { JWTAuthProvider } from '@prmichaelsen/mcp-auth/providers/jwt';
+import { JWTAuthProvider, APITokenResolver } from '@prmichaelsen/mcp-auth';
 
+// Validates JWT tokens from tenant manager
 const authProvider = new JWTAuthProvider({
   jwtSecret: process.env.JWT_SECRET,
-  database: {
-    host: 'localhost',
-    database: 'users'
-  }
+  userIdClaim: 'sub'
+});
+
+// Resolves tokens via tenant manager API
+const tokenResolver = new APITokenResolver({
+  tenantManagerUrl: 'https://tenant-manager.example.com',
+  serviceToken: process.env.SERVICE_TOKEN,
+  cacheTokens: true, // Cache for performance
+  cacheTtl: 300000 // 5 minutes
 });
 ```
 
-### OAuth 2.0
+**Why API-Based is Better:**
+- ✅ Automatic token refresh (no new JWT needed)
+- ✅ Immediate token revocation
+- ✅ Tokens not exposed in JWT
+- ✅ Small JWT size (~200 bytes)
+- ✅ Centralized token management
+
+### JWTAuthProvider + JWTTokenResolver (MVP/Prototyping)
+
+For quick setup with JWT-embedded tokens:
 
 ```typescript
-import { OAuthProvider } from '@prmichaelsen/mcp-auth/providers/oauth';
+import { JWTAuthProvider, JWTTokenResolver } from '@prmichaelsen/mcp-auth';
 
-const authProvider = new OAuthProvider({
-  authorizationUrl: 'https://auth.example.com/authorize',
-  tokenUrl: 'https://auth.example.com/token',
-  clientId: process.env.OAUTH_CLIENT_ID,
-  clientSecret: process.env.OAUTH_CLIENT_SECRET
+const authProvider = new JWTAuthProvider({
+  jwtSecret: process.env.JWT_SECRET,
+  extractTokens: true // Extract tokens from JWT
+});
+
+const tokenResolver = new JWTTokenResolver({ authProvider });
+```
+
+**Trade-offs:**
+- ✅ Zero API calls (faster)
+- ✅ Simpler to implement
+- ❌ Token rotation requires new JWT
+- ❌ Larger JWT size
+- ❌ Tokens exposed in JWT payload
+
+### APITokenResolver (API-Based)
+
+For resolving tokens via tenant manager API:
+
+```typescript
+import { JWTAuthProvider, APITokenResolver } from '@prmichaelsen/mcp-auth';
+
+const authProvider = new JWTAuthProvider({
+  jwtSecret: process.env.JWT_SECRET
+});
+
+const tokenResolver = new APITokenResolver({
+  tenantManagerUrl: 'https://tenant-manager.example.com',
+  serviceToken: process.env.SERVICE_TOKEN,
+  endpointPath: '/api/credentials/:userId/:resourceType'
 });
 ```
 
 ### Custom Provider
 
+Implement your own authentication logic:
+
 ```typescript
 import { AuthProvider, AuthResult, RequestContext } from '@prmichaelsen/mcp-auth';
 
 class CustomAuthProvider implements AuthProvider {
   async authenticate(context: RequestContext): Promise<AuthResult> {
-    // Your custom auth logic
     const apiKey = context.headers?.['x-api-key'];
     
     if (!apiKey) {
       return { authenticated: false, error: 'No API key' };
     }
     
-    // Validate and return user ID
+    // Your validation logic
     return {
       authenticated: true,
       userId: 'user-123'
@@ -131,11 +195,12 @@ class CustomAuthProvider implements AuthProvider {
 ## Middleware Composition
 
 ```typescript
-import { compose, withAuth, withRateLimit, withLogging } from '@prmichaelsen/mcp-auth';
+import { compose, withAuth, withRateLimit, withLogging, withTimeout } from '@prmichaelsen/mcp-auth';
 
 const getTool = compose(
-  withLogging(),
+  withLogging({ logArgs: true }),
   withRateLimit({ maxRequests: 100, windowMs: 60000 }),
+  withTimeout(5000),
   withAuth(),
   async (args, accessToken, userId) => {
     // Your tool logic
@@ -150,41 +215,121 @@ server.registerTool('get_data', getTool);
 ### Stdio (Local)
 
 ```typescript
-const server = new AuthenticatedMCPServer({
-  // ...
-  transport: { type: 'stdio' }
-});
+transport: { type: 'stdio' }
 ```
 
-### HTTP/SSE (Remote)
+### SSE (Remote Multi-Tenant)
 
 ```typescript
-const server = new AuthenticatedMCPServer({
-  // ...
-  transport: {
-    type: 'sse',
-    port: 3000,
-    host: '0.0.0.0',
-    basePath: '/mcp'
-  }
-});
+transport: {
+  type: 'sse',
+  port: 3000,
+  host: '0.0.0.0',
+  basePath: '/mcp',
+  cors: true
+}
+```
+
+### HTTP (Remote)
+
+```typescript
+transport: {
+  type: 'http',
+  port: 3000,
+  host: '0.0.0.0'
+}
+```
+
+## MCP Server Contract
+
+To make your MCP server compatible with `wrapServer()`, export a factory function:
+
+```typescript
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+
+export function createServer(accessToken: string, userId?: string): Server {
+  const server = new Server({ name: 'my-server', version: '1.0.0' });
+  const client = new MyAPIClient(accessToken);
+  
+  // Register your tool handlers...
+  
+  return server;
+}
 ```
 
+That's it! No mcp-auth imports needed in your server.
+
+## Architecture
+
+### Three-Tier Deployment
+
+1. **Chat Platform** - Sends MCP requests with JWT
+2. **Tenant Manager** - Issues JWTs, manages user credentials
+3. **MCP Server Instance** - Uses mcp-auth to wrap MCP servers
+
+### Token Resolution Approaches
+
+**Approach 1: JWT with Embedded Tokens** (Recommended)
+- Tenant manager includes resource tokens in JWT
+- Zero external calls
+- Fastest performance
+
+**Approach 2: API-Based Resolution**
+- Tenant manager provides API for token lookup
+- Better separation of concerns
+- Easier token rotation
+
+See [`agent/token-resolution-approaches.md`](./agent/token-resolution-approaches.md) for details.
+
 ## Documentation
 
-See the [`agent/`](./agent/) directory for detailed architecture documentation:
+Comprehensive architecture documentation in [`agent/`](./agent/):
 
-- [`multi-tenant-architecture.md`](./agent/multi-tenant-architecture.md) - Overall architecture and auth schemes
-- [`lib-structure.md`](./agent/lib-structure.md) - Package structure and design
-- [`tool-patterns.md`](./agent/tool-patterns.md) - Tool registration patterns
+- [`server-wrapping-pattern.md`](./agent/server-wrapping-pattern.md) - Server wrapping architecture
+- [`server-contract.md`](./agent/server-contract.md) - MCP server compatibility guide
+- [`dual-pattern-architecture.md`](./agent/dual-pattern-architecture.md) - Both patterns explained
+- [`token-resolution-approaches.md`](./agent/token-resolution-approaches.md) - Token resolution strategies
+- [`why-two-steps.md`](./agent/why-two-steps.md) - AuthProvider vs TokenResolver
+- [`INTEGRATION.md`](./INTEGRATION.md) - Integration guide for MCP server authors
 
 ## Examples
 
-See the [`examples/`](./examples/) directory for complete examples:
+Working examples coming soon in [`examples/`](./examples/):
 
 - `simple-stdio/` - Single-user stdio server
-- `jwt-multi-tenant/` - Multi-tenant JWT server
-- `oauth-server/` - OAuth authentication flow
+- `wrapped-server/` - Server wrapping with JWT
+- `tool-level-auth/` - Tool-level authentication
+- `jwt-multi-tenant/` - Multi-tenant JWT deployment
+
+## API Reference
+
+### Core Functions
+
+- `wrapServer(config)` - Wrap MCP server with authentication
+- `withAuth(handler)` - Add auth to function-based tools
+- `compose(...middlewares)` - Compose middleware functions
+
+### Classes
+
+- `AuthenticatedMCPServer` - MCP server with integrated auth
+- `AuthenticatedTool` - Wrapper for class-based tools
+- `BaseAuthProvider` - Base class for auth providers
+
+### Providers
+
+- `EnvAuthProvider` - Environment variable authentication
+- `SimpleTokenResolver` - Environment variable token resolution
+- `JWTAuthProvider` - JWT validation with token extraction
+- `JWTTokenResolver` - JWT-embedded token resolution
+- `APITokenResolver` - API-based token resolution
+
+### Middleware
+
+- `withAuth()` - Authentication
+- `withLogging()` - Request/response logging
+- `withRateLimit()` - Rate limiting per user
+- `withTimeout()` - Request timeout
+- `withRetry()` - Automatic retry on failure
 
 ## License
 
@@ -192,4 +337,4 @@ MIT
 
 ## Contributing
 
-Contributions welcome! Please see [CONTRIBUTING.md](./CONTRIBUTING.md) for details.
+Contributions welcome! Please open an issue or PR on [GitHub](https://github.com/prmichaelsen/mcp-auth).

package/dist/auth/index.js

@@ -1,11 +1,17 @@
 import { BaseAuthProvider } from "./base-provider.js";
 import {
   EnvAuthProvider,
-  SimpleTokenResolver
+  SimpleTokenResolver,
+  JWTAuthProvider,
+  JWTTokenResolver,
+  APITokenResolver
 } from "./providers/index.js";
 export {
+  APITokenResolver,
   BaseAuthProvider,
   EnvAuthProvider,
+  JWTAuthProvider,
+  JWTTokenResolver,
   SimpleTokenResolver
 };
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/auth/index.ts"],
-  "sourcesContent": ["/**\n * Authentication module exports\n */\n\n// Types\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './types.js';\n\n// Base provider\nexport { BaseAuthProvider } from './base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig\n} from './providers/index.js';\n"],
-  "mappings": "AAcA,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,OAEK;",
+  "sourcesContent": ["/**\n * Authentication module exports\n */\n\n// Types\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './types.js';\n\n// Base provider\nexport { BaseAuthProvider } from './base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig,\n  JWTAuthProvider,\n  type JWTAuthProviderConfig,\n  type JWTPayload,\n  JWTTokenResolver,\n  type JWTTokenResolverConfig,\n  APITokenResolver,\n  type APITokenResolverConfig\n} from './providers/index.js';\n"],
+  "mappings": "AAcA,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAGA;AAAA,EAEA;AAAA,OAEK;",
   "names": []
 }

package/dist/auth/providers/api-token-resolver.js

@@ -0,0 +1,225 @@
+import { TokenResolutionError } from "../../utils/errors.js";
+import { createLogger } from "../../utils/logger.js";
+import { validateAccessToken } from "../../utils/validation.js";
+class APITokenResolver {
+  config;
+  logger;
+  tokenCache;
+  constructor(config) {
+    if (!config.tenantManagerUrl) {
+      throw new Error("tenantManagerUrl is required for APITokenResolver");
+    }
+    if (!config.serviceToken) {
+      throw new Error("serviceToken is required for APITokenResolver");
+    }
+    this.config = {
+      tenantManagerUrl: config.tenantManagerUrl.replace(/\/$/, ""),
+      // Remove trailing slash
+      serviceToken: config.serviceToken,
+      endpointPath: config.endpointPath ?? "/api/credentials/:userId/:resourceType",
+      timeoutMs: config.timeoutMs ?? 5e3,
+      throwOnMissing: config.throwOnMissing ?? true,
+      validateToken: config.validateToken ?? true,
+      customHeaders: config.customHeaders ?? {},
+      cacheTokens: config.cacheTokens ?? true,
+      cacheTtl: config.cacheTtl ?? 3e5,
+      // 5 minutes
+      autoRefresh: config.autoRefresh ?? false
+    };
+    this.logger = createLogger({ enabled: true, level: "info" });
+    this.tokenCache = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Resolve token by calling tenant manager API
+   */
+  async resolveToken(userId, resourceType) {
+    if (this.config.cacheTokens) {
+      const cacheKey = `${userId}:${resourceType}`;
+      const cached = this.tokenCache.get(cacheKey);
+      if (cached && cached.expiresAt > Date.now()) {
+        this.logger.debug("Token retrieved from cache", {
+          userId,
+          resourceType,
+          cacheKey
+        });
+        return cached.token;
+      }
+    }
+    const url = this.buildUrl(userId, resourceType);
+    try {
+      this.logger.debug("Calling tenant manager API", {
+        userId,
+        resourceType,
+        url
+      });
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), this.config.timeoutMs);
+      const response = await fetch(url, {
+        method: "GET",
+        headers: {
+          "Authorization": `Bearer ${this.config.serviceToken}`,
+          "Content-Type": "application/json",
+          ...this.config.customHeaders
+        },
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        const errorText = await response.text().catch(() => "Unknown error");
+        this.logger.warn("API request failed", {
+          userId,
+          resourceType,
+          status: response.status,
+          error: errorText
+        });
+        if (this.config.throwOnMissing) {
+          throw new TokenResolutionError(userId, resourceType, {
+            status: response.status,
+            error: errorText,
+            url
+          });
+        }
+        return null;
+      }
+      const data = await response.json();
+      const token = data.accessToken || data.access_token || data.token;
+      if (!token) {
+        this.logger.warn("API response missing token", {
+          userId,
+          resourceType,
+          responseKeys: Object.keys(data || {})
+        });
+        if (this.config.throwOnMissing) {
+          throw new TokenResolutionError(userId, resourceType, {
+            reason: "API response missing accessToken field"
+          });
+        }
+        return null;
+      }
+      if (this.config.validateToken) {
+        try {
+          validateAccessToken(token);
+        } catch (error) {
+          this.logger.error("Token validation failed", error, {
+            userId,
+            resourceType
+          });
+          if (this.config.throwOnMissing) {
+            throw new TokenResolutionError(userId, resourceType, {
+              reason: "Invalid token format"
+            });
+          }
+          return null;
+        }
+      }
+      if (this.config.cacheTokens) {
+        const cacheKey = `${userId}:${resourceType}`;
+        this.tokenCache.set(cacheKey, {
+          token,
+          expiresAt: Date.now() + this.config.cacheTtl
+        });
+        this.logger.debug("Token cached", {
+          userId,
+          resourceType,
+          cacheKey,
+          ttl: this.config.cacheTtl
+        });
+      }
+      this.logger.info("Token resolved successfully", {
+        userId,
+        resourceType,
+        tokenLength: token.length
+      });
+      return token;
+    } catch (error) {
+      if (error instanceof TokenResolutionError) {
+        throw error;
+      }
+      this.logger.error("API request error", error, {
+        userId,
+        resourceType,
+        url
+      });
+      if (this.config.throwOnMissing) {
+        throw new TokenResolutionError(userId, resourceType, {
+          reason: error instanceof Error ? error.message : "API request failed",
+          url
+        });
+      }
+      return null;
+    }
+  }
+  /**
+   * Build API URL from template
+   */
+  buildUrl(userId, resourceType) {
+    const path = this.config.endpointPath.replace(":userId", encodeURIComponent(userId)).replace(":resourceType", encodeURIComponent(resourceType));
+    return `${this.config.tenantManagerUrl}${path}`;
+  }
+  /**
+   * Refresh token (calls API again)
+   */
+  async refreshToken(userId, resourceType) {
+    this.logger.info("Refreshing token via API", { userId, resourceType });
+    const cacheKey = `${userId}:${resourceType}`;
+    this.tokenCache.delete(cacheKey);
+    return this.resolveToken(userId, resourceType);
+  }
+  /**
+   * Validate token (basic check)
+   */
+  async validateToken(token, resourceType) {
+    if (!this.config.validateToken) {
+      return true;
+    }
+    try {
+      validateAccessToken(token);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Initialize resolver
+   */
+  async initialize() {
+    this.logger.info("APITokenResolver initialized", {
+      tenantManagerUrl: this.config.tenantManagerUrl,
+      endpointPath: this.config.endpointPath,
+      cacheEnabled: this.config.cacheTokens,
+      timeoutMs: this.config.timeoutMs
+    });
+    try {
+      new URL(this.config.tenantManagerUrl);
+    } catch {
+      throw new Error(`Invalid tenantManagerUrl: ${this.config.tenantManagerUrl}`);
+    }
+  }
+  /**
+   * Cleanup resources
+   */
+  async cleanup() {
+    this.tokenCache.clear();
+    this.logger.info("APITokenResolver cleaned up");
+  }
+  /**
+   * Clear token cache
+   */
+  clearCache() {
+    this.tokenCache.clear();
+    this.logger.debug("Token cache cleared");
+  }
+  /**
+   * Get cache statistics
+   */
+  getCacheStats() {
+    return {
+      size: this.tokenCache.size,
+      keys: Array.from(this.tokenCache.keys())
+    };
+  }
+}
+export {
+  APITokenResolver
+};
+//# sourceMappingURL=api-token-resolver.js.map

package/dist/auth/providers/api-token-resolver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/auth/providers/api-token-resolver.ts"],
+  "sourcesContent": ["/**\n * API-based token resolver\n * \n * Resolves tokens by calling the tenant manager's API.\n * Alternative to JWT-embedded tokens for better separation.\n */\n\nimport type { ResourceTokenResolver, TokenResolverConfig } from '../types.js';\nimport { TokenResolutionError } from '../../utils/errors.js';\nimport { createLogger, type Logger } from '../../utils/logger.js';\nimport { validateAccessToken } from '../../utils/validation.js';\n\n/**\n * Configuration for APITokenResolver\n */\nexport interface APITokenResolverConfig extends TokenResolverConfig {\n  /**\n   * Tenant manager API base URL\n   * @example 'https://tenant-manager.example.com'\n   */\n  tenantManagerUrl: string;\n  \n  /**\n   * Service token for authenticating MCP server \u2192 tenant manager requests\n   * This is a separate token from user JWTs\n   */\n  serviceToken: string;\n  \n  /**\n   * API endpoint path template\n   * @default '/api/credentials/:userId/:resourceType'\n   * \n   * Variables:\n   * - :userId - Will be replaced with actual user ID\n   * - :resourceType - Will be replaced with resource type\n   */\n  endpointPath?: string;\n  \n  /**\n   * Request timeout in milliseconds\n   * @default 5000\n   */\n  timeoutMs?: number;\n  \n  /**\n   * Whether to throw error if token is not found\n   * @default true\n   */\n  throwOnMissing?: boolean;\n  \n  /**\n   * Whether to validate token format\n   * @default true\n   */\n  validateToken?: boolean;\n  \n  /**\n   * Custom headers to include in API requests\n   */\n  customHeaders?: Record<string, string>;\n}\n\n/**\n * API token resolver\n * \n * Resolves tokens by calling the tenant manager's API endpoint.\n * This approach provides better separation between MCP server and tenant manager.\n * \n * @example\n * ```typescript\n * const resolver = new APITokenResolver({\n *   tenantManagerUrl: 'https://tenant-manager.example.com',\n *   serviceToken: process.env.SERVICE_TOKEN\n * });\n * \n * // Calls: GET https://tenant-manager.example.com/api/credentials/user-123/instagram\n * // Headers: { Authorization: Bearer <service-token> }\n * // Returns: { accessToken: \"IGQVJXabc...\" }\n * ```\n */\nexport class APITokenResolver implements ResourceTokenResolver {\n  private config: Required<APITokenResolverConfig>;\n  private logger: Logger;\n  private tokenCache: Map<string, { token: string; expiresAt: number }>;\n  \n  constructor(config: APITokenResolverConfig) {\n    if (!config.tenantManagerUrl) {\n      throw new Error('tenantManagerUrl is required for APITokenResolver');\n    }\n    if (!config.serviceToken) {\n      throw new Error('serviceToken is required for APITokenResolver');\n    }\n    \n    this.config = {\n      tenantManagerUrl: config.tenantManagerUrl.replace(/\\/$/, ''), // Remove trailing slash\n      serviceToken: config.serviceToken,\n      endpointPath: config.endpointPath ?? '/api/credentials/:userId/:resourceType',\n      timeoutMs: config.timeoutMs ?? 5000,\n      throwOnMissing: config.throwOnMissing ?? true,\n      validateToken: config.validateToken ?? true,\n      customHeaders: config.customHeaders ?? {},\n      cacheTokens: config.cacheTokens ?? true,\n      cacheTtl: config.cacheTtl ?? 300000, // 5 minutes\n      autoRefresh: config.autoRefresh ?? false\n    };\n    \n    this.logger = createLogger({ enabled: true, level: 'info' });\n    this.tokenCache = new Map();\n  }\n  \n  /**\n   * Resolve token by calling tenant manager API\n   */\n  async resolveToken(userId: string, resourceType: string): Promise<string | null> {\n    // Check cache if enabled\n    if (this.config.cacheTokens) {\n      const cacheKey = `${userId}:${resourceType}`;\n      const cached = this.tokenCache.get(cacheKey);\n      \n      if (cached && cached.expiresAt > Date.now()) {\n        this.logger.debug('Token retrieved from cache', {\n          userId,\n          resourceType,\n          cacheKey\n        });\n        return cached.token;\n      }\n    }\n    \n    // Build API URL\n    const url = this.buildUrl(userId, resourceType);\n    \n    try {\n      this.logger.debug('Calling tenant manager API', {\n        userId,\n        resourceType,\n        url\n      });\n      \n      // Call tenant manager API with timeout\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), this.config.timeoutMs);\n      \n      const response = await fetch(url, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${this.config.serviceToken}`,\n          'Content-Type': 'application/json',\n          ...this.config.customHeaders\n        },\n        signal: controller.signal\n      });\n      \n      clearTimeout(timeoutId);\n      \n      if (!response.ok) {\n        const errorText = await response.text().catch(() => 'Unknown error');\n        \n        this.logger.warn('API request failed', {\n          userId,\n          resourceType,\n          status: response.status,\n          error: errorText\n        });\n        \n        if (this.config.throwOnMissing) {\n          throw new TokenResolutionError(userId, resourceType, {\n            status: response.status,\n            error: errorText,\n            url\n          });\n        }\n        \n        return null;\n      }\n      \n      // Parse response\n      const data = await response.json() as any;\n      const token = data.accessToken || data.access_token || data.token;\n      \n      if (!token) {\n        this.logger.warn('API response missing token', {\n          userId,\n          resourceType,\n          responseKeys: Object.keys(data || {})\n        });\n        \n        if (this.config.throwOnMissing) {\n          throw new TokenResolutionError(userId, resourceType, {\n            reason: 'API response missing accessToken field'\n          });\n        }\n        \n        return null;\n      }\n      \n      // Validate token format if enabled\n      if (this.config.validateToken) {\n        try {\n          validateAccessToken(token);\n        } catch (error) {\n          this.logger.error('Token validation failed', error as Error, {\n            userId,\n            resourceType\n          });\n          \n          if (this.config.throwOnMissing) {\n            throw new TokenResolutionError(userId, resourceType, {\n              reason: 'Invalid token format'\n            });\n          }\n          \n          return null;\n        }\n      }\n      \n      // Cache token if enabled\n      if (this.config.cacheTokens) {\n        const cacheKey = `${userId}:${resourceType}`;\n        this.tokenCache.set(cacheKey, {\n          token,\n          expiresAt: Date.now() + this.config.cacheTtl\n        });\n        \n        this.logger.debug('Token cached', {\n          userId,\n          resourceType,\n          cacheKey,\n          ttl: this.config.cacheTtl\n        });\n      }\n      \n      this.logger.info('Token resolved successfully', {\n        userId,\n        resourceType,\n        tokenLength: token.length\n      });\n      \n      return token;\n      \n    } catch (error) {\n      if (error instanceof TokenResolutionError) {\n        throw error;\n      }\n      \n      this.logger.error('API request error', error as Error, {\n        userId,\n        resourceType,\n        url\n      });\n      \n      if (this.config.throwOnMissing) {\n        throw new TokenResolutionError(userId, resourceType, {\n          reason: error instanceof Error ? error.message : 'API request failed',\n          url\n        });\n      }\n      \n      return null;\n    }\n  }\n  \n  /**\n   * Build API URL from template\n   */\n  private buildUrl(userId: string, resourceType: string): string {\n    const path = this.config.endpointPath\n      .replace(':userId', encodeURIComponent(userId))\n      .replace(':resourceType', encodeURIComponent(resourceType));\n    \n    return `${this.config.tenantManagerUrl}${path}`;\n  }\n  \n  /**\n   * Refresh token (calls API again)\n   */\n  async refreshToken(userId: string, resourceType: string): Promise<string | null> {\n    this.logger.info('Refreshing token via API', { userId, resourceType });\n    \n    // Clear cache and fetch fresh token\n    const cacheKey = `${userId}:${resourceType}`;\n    this.tokenCache.delete(cacheKey);\n    \n    return this.resolveToken(userId, resourceType);\n  }\n  \n  /**\n   * Validate token (basic check)\n   */\n  async validateToken(token: string, resourceType: string): Promise<boolean> {\n    if (!this.config.validateToken) {\n      return true;\n    }\n    \n    try {\n      validateAccessToken(token);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n  \n  /**\n   * Initialize resolver\n   */\n  async initialize(): Promise<void> {\n    this.logger.info('APITokenResolver initialized', {\n      tenantManagerUrl: this.config.tenantManagerUrl,\n      endpointPath: this.config.endpointPath,\n      cacheEnabled: this.config.cacheTokens,\n      timeoutMs: this.config.timeoutMs\n    });\n    \n    // Validate configuration\n    try {\n      new URL(this.config.tenantManagerUrl);\n    } catch {\n      throw new Error(`Invalid tenantManagerUrl: ${this.config.tenantManagerUrl}`);\n    }\n  }\n  \n  /**\n   * Cleanup resources\n   */\n  async cleanup(): Promise<void> {\n    this.tokenCache.clear();\n    this.logger.info('APITokenResolver cleaned up');\n  }\n  \n  /**\n   * Clear token cache\n   */\n  clearCache(): void {\n    this.tokenCache.clear();\n    this.logger.debug('Token cache cleared');\n  }\n  \n  /**\n   * Get cache statistics\n   */\n  getCacheStats(): { size: number; keys: string[] } {\n    return {\n      size: this.tokenCache.size,\n      keys: Array.from(this.tokenCache.keys())\n    };\n  }\n}\n"],
+  "mappings": "AAQA,SAAS,4BAA4B;AACrC,SAAS,oBAAiC;AAC1C,SAAS,2BAA2B;AAsE7B,MAAM,iBAAkD;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAgC;AAC1C,QAAI,CAAC,OAAO,kBAAkB;AAC5B,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,SAAK,SAAS;AAAA,MACZ,kBAAkB,OAAO,iBAAiB,QAAQ,OAAO,EAAE;AAAA;AAAA,MAC3D,cAAc,OAAO;AAAA,MACrB,cAAc,OAAO,gBAAgB;AAAA,MACrC,WAAW,OAAO,aAAa;AAAA,MAC/B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,eAAe,OAAO,iBAAiB;AAAA,MACvC,eAAe,OAAO,iBAAiB,CAAC;AAAA,MACxC,aAAa,OAAO,eAAe;AAAA,MACnC,UAAU,OAAO,YAAY;AAAA;AAAA,MAC7B,aAAa,OAAO,eAAe;AAAA,IACrC;AAEA,SAAK,SAAS,aAAa,EAAE,SAAS,MAAM,OAAO,OAAO,CAAC;AAC3D,SAAK,aAAa,oBAAI,IAAI;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAgB,cAA8C;AAE/E,QAAI,KAAK,OAAO,aAAa;AAC3B,YAAM,WAAW,GAAG,MAAM,IAAI,YAAY;AAC1C,YAAM,SAAS,KAAK,WAAW,IAAI,QAAQ;AAE3C,UAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAC3C,aAAK,OAAO,MAAM,8BAA8B;AAAA,UAC9C;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AACD,eAAO,OAAO;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,MAAM,KAAK,SAAS,QAAQ,YAAY;AAE9C,QAAI;AACF,WAAK,OAAO,MAAM,8BAA8B;AAAA,QAC9C;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAGD,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,OAAO,SAAS;AAE5E,YAAM,WAAW,MAAM,MAAM,KAAK;AAAA,QAChC,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,KAAK,OAAO,YAAY;AAAA,UACnD,gBAAgB;AAAA,UAChB,GAAG,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,mBAAa,SAAS;AAEtB,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,YAAY,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,eAAe;AAEnE,aAAK,OAAO,KAAK,sBAAsB;AAAA,UACrC;AAAA,UACA;AAAA,UACA,QAAQ,SAAS;AAAA,UACjB,OAAO;AAAA,QACT,CAAC;AAED,YAAI,KAAK,OAAO,gBAAgB;AAC9B,gBAAM,IAAI,qBAAqB,QAAQ,cAAc;AAAA,YACnD,QAAQ,SAAS;AAAA,YACjB,OAAO;AAAA,YACP;AAAA,UACF,CAAC;AAAA,QACH;AAEA,eAAO;AAAA,MACT;AAGA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,QAAQ,KAAK,eAAe,KAAK,gBAAgB,KAAK;AAE5D,UAAI,CAAC,OAAO;AACV,aAAK,OAAO,KAAK,8BAA8B;AAAA,UAC7C;AAAA,UACA;AAAA,UACA,cAAc,OAAO,KAAK,QAAQ,CAAC,CAAC;AAAA,QACtC,CAAC;AAED,YAAI,KAAK,OAAO,gBAAgB;AAC9B,gBAAM,IAAI,qBAAqB,QAAQ,cAAc;AAAA,YACnD,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAEA,eAAO;AAAA,MACT;AAGA,UAAI,KAAK,OAAO,eAAe;AAC7B,YAAI;AACF,8BAAoB,KAAK;AAAA,QAC3B,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,2BAA2B,OAAgB;AAAA,YAC3D;AAAA,YACA;AAAA,UACF,CAAC;AAED,cAAI,KAAK,OAAO,gBAAgB;AAC9B,kBAAM,IAAI,qBAAqB,QAAQ,cAAc;AAAA,cACnD,QAAQ;AAAA,YACV,CAAC;AAAA,UACH;AAEA,iBAAO;AAAA,QACT;AAAA,MACF;AAGA,UAAI,KAAK,OAAO,aAAa;AAC3B,cAAM,WAAW,GAAG,MAAM,IAAI,YAAY;AAC1C,aAAK,WAAW,IAAI,UAAU;AAAA,UAC5B;AAAA,UACA,WAAW,KAAK,IAAI,IAAI,KAAK,OAAO;AAAA,QACtC,CAAC;AAED,aAAK,OAAO,MAAM,gBAAgB;AAAA,UAChC;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,KAAK,OAAO;AAAA,QACnB,CAAC;AAAA,MACH;AAEA,WAAK,OAAO,KAAK,+BAA+B;AAAA,QAC9C;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,MACrB,CAAC;AAED,aAAO;AAAA,IAET,SAAS,OAAO;AACd,UAAI,iBAAiB,sBAAsB;AACzC,cAAM;AAAA,MACR;AAEA,WAAK,OAAO,MAAM,qBAAqB,OAAgB;AAAA,QACrD;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,UAAI,KAAK,OAAO,gBAAgB;AAC9B,cAAM,IAAI,qBAAqB,QAAQ,cAAc;AAAA,UACnD,QAAQ,iBAAiB,QAAQ,MAAM,UAAU;AAAA,UACjD;AAAA,QACF,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,SAAS,QAAgB,cAA8B;AAC7D,UAAM,OAAO,KAAK,OAAO,aACtB,QAAQ,WAAW,mBAAmB,MAAM,CAAC,EAC7C,QAAQ,iBAAiB,mBAAmB,YAAY,CAAC;AAE5D,WAAO,GAAG,KAAK,OAAO,gBAAgB,GAAG,IAAI;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAgB,cAA8C;AAC/E,SAAK,OAAO,KAAK,4BAA4B,EAAE,QAAQ,aAAa,CAAC;AAGrE,UAAM,WAAW,GAAG,MAAM,IAAI,YAAY;AAC1C,SAAK,WAAW,OAAO,QAAQ;AAE/B,WAAO,KAAK,aAAa,QAAQ,YAAY;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,OAAe,cAAwC;AACzE,QAAI,CAAC,KAAK,OAAO,eAAe;AAC9B,aAAO;AAAA,IACT;AAEA,QAAI;AACF,0BAAoB,KAAK;AACzB,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAA4B;AAChC,SAAK,OAAO,KAAK,gCAAgC;AAAA,MAC/C,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO;AAAA,IACzB,CAAC;AAGD,QAAI;AACF,UAAI,IAAI,KAAK,OAAO,gBAAgB;AAAA,IACtC,QAAQ;AACN,YAAM,IAAI,MAAM,6BAA6B,KAAK,OAAO,gBAAgB,EAAE;AAAA,IAC7E;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAC7B,SAAK,WAAW,MAAM;AACtB,SAAK,OAAO,KAAK,6BAA6B;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,WAAW,MAAM;AACtB,SAAK,OAAO,MAAM,qBAAqB;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAkD;AAChD,WAAO;AAAA,MACL,MAAM,KAAK,WAAW;AAAA,MACtB,MAAM,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;AAAA,IACzC;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/auth/providers/index.js

@@ -4,8 +4,20 @@ import {
 import {
   SimpleTokenResolver
 } from "./simple-resolver.js";
+import {
+  JWTAuthProvider
+} from "./jwt-provider.js";
+import {
+  JWTTokenResolver
+} from "./jwt-token-resolver.js";
+import {
+  APITokenResolver
+} from "./api-token-resolver.js";
 export {
+  APITokenResolver,
   EnvAuthProvider,
+  JWTAuthProvider,
+  JWTTokenResolver,
   SimpleTokenResolver
 };
 //# sourceMappingURL=index.js.map

package/dist/auth/providers/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/auth/providers/index.ts"],
-  "sourcesContent": ["/**\n * Authentication providers module exports\n */\n\n// Environment-based provider\nexport { \n  EnvAuthProvider,\n  type EnvAuthProviderConfig \n} from './env-provider.js';\n\n// Simple token resolver\nexport { \n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig \n} from './simple-resolver.js';\n"],
-  "mappings": "AAKA;AAAA,EACE;AAAA,OAEK;AAGP;AAAA,EACE;AAAA,OAEK;",
+  "sourcesContent": ["/**\n * Authentication providers module exports\n */\n\n// Environment-based provider\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig\n} from './env-provider.js';\n\n// Simple token resolver\nexport {\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig\n} from './simple-resolver.js';\n\n// JWT provider and resolver\nexport {\n  JWTAuthProvider,\n  type JWTAuthProviderConfig,\n  type JWTPayload\n} from './jwt-provider.js';\n\nexport {\n  JWTTokenResolver,\n  type JWTTokenResolverConfig\n} from './jwt-token-resolver.js';\n\n// API-based token resolver\nexport {\n  APITokenResolver,\n  type APITokenResolverConfig\n} from './api-token-resolver.js';\n"],
+  "mappings": "AAKA;AAAA,EACE;AAAA,OAEK;AAGP;AAAA,EACE;AAAA,OAEK;AAGP;AAAA,EACE;AAAA,OAGK;AAEP;AAAA,EACE;AAAA,OAEK;AAGP;AAAA,EACE;AAAA,OAEK;",
   "names": []
 }

package/dist/auth/providers/jwt-provider.js

@@ -0,0 +1,136 @@
+import { BaseAuthProvider } from "../base-provider.js";
+class JWTAuthProvider extends BaseAuthProvider {
+  jwtConfig;
+  /**
+   * Token cache for extracted tokens
+   * Maps userId → resourceType → token
+   */
+  tokenCache = /* @__PURE__ */ new Map();
+  constructor(config) {
+    super(config);
+    if (!config.jwtSecret) {
+      throw new Error("jwtSecret is required for JWTAuthProvider");
+    }
+    this.jwtConfig = {
+      ...config,
+      jwtSecret: config.jwtSecret,
+      algorithm: config.algorithm ?? "HS256",
+      extractTokens: config.extractTokens ?? true,
+      userIdClaim: config.userIdClaim ?? "sub",
+      tokensClaim: config.tokensClaim ?? "tokens",
+      validateExpiration: config.validateExpiration ?? true,
+      clockTolerance: config.clockTolerance ?? 0,
+      errorMessages: config.errorMessages ?? {},
+      cacheResults: config.cacheResults ?? false,
+      cacheTtl: config.cacheTtl ?? 6e4
+    };
+  }
+  /**
+   * Authenticate request by validating JWT
+   */
+  async doAuthenticate(context) {
+    const token = this.extractBearerToken(context);
+    if (!token) {
+      return this.createFailureResult(
+        this.jwtConfig.errorMessages?.noAuth || "No JWT token provided"
+      );
+    }
+    try {
+      const jwt = await import("jsonwebtoken");
+      const decoded = jwt.verify(token, this.jwtConfig.jwtSecret, {
+        algorithms: [this.jwtConfig.algorithm],
+        clockTolerance: this.jwtConfig.clockTolerance
+      });
+      const userId = decoded[this.jwtConfig.userIdClaim] || decoded.userId || decoded.sub;
+      if (!userId) {
+        return this.createFailureResult("JWT does not contain user ID");
+      }
+      this.logger.debug("JWT validated successfully", {
+        userId,
+        hasTokens: !!decoded[this.jwtConfig.tokensClaim]
+      });
+      if (this.jwtConfig.extractTokens && decoded[this.jwtConfig.tokensClaim]) {
+        const tokens = decoded[this.jwtConfig.tokensClaim];
+        const userTokens = /* @__PURE__ */ new Map();
+        for (const [resourceType, resourceToken] of Object.entries(tokens)) {
+          userTokens.set(resourceType, resourceToken);
+        }
+        this.tokenCache.set(userId, userTokens);
+        this.logger.debug("Extracted tokens from JWT", {
+          userId,
+          resourceTypes: Object.keys(tokens)
+        });
+      }
+      return this.createSuccessResult(userId, {
+        exp: decoded.exp,
+        iat: decoded.iat,
+        hasEmbeddedTokens: !!decoded[this.jwtConfig.tokensClaim]
+      });
+    } catch (error) {
+      this.logger.warn("JWT validation failed", {
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+      if (error instanceof Error) {
+        if (error.message.includes("expired")) {
+          return this.createFailureResult(
+            this.jwtConfig.errorMessages?.expiredAuth || "JWT token has expired"
+          );
+        }
+        if (error.message.includes("invalid")) {
+          return this.createFailureResult(
+            this.jwtConfig.errorMessages?.invalidAuth || "Invalid JWT token"
+          );
+        }
+      }
+      return this.createFailureResult("JWT validation failed");
+    }
+  }
+  /**
+   * Validate provider configuration
+   */
+  async validate() {
+    if (!this.jwtConfig.jwtSecret || this.jwtConfig.jwtSecret.length < 32) {
+      this.logger.error("JWT secret must be at least 32 characters");
+      return false;
+    }
+    try {
+      await import("jsonwebtoken");
+    } catch {
+      this.logger.error("jsonwebtoken package is required. Install it with: npm install jsonwebtoken");
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Get cached token for a user and resource
+   */
+  getCachedToken(userId, resourceType) {
+    return this.tokenCache.get(userId)?.get(resourceType) || null;
+  }
+  /**
+   * Clear token cache
+   */
+  clearTokenCache() {
+    this.tokenCache.clear();
+    this.logger.debug("Token cache cleared");
+  }
+  /**
+   * Get token cache statistics
+   */
+  getTokenCacheStats() {
+    const users = Array.from(this.tokenCache.entries()).map(([userId, tokens]) => ({
+      userId,
+      resourceTypes: Array.from(tokens.keys())
+    }));
+    const totalTokens = users.reduce((sum, user) => sum + user.resourceTypes.length, 0);
+    return {
+      userCount: this.tokenCache.size,
+      totalTokens,
+      users
+    };
+  }
+}
+export {
+  JWTAuthProvider
+};
+//# sourceMappingURL=jwt-provider.js.map

package/dist/auth/providers/jwt-provider.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/auth/providers/jwt-provider.ts"],
+  "sourcesContent": ["/**\n * JWT authentication provider\n * \n * Reference implementation for JWT-based authentication.\n * Validates JWT tokens and optionally extracts embedded resource tokens.\n */\n\nimport { BaseAuthProvider } from '../base-provider.js';\nimport type { AuthProviderConfig } from '../types.js';\nimport type { RequestContext, AuthResult } from '../../types.js';\nimport { AuthenticationError, MissingCredentialsError, InvalidTokenError } from '../../utils/errors.js';\n\n/**\n * JWT payload structure\n */\nexport interface JWTPayload {\n  /**\n   * User ID (standard JWT claim: 'sub' or custom 'userId')\n   */\n  sub?: string;\n  userId?: string;\n  \n  /**\n   * Optional: Embedded resource tokens\n   * { instagram: \"token1\", github: \"token2\" }\n   */\n  tokens?: Record<string, string>;\n  \n  /**\n   * Expiration time (standard JWT claim)\n   */\n  exp?: number;\n  \n  /**\n   * Issued at (standard JWT claim)\n   */\n  iat?: number;\n  \n  /**\n   * Additional custom claims\n   */\n  [key: string]: any;\n}\n\n/**\n * Configuration for JWTAuthProvider\n */\nexport interface JWTAuthProviderConfig extends AuthProviderConfig {\n  /**\n   * JWT secret for verification\n   */\n  jwtSecret: string;\n  \n  /**\n   * JWT algorithm\n   * @default 'HS256'\n   */\n  algorithm?: string;\n  \n  /**\n   * Whether to extract embedded tokens from JWT\n   * If true, tokens will be cached for JWTTokenResolver\n   * @default true\n   */\n  extractTokens?: boolean;\n  \n  /**\n   * Custom user ID claim name\n   * @default 'sub' (falls back to 'userId')\n   */\n  userIdClaim?: string;\n  \n  /**\n   * Custom tokens claim name\n   * @default 'tokens'\n   */\n  tokensClaim?: string;\n  \n  /**\n   * Whether to validate token expiration\n   * @default true\n   */\n  validateExpiration?: boolean;\n  \n  /**\n   * Clock tolerance in seconds for exp/nbf claims\n   * @default 0\n   */\n  clockTolerance?: number;\n}\n\n/**\n * JWT authentication provider\n * \n * Validates JWT tokens issued by the tenant manager.\n * Optionally extracts embedded resource tokens from the JWT payload.\n * \n * @example\n * ```typescript\n * // Basic usage\n * const provider = new JWTAuthProvider({\n *   jwtSecret: process.env.JWT_SECRET\n * });\n * \n * // With token extraction\n * const provider = new JWTAuthProvider({\n *   jwtSecret: process.env.JWT_SECRET,\n *   extractTokens: true\n * });\n * ```\n */\nexport class JWTAuthProvider extends BaseAuthProvider {\n  private jwtConfig: Required<JWTAuthProviderConfig>;\n  \n  /**\n   * Token cache for extracted tokens\n   * Maps userId \u2192 resourceType \u2192 token\n   */\n  public readonly tokenCache = new Map<string, Map<string, string>>();\n  \n  constructor(config: JWTAuthProviderConfig) {\n    super(config);\n    \n    if (!config.jwtSecret) {\n      throw new Error('jwtSecret is required for JWTAuthProvider');\n    }\n    \n    this.jwtConfig = {\n      ...config,\n      jwtSecret: config.jwtSecret,\n      algorithm: config.algorithm ?? 'HS256',\n      extractTokens: config.extractTokens ?? true,\n      userIdClaim: config.userIdClaim ?? 'sub',\n      tokensClaim: config.tokensClaim ?? 'tokens',\n      validateExpiration: config.validateExpiration ?? true,\n      clockTolerance: config.clockTolerance ?? 0,\n      errorMessages: config.errorMessages ?? {},\n      cacheResults: config.cacheResults ?? false,\n      cacheTtl: config.cacheTtl ?? 60000\n    };\n  }\n  \n  /**\n   * Authenticate request by validating JWT\n   */\n  protected async doAuthenticate(context: RequestContext): Promise<AuthResult> {\n    // Extract bearer token\n    const token = this.extractBearerToken(context);\n    \n    if (!token) {\n      return this.createFailureResult(\n        this.jwtConfig.errorMessages?.noAuth || 'No JWT token provided'\n      );\n    }\n    \n    try {\n      // Dynamically import jsonwebtoken (optional dependency)\n      // @ts-ignore - Dynamic import of optional dependency\n      const jwt = await import('jsonwebtoken');\n      \n      // Verify JWT\n      const decoded = jwt.verify(token, this.jwtConfig.jwtSecret, {\n        algorithms: [this.jwtConfig.algorithm as any],\n        clockTolerance: this.jwtConfig.clockTolerance\n      }) as JWTPayload;\n      \n      // Extract user ID\n      const userId = decoded[this.jwtConfig.userIdClaim] || decoded.userId || decoded.sub;\n      \n      if (!userId) {\n        return this.createFailureResult('JWT does not contain user ID');\n      }\n      \n      this.logger.debug('JWT validated successfully', {\n        userId,\n        hasTokens: !!decoded[this.jwtConfig.tokensClaim]\n      });\n      \n      // Extract embedded tokens if enabled\n      if (this.jwtConfig.extractTokens && decoded[this.jwtConfig.tokensClaim]) {\n        const tokens = decoded[this.jwtConfig.tokensClaim] as Record<string, string>;\n        \n        // Cache tokens for resolver\n        const userTokens = new Map<string, string>();\n        for (const [resourceType, resourceToken] of Object.entries(tokens)) {\n          userTokens.set(resourceType, resourceToken);\n        }\n        this.tokenCache.set(userId, userTokens);\n        \n        this.logger.debug('Extracted tokens from JWT', {\n          userId,\n          resourceTypes: Object.keys(tokens)\n        });\n      }\n      \n      return this.createSuccessResult(userId, {\n        exp: decoded.exp,\n        iat: decoded.iat,\n        hasEmbeddedTokens: !!decoded[this.jwtConfig.tokensClaim]\n      });\n      \n    } catch (error) {\n      this.logger.warn('JWT validation failed', {\n        error: error instanceof Error ? error.message : 'Unknown error'\n      });\n      \n      if (error instanceof Error) {\n        if (error.message.includes('expired')) {\n          return this.createFailureResult(\n            this.jwtConfig.errorMessages?.expiredAuth || 'JWT token has expired'\n          );\n        }\n        if (error.message.includes('invalid')) {\n          return this.createFailureResult(\n            this.jwtConfig.errorMessages?.invalidAuth || 'Invalid JWT token'\n          );\n        }\n      }\n      \n      return this.createFailureResult('JWT validation failed');\n    }\n  }\n  \n  /**\n   * Validate provider configuration\n   */\n  async validate(): Promise<boolean> {\n    if (!this.jwtConfig.jwtSecret || this.jwtConfig.jwtSecret.length < 32) {\n      this.logger.error('JWT secret must be at least 32 characters');\n      return false;\n    }\n    \n    // Try to import jsonwebtoken\n    try {\n      // @ts-ignore - Dynamic import of optional dependency\n      await import('jsonwebtoken');\n    } catch {\n      this.logger.error('jsonwebtoken package is required. Install it with: npm install jsonwebtoken');\n      return false;\n    }\n    \n    return true;\n  }\n  \n  /**\n   * Get cached token for a user and resource\n   */\n  getCachedToken(userId: string, resourceType: string): string | null {\n    return this.tokenCache.get(userId)?.get(resourceType) || null;\n  }\n  \n  /**\n   * Clear token cache\n   */\n  clearTokenCache(): void {\n    this.tokenCache.clear();\n    this.logger.debug('Token cache cleared');\n  }\n  \n  /**\n   * Get token cache statistics\n   */\n  getTokenCacheStats(): {\n    userCount: number;\n    totalTokens: number;\n    users: Array<{ userId: string; resourceTypes: string[] }>;\n  } {\n    const users = Array.from(this.tokenCache.entries()).map(([userId, tokens]) => ({\n      userId,\n      resourceTypes: Array.from(tokens.keys())\n    }));\n    \n    const totalTokens = users.reduce((sum, user) => sum + user.resourceTypes.length, 0);\n    \n    return {\n      userCount: this.tokenCache.size,\n      totalTokens,\n      users\n    };\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,wBAAwB;AAwG1B,MAAM,wBAAwB,iBAAiB;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,oBAAI,IAAiC;AAAA,EAElE,YAAY,QAA+B;AACzC,UAAM,MAAM;AAEZ,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AAEA,SAAK,YAAY;AAAA,MACf,GAAG;AAAA,MACH,WAAW,OAAO;AAAA,MAClB,WAAW,OAAO,aAAa;AAAA,MAC/B,eAAe,OAAO,iBAAiB;AAAA,MACvC,aAAa,OAAO,eAAe;AAAA,MACnC,aAAa,OAAO,eAAe;AAAA,MACnC,oBAAoB,OAAO,sBAAsB;AAAA,MACjD,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,eAAe,OAAO,iBAAiB,CAAC;AAAA,MACxC,cAAc,OAAO,gBAAgB;AAAA,MACrC,UAAU,OAAO,YAAY;AAAA,IAC/B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAgB,eAAe,SAA8C;AAE3E,UAAM,QAAQ,KAAK,mBAAmB,OAAO;AAE7C,QAAI,CAAC,OAAO;AACV,aAAO,KAAK;AAAA,QACV,KAAK,UAAU,eAAe,UAAU;AAAA,MAC1C;AAAA,IACF;AAEA,QAAI;AAGF,YAAM,MAAM,MAAM,OAAO,cAAc;AAGvC,YAAM,UAAU,IAAI,OAAO,OAAO,KAAK,UAAU,WAAW;AAAA,QAC1D,YAAY,CAAC,KAAK,UAAU,SAAgB;AAAA,QAC5C,gBAAgB,KAAK,UAAU;AAAA,MACjC,CAAC;AAGD,YAAM,SAAS,QAAQ,KAAK,UAAU,WAAW,KAAK,QAAQ,UAAU,QAAQ;AAEhF,UAAI,CAAC,QAAQ;AACX,eAAO,KAAK,oBAAoB,8BAA8B;AAAA,MAChE;AAEA,WAAK,OAAO,MAAM,8BAA8B;AAAA,QAC9C;AAAA,QACA,WAAW,CAAC,CAAC,QAAQ,KAAK,UAAU,WAAW;AAAA,MACjD,CAAC;AAGD,UAAI,KAAK,UAAU,iBAAiB,QAAQ,KAAK,UAAU,WAAW,GAAG;AACvE,cAAM,SAAS,QAAQ,KAAK,UAAU,WAAW;AAGjD,cAAM,aAAa,oBAAI,IAAoB;AAC3C,mBAAW,CAAC,cAAc,aAAa,KAAK,OAAO,QAAQ,MAAM,GAAG;AAClE,qBAAW,IAAI,cAAc,aAAa;AAAA,QAC5C;AACA,aAAK,WAAW,IAAI,QAAQ,UAAU;AAEtC,aAAK,OAAO,MAAM,6BAA6B;AAAA,UAC7C;AAAA,UACA,eAAe,OAAO,KAAK,MAAM;AAAA,QACnC,CAAC;AAAA,MACH;AAEA,aAAO,KAAK,oBAAoB,QAAQ;AAAA,QACtC,KAAK,QAAQ;AAAA,QACb,KAAK,QAAQ;AAAA,QACb,mBAAmB,CAAC,CAAC,QAAQ,KAAK,UAAU,WAAW;AAAA,MACzD,CAAC;AAAA,IAEH,SAAS,OAAO;AACd,WAAK,OAAO,KAAK,yBAAyB;AAAA,QACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAED,UAAI,iBAAiB,OAAO;AAC1B,YAAI,MAAM,QAAQ,SAAS,SAAS,GAAG;AACrC,iBAAO,KAAK;AAAA,YACV,KAAK,UAAU,eAAe,eAAe;AAAA,UAC/C;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,SAAS,SAAS,GAAG;AACrC,iBAAO,KAAK;AAAA,YACV,KAAK,UAAU,eAAe,eAAe;AAAA,UAC/C;AAAA,QACF;AAAA,MACF;AAEA,aAAO,KAAK,oBAAoB,uBAAuB;AAAA,IACzD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAA6B;AACjC,QAAI,CAAC,KAAK,UAAU,aAAa,KAAK,UAAU,UAAU,SAAS,IAAI;AACrE,WAAK,OAAO,MAAM,2CAA2C;AAC7D,aAAO;AAAA,IACT;AAGA,QAAI;AAEF,YAAM,OAAO,cAAc;AAAA,IAC7B,QAAQ;AACN,WAAK,OAAO,MAAM,6EAA6E;AAC/F,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,QAAgB,cAAqC;AAClE,WAAO,KAAK,WAAW,IAAI,MAAM,GAAG,IAAI,YAAY,KAAK;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAwB;AACtB,SAAK,WAAW,MAAM;AACtB,SAAK,OAAO,MAAM,qBAAqB;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA,EAKA,qBAIE;AACA,UAAM,QAAQ,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,MAAM,OAAO;AAAA,MAC7E;AAAA,MACA,eAAe,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,IACzC,EAAE;AAEF,UAAM,cAAc,MAAM,OAAO,CAAC,KAAK,SAAS,MAAM,KAAK,cAAc,QAAQ,CAAC;AAElF,WAAO;AAAA,MACL,WAAW,KAAK,WAAW;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/auth/providers/jwt-token-resolver.js

@@ -0,0 +1,94 @@
+import { TokenResolutionError } from "../../utils/errors.js";
+import { createLogger } from "../../utils/logger.js";
+class JWTTokenResolver {
+  config;
+  logger;
+  constructor(config) {
+    if (!config.authProvider) {
+      throw new Error("authProvider is required for JWTTokenResolver");
+    }
+    this.config = {
+      authProvider: config.authProvider,
+      throwOnMissing: config.throwOnMissing ?? true,
+      cacheTokens: config.cacheTokens ?? true,
+      cacheTtl: config.cacheTtl ?? 3e5,
+      autoRefresh: config.autoRefresh ?? false
+    };
+    this.logger = createLogger({ enabled: true, level: "info" });
+  }
+  /**
+   * Resolve token from JWT auth provider's cache
+   */
+  async resolveToken(userId, resourceType) {
+    const token = this.config.authProvider.getCachedToken(userId, resourceType);
+    if (!token) {
+      const errorMessage = `No ${resourceType} token found in JWT for user ${userId}`;
+      this.logger.warn("Token resolution failed", {
+        userId,
+        resourceType,
+        reason: "Token not found in JWT cache"
+      });
+      if (this.config.throwOnMissing) {
+        throw new TokenResolutionError(userId, resourceType, {
+          reason: "Token not embedded in JWT",
+          hint: "Ensure tenant manager includes tokens in JWT payload"
+        });
+      }
+      return null;
+    }
+    this.logger.debug("Token resolved from JWT cache", {
+      userId,
+      resourceType,
+      tokenLength: token.length
+    });
+    return token;
+  }
+  /**
+   * Refresh token (not supported for JWT-embedded tokens)
+   */
+  async refreshToken(userId, resourceType) {
+    this.logger.warn("Token refresh not supported for JWT-embedded tokens", {
+      userId,
+      resourceType,
+      hint: "User must obtain new JWT from tenant manager"
+    });
+    return null;
+  }
+  /**
+   * Validate token (checks if token exists in cache)
+   */
+  async validateToken(token, resourceType) {
+    return !!(token && token.length > 0);
+  }
+  /**
+   * Initialize resolver
+   */
+  async initialize() {
+    this.logger.info("JWTTokenResolver initialized", {
+      throwOnMissing: this.config.throwOnMissing
+    });
+  }
+  /**
+   * Cleanup resources
+   */
+  async cleanup() {
+    this.logger.info("JWTTokenResolver cleaned up");
+  }
+  /**
+   * Get available resource types for a user
+   */
+  getAvailableResources(userId) {
+    const userTokens = this.config.authProvider.tokenCache.get(userId);
+    return userTokens ? Array.from(userTokens.keys()) : [];
+  }
+  /**
+   * Check if token is available for a user and resource
+   */
+  hasToken(userId, resourceType) {
+    return !!this.config.authProvider.getCachedToken(userId, resourceType);
+  }
+}
+export {
+  JWTTokenResolver
+};
+//# sourceMappingURL=jwt-token-resolver.js.map

package/dist/auth/providers/jwt-token-resolver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/auth/providers/jwt-token-resolver.ts"],
+  "sourcesContent": ["/**\n * JWT token resolver\n * \n * Resolves tokens that were extracted from JWT by JWTAuthProvider.\n * Works in conjunction with JWTAuthProvider for JWT-embedded token approach.\n */\n\nimport type { ResourceTokenResolver, TokenResolverConfig } from '../types.js';\nimport type { JWTAuthProvider } from './jwt-provider.js';\nimport { TokenResolutionError } from '../../utils/errors.js';\nimport { createLogger, type Logger } from '../../utils/logger.js';\n\n/**\n * Configuration for JWTTokenResolver\n */\nexport interface JWTTokenResolverConfig extends TokenResolverConfig {\n  /**\n   * JWTAuthProvider instance that extracts tokens\n   */\n  authProvider: JWTAuthProvider;\n  \n  /**\n   * Whether to throw error if token is not found\n   * @default true\n   */\n  throwOnMissing?: boolean;\n}\n\n/**\n * JWT token resolver\n * \n * Resolves tokens that were cached by JWTAuthProvider during authentication.\n * This is used for the JWT-embedded token approach where the JWT contains\n * all resource tokens.\n * \n * @example\n * ```typescript\n * const authProvider = new JWTAuthProvider({\n *   jwtSecret: process.env.JWT_SECRET,\n *   extractTokens: true\n * });\n * \n * const tokenResolver = new JWTTokenResolver({\n *   authProvider\n * });\n * \n * // JWT structure:\n * // {\n * //   \"userId\": \"user-123\",\n * //   \"tokens\": {\n * //     \"instagram\": \"IGQVJXabc...\",\n * //     \"github\": \"ghp_abc123...\"\n * //   }\n * // }\n * ```\n */\nexport class JWTTokenResolver implements ResourceTokenResolver {\n  private config: Required<JWTTokenResolverConfig>;\n  private logger: Logger;\n  \n  constructor(config: JWTTokenResolverConfig) {\n    if (!config.authProvider) {\n      throw new Error('authProvider is required for JWTTokenResolver');\n    }\n    \n    this.config = {\n      authProvider: config.authProvider,\n      throwOnMissing: config.throwOnMissing ?? true,\n      cacheTokens: config.cacheTokens ?? true,\n      cacheTtl: config.cacheTtl ?? 300000,\n      autoRefresh: config.autoRefresh ?? false\n    };\n    \n    this.logger = createLogger({ enabled: true, level: 'info' });\n  }\n  \n  /**\n   * Resolve token from JWT auth provider's cache\n   */\n  async resolveToken(userId: string, resourceType: string): Promise<string | null> {\n    // Get token from auth provider's cache\n    const token = this.config.authProvider.getCachedToken(userId, resourceType);\n    \n    if (!token) {\n      const errorMessage = `No ${resourceType} token found in JWT for user ${userId}`;\n      \n      this.logger.warn('Token resolution failed', {\n        userId,\n        resourceType,\n        reason: 'Token not found in JWT cache'\n      });\n      \n      if (this.config.throwOnMissing) {\n        throw new TokenResolutionError(userId, resourceType, {\n          reason: 'Token not embedded in JWT',\n          hint: 'Ensure tenant manager includes tokens in JWT payload'\n        });\n      }\n      \n      return null;\n    }\n    \n    this.logger.debug('Token resolved from JWT cache', {\n      userId,\n      resourceType,\n      tokenLength: token.length\n    });\n    \n    return token;\n  }\n  \n  /**\n   * Refresh token (not supported for JWT-embedded tokens)\n   */\n  async refreshToken(userId: string, resourceType: string): Promise<string | null> {\n    this.logger.warn('Token refresh not supported for JWT-embedded tokens', {\n      userId,\n      resourceType,\n      hint: 'User must obtain new JWT from tenant manager'\n    });\n    \n    return null;\n  }\n  \n  /**\n   * Validate token (checks if token exists in cache)\n   */\n  async validateToken(token: string, resourceType: string): Promise<boolean> {\n    // Basic validation - just check if token is non-empty\n    return !!(token && token.length > 0);\n  }\n  \n  /**\n   * Initialize resolver\n   */\n  async initialize(): Promise<void> {\n    this.logger.info('JWTTokenResolver initialized', {\n      throwOnMissing: this.config.throwOnMissing\n    });\n  }\n  \n  /**\n   * Cleanup resources\n   */\n  async cleanup(): Promise<void> {\n    // Token cache is managed by auth provider\n    this.logger.info('JWTTokenResolver cleaned up');\n  }\n  \n  /**\n   * Get available resource types for a user\n   */\n  getAvailableResources(userId: string): string[] {\n    const userTokens = this.config.authProvider.tokenCache.get(userId);\n    return userTokens ? Array.from(userTokens.keys()) : [];\n  }\n  \n  /**\n   * Check if token is available for a user and resource\n   */\n  hasToken(userId: string, resourceType: string): boolean {\n    return !!this.config.authProvider.getCachedToken(userId, resourceType);\n  }\n}\n"],
+  "mappings": "AASA,SAAS,4BAA4B;AACrC,SAAS,oBAAiC;AA8CnC,MAAM,iBAAkD;AAAA,EACrD;AAAA,EACA;AAAA,EAER,YAAY,QAAgC;AAC1C,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,SAAK,SAAS;AAAA,MACZ,cAAc,OAAO;AAAA,MACrB,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,aAAa,OAAO,eAAe;AAAA,MACnC,UAAU,OAAO,YAAY;AAAA,MAC7B,aAAa,OAAO,eAAe;AAAA,IACrC;AAEA,SAAK,SAAS,aAAa,EAAE,SAAS,MAAM,OAAO,OAAO,CAAC;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAgB,cAA8C;AAE/E,UAAM,QAAQ,KAAK,OAAO,aAAa,eAAe,QAAQ,YAAY;AAE1E,QAAI,CAAC,OAAO;AACV,YAAM,eAAe,MAAM,YAAY,gCAAgC,MAAM;AAE7E,WAAK,OAAO,KAAK,2BAA2B;AAAA,QAC1C;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,KAAK,OAAO,gBAAgB;AAC9B,cAAM,IAAI,qBAAqB,QAAQ,cAAc;AAAA,UACnD,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAEA,SAAK,OAAO,MAAM,iCAAiC;AAAA,MACjD;AAAA,MACA;AAAA,MACA,aAAa,MAAM;AAAA,IACrB,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,QAAgB,cAA8C;AAC/E,SAAK,OAAO,KAAK,uDAAuD;AAAA,MACtE;AAAA,MACA;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAED,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,OAAe,cAAwC;AAEzE,WAAO,CAAC,EAAE,SAAS,MAAM,SAAS;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAA4B;AAChC,SAAK,OAAO,KAAK,gCAAgC;AAAA,MAC/C,gBAAgB,KAAK,OAAO;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAyB;AAE7B,SAAK,OAAO,KAAK,6BAA6B;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB,QAA0B;AAC9C,UAAM,aAAa,KAAK,OAAO,aAAa,WAAW,IAAI,MAAM;AACjE,WAAO,aAAa,MAAM,KAAK,WAAW,KAAK,CAAC,IAAI,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,SAAS,QAAgB,cAA+B;AACtD,WAAO,CAAC,CAAC,KAAK,OAAO,aAAa,eAAe,QAAQ,YAAY;AAAA,EACvE;AACF;",
+  "names": []
+}

package/dist/index.js

@@ -16,7 +16,10 @@ import {
 import { BaseAuthProvider } from "./auth/base-provider.js";
 import {
   EnvAuthProvider,
-  SimpleTokenResolver
+  SimpleTokenResolver,
+  JWTAuthProvider,
+  JWTTokenResolver,
+  APITokenResolver
 } from "./auth/providers/index.js";
 import {
   MCPAuthError,
@@ -57,6 +60,7 @@ import {
   validateAccessToken
 } from "./utils/index.js";
 export {
+  APITokenResolver,
   AuthenticatedMCPServer,
   AuthenticatedServerWrapper,
   AuthenticatedTool,
@@ -65,6 +69,8 @@ export {
   ConfigurationError,
   EnvAuthProvider,
   InvalidTokenError,
+  JWTAuthProvider,
+  JWTTokenResolver,
   LogLevel,
   Logger,
   MCPAuthError,

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["/**\n * @prmichaelsen/mcp-auth\n *\n * Authentication and multi-tenancy framework for MCP (Model Context Protocol) servers.\n *\n * Supports two complementary patterns:\n * 1. **Server Wrapping** - Wrap existing MCP servers without modification (MCP-level auth)\n * 2. **Tool-Level Auth** - Build new MCP servers with integrated auth\n *\n * @packageDocumentation\n */\n\n// ============================================================================\n// PATTERN 1: SERVER WRAPPING (MCP-Level Auth)\n// ============================================================================\n// Use this to wrap existing MCP servers without modifying them\n// Ideal for multi-tenant services that host multiple MCP servers\n\nexport {\n  wrapServer,\n  AuthenticatedServerWrapper,\n  type ServerWrapperConfig,\n  type MCPServerFactory,\n  type NormalizedServerWrapperConfig\n} from './wrapper/index.js';\n\n// ============================================================================\n// PATTERN 2: TOOL-LEVEL AUTH\n// ============================================================================\n// Use this to build new MCP servers with integrated authentication\n// Provides fine-grained control over auth per tool\n\nexport {\n  AuthenticatedMCPServer,\n  type ServerConfig,\n  type NormalizedServerConfig,\n  withAuth,\n  compose,\n  withLogging,\n  withRateLimit,\n  withTimeout,\n  withRetry,\n  type Tool,\n  AuthenticatedTool,\n  createAuthenticatedTool,\n  type AuthenticatedToolHandler\n} from './server/index.js';\n\n// ============================================================================\n// SHARED: CORE TYPES\n// ============================================================================\n\nexport type {\n  TransportType,\n  RequestContext,\n  AuthResult,\n  TransportConfig,\n  RateLimitConfig,\n  LoggingConfig,\n  MiddlewareConfig,\n  PoolingConfig,\n  Result,\n  AsyncFunction,\n  ToolHandler,\n  Middleware\n} from './types.js';\n\n// ============================================================================\n// SHARED: AUTHENTICATION\n// ============================================================================\n\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './auth/types.js';\n\nexport { BaseAuthProvider } from './auth/base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig\n} from './auth/providers/index.js';\n\n// Advanced Providers (to be implemented in Phase 8)\n// export { JWTAuthProvider } from './auth/providers/jwt-provider.js';\n// export { OAuthProvider } from './auth/providers/oauth-provider.js';\n// export { APIKeyProvider } from './auth/providers/apikey-provider.js';\n// export { DatabaseTokenResolver } from './auth/providers/database-resolver.js';\n\n// ============================================================================\n// SHARED: UTILITIES\n// ============================================================================\n\nexport {\n  // Errors\n  MCPAuthError,\n  AuthenticationError,\n  TokenResolutionError,\n  InvalidTokenError,\n  MissingCredentialsError,\n  ConfigurationError,\n  RateLimitError,\n  ServerPoolError,\n  TransportError,\n  ValidationError,\n  isMCPAuthError,\n  isAuthenticationError,\n  isTokenResolutionError,\n  isRateLimitError,\n  formatErrorForClient,\n  \n  // Logger\n  Logger,\n  LogLevel,\n  defaultLogger,\n  createLogger,\n  sanitizeForLogging,\n  \n  // Validation\n  validateNonEmptyString,\n  validateUrl,\n  validatePositiveNumber,\n  validatePort,\n  validateEnum,\n  validateObject,\n  validateFunction,\n  validateRequiredFields,\n  validateTransportConfig,\n  validateRateLimitConfig,\n  validateLoggingConfig,\n  validatePoolingConfig,\n  sanitizeString,\n  validateUserId,\n  validateResourceType,\n  validateAccessToken\n} from './utils/index.js';\n\n// Re-export types for convenience\nexport type { LogEntry } from './utils/logger.js';\n\n// ============================================================================\n// USAGE EXAMPLES\n// ============================================================================\n\n/**\n * @example Server Wrapping Pattern (MCP-Level Auth)\n * ```typescript\n * import { wrapServer, JWTAuthProvider, DatabaseTokenResolver } from '@prmichaelsen/mcp-auth';\n * import { createServer as createInstagramServer } from '@prmichaelsen/instagram-mcp';\n *\n * const wrapped = wrapServer({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken, userId),\n *   authProvider: new JWTAuthProvider({ jwtSecret: process.env.JWT_SECRET }),\n *   tokenResolver: new DatabaseTokenResolver({ database: {...} }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n *\n * await wrapped.start();\n * ```\n *\n * @example Tool-Level Auth Pattern\n * ```typescript\n * import { AuthenticatedMCPServer, withAuth, EnvAuthProvider } from '@prmichaelsen/mcp-auth';\n *\n * const server = new AuthenticatedMCPServer({\n *   name: 'my-server',\n *   authProvider: new EnvAuthProvider(),\n *   tokenResolver: new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' }),\n *   resourceType: 'myapi',\n *   transport: { type: 'stdio' }\n * });\n *\n * server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {\n *   const client = new MyAPIClient(accessToken);\n *   return client.getData(args);\n * }));\n *\n * await server.start();\n * ```\n */\n"],
-  "mappings": "AAkBA;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAQP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAEK;AAiCP,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,OAEK;AAYP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "sourcesContent": ["/**\n * @prmichaelsen/mcp-auth\n *\n * Authentication and multi-tenancy framework for MCP (Model Context Protocol) servers.\n *\n * Supports two complementary patterns:\n * 1. **Server Wrapping** - Wrap existing MCP servers without modification (MCP-level auth)\n * 2. **Tool-Level Auth** - Build new MCP servers with integrated auth\n *\n * @packageDocumentation\n */\n\n// ============================================================================\n// PATTERN 1: SERVER WRAPPING (MCP-Level Auth)\n// ============================================================================\n// Use this to wrap existing MCP servers without modifying them\n// Ideal for multi-tenant services that host multiple MCP servers\n\nexport {\n  wrapServer,\n  AuthenticatedServerWrapper,\n  type ServerWrapperConfig,\n  type MCPServerFactory,\n  type NormalizedServerWrapperConfig\n} from './wrapper/index.js';\n\n// ============================================================================\n// PATTERN 2: TOOL-LEVEL AUTH\n// ============================================================================\n// Use this to build new MCP servers with integrated authentication\n// Provides fine-grained control over auth per tool\n\nexport {\n  AuthenticatedMCPServer,\n  type ServerConfig,\n  type NormalizedServerConfig,\n  withAuth,\n  compose,\n  withLogging,\n  withRateLimit,\n  withTimeout,\n  withRetry,\n  type Tool,\n  AuthenticatedTool,\n  createAuthenticatedTool,\n  type AuthenticatedToolHandler\n} from './server/index.js';\n\n// ============================================================================\n// SHARED: CORE TYPES\n// ============================================================================\n\nexport type {\n  TransportType,\n  RequestContext,\n  AuthResult,\n  TransportConfig,\n  RateLimitConfig,\n  LoggingConfig,\n  MiddlewareConfig,\n  PoolingConfig,\n  Result,\n  AsyncFunction,\n  ToolHandler,\n  Middleware\n} from './types.js';\n\n// ============================================================================\n// SHARED: AUTHENTICATION\n// ============================================================================\n\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './auth/types.js';\n\nexport { BaseAuthProvider } from './auth/base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig,\n  JWTAuthProvider,\n  type JWTAuthProviderConfig,\n  type JWTPayload,\n  JWTTokenResolver,\n  type JWTTokenResolverConfig,\n  APITokenResolver,\n  type APITokenResolverConfig\n} from './auth/providers/index.js';\n\n// Note: OAuth and API Key providers can be added in the future if needed\n// For now, JWT-based auth with embedded or API-resolved tokens covers most use cases\n\n// ============================================================================\n// SHARED: UTILITIES\n// ============================================================================\n\nexport {\n  // Errors\n  MCPAuthError,\n  AuthenticationError,\n  TokenResolutionError,\n  InvalidTokenError,\n  MissingCredentialsError,\n  ConfigurationError,\n  RateLimitError,\n  ServerPoolError,\n  TransportError,\n  ValidationError,\n  isMCPAuthError,\n  isAuthenticationError,\n  isTokenResolutionError,\n  isRateLimitError,\n  formatErrorForClient,\n  \n  // Logger\n  Logger,\n  LogLevel,\n  defaultLogger,\n  createLogger,\n  sanitizeForLogging,\n  \n  // Validation\n  validateNonEmptyString,\n  validateUrl,\n  validatePositiveNumber,\n  validatePort,\n  validateEnum,\n  validateObject,\n  validateFunction,\n  validateRequiredFields,\n  validateTransportConfig,\n  validateRateLimitConfig,\n  validateLoggingConfig,\n  validatePoolingConfig,\n  sanitizeString,\n  validateUserId,\n  validateResourceType,\n  validateAccessToken\n} from './utils/index.js';\n\n// Re-export types for convenience\nexport type { LogEntry } from './utils/logger.js';\n\n// ============================================================================\n// USAGE EXAMPLES\n// ============================================================================\n\n/**\n * @example Server Wrapping Pattern (MCP-Level Auth)\n * ```typescript\n * import { wrapServer, JWTAuthProvider, DatabaseTokenResolver } from '@prmichaelsen/mcp-auth';\n * import { createServer as createInstagramServer } from '@prmichaelsen/instagram-mcp';\n *\n * const wrapped = wrapServer({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken, userId),\n *   authProvider: new JWTAuthProvider({ jwtSecret: process.env.JWT_SECRET }),\n *   tokenResolver: new DatabaseTokenResolver({ database: {...} }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n *\n * await wrapped.start();\n * ```\n *\n * @example Tool-Level Auth Pattern\n * ```typescript\n * import { AuthenticatedMCPServer, withAuth, EnvAuthProvider } from '@prmichaelsen/mcp-auth';\n *\n * const server = new AuthenticatedMCPServer({\n *   name: 'my-server',\n *   authProvider: new EnvAuthProvider(),\n *   tokenResolver: new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' }),\n *   resourceType: 'myapi',\n *   transport: { type: 'stdio' }\n * });\n *\n * server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {\n *   const client = new MyAPIClient(accessToken);\n *   return client.getData(args);\n * }));\n *\n * await server.start();\n * ```\n */\n"],
+  "mappings": "AAkBA;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAQP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAEK;AAiCP,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAGA;AAAA,EAEA;AAAA,OAEK;AASP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": []
 }

package/dist/wrapper/server-wrapper.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/wrapper/server-wrapper.ts"],
-  "sourcesContent": ["/**\n * Authenticated server wrapper implementation\n * \n * Wraps MCP servers with authentication and multi-tenancy support.\n * Uses ephemeral instances by default for security.\n */\n\nimport type { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport type { ServerWrapperConfig, NormalizedServerWrapperConfig } from './config.js';\nimport type { RequestContext } from '../types.js';\nimport { \n  AuthenticationError, \n  TokenResolutionError,\n  ConfigurationError,\n  TransportError\n} from '../utils/errors.js';\nimport { createLogger, type Logger } from '../utils/logger.js';\nimport {\n  validateRequiredFields,\n  validateResourceType,\n  validateUserId,\n  validateAccessToken,\n  validateTransportConfig\n} from '../utils/validation.js';\n\n/**\n * Server instance metadata (for pooled mode)\n */\ninterface ServerInstance {\n  server: Server;\n  accessToken: string;\n  userId: string;\n  createdAt: number;\n  lastUsed: number;\n}\n\n/**\n * Authenticated server wrapper\n * \n * Wraps an MCP server with authentication, automatically handling:\n * - Request authentication via AuthProvider\n * - Token resolution via ResourceTokenResolver\n * - Per-user server instance creation (ephemeral or pooled)\n * - Transport management (stdio, SSE, HTTP)\n * \n * @example\n * ```typescript\n * const wrapper = new AuthenticatedServerWrapper({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken),\n *   authProvider: new JWTAuthProvider({ ... }),\n *   tokenResolver: new DatabaseTokenResolver({ ... }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n * \n * await wrapper.start();\n * ```\n */\nexport class AuthenticatedServerWrapper {\n  private config: NormalizedServerWrapperConfig;\n  private logger: Logger;\n  private serverPool: Map<string, ServerInstance>;\n  private isRunning: boolean = false;\n  private cleanupTimer?: NodeJS.Timeout;\n  \n  constructor(config: ServerWrapperConfig) {\n    // Validate configuration\n    this.validateConfig(config);\n    \n    // Normalize configuration with defaults\n    this.config = this.normalizeConfig(config);\n    \n    // Initialize logger\n    this.logger = createLogger(this.config.middleware.logging);\n    \n    // Initialize server pool (only used in pooled mode)\n    this.serverPool = new Map();\n    \n    this.logger.info('AuthenticatedServerWrapper created', {\n      name: this.config.name,\n      resourceType: this.config.resourceType,\n      transport: this.config.transport.type,\n      instanceMode: this.config.instanceMode\n    });\n  }\n  \n  /**\n   * Validate wrapper configuration\n   */\n  private validateConfig(config: ServerWrapperConfig): void {\n    // Validate required fields manually for better type safety\n    if (!config.serverFactory) {\n      throw new ConfigurationError('serverFactory is required');\n    }\n    if (!config.authProvider) {\n      throw new ConfigurationError('authProvider is required');\n    }\n    if (!config.tokenResolver) {\n      throw new ConfigurationError('tokenResolver is required');\n    }\n    if (!config.resourceType) {\n      throw new ConfigurationError('resourceType is required');\n    }\n    if (!config.transport) {\n      throw new ConfigurationError('transport is required');\n    }\n    \n    validateResourceType(config.resourceType);\n    validateTransportConfig(config.transport);\n  }\n  \n  /**\n   * Normalize configuration with defaults\n   */\n  private normalizeConfig(config: ServerWrapperConfig): NormalizedServerWrapperConfig {\n    return {\n      serverFactory: config.serverFactory,\n      authProvider: config.authProvider,\n      tokenResolver: config.tokenResolver,\n      resourceType: config.resourceType,\n      transport: config.transport,\n      name: config.name ?? 'mcp-auth-wrapped-server',\n      version: config.version ?? '1.0.0',\n      instanceMode: config.instanceMode ?? 'ephemeral',\n      middleware: {\n        rateLimit: config.middleware?.rateLimit,\n        logging: config.middleware?.logging ?? { enabled: true, level: 'info' }\n      },\n      pooling: {\n        maxServersPerUser: config.pooling?.maxServersPerUser ?? 1,\n        idleTimeoutMs: config.pooling?.idleTimeoutMs ?? 300000,\n        maxTotalServers: config.pooling?.maxTotalServers ?? 100\n      },\n      requestTimeoutMs: config.requestTimeoutMs ?? 30000,\n      enableTracing: config.enableTracing ?? false\n    };\n  }\n  \n  /**\n   * Start the wrapped server\n   */\n  async start(): Promise<void> {\n    if (this.isRunning) {\n      throw new ConfigurationError('Server is already running');\n    }\n    \n    this.logger.info('Starting authenticated server wrapper', {\n      name: this.config.name,\n      transport: this.config.transport.type\n    });\n    \n    // Initialize auth provider\n    if (this.config.authProvider.initialize) {\n      await this.config.authProvider.initialize();\n      this.logger.debug('Auth provider initialized');\n    }\n    \n    // Initialize token resolver\n    if (this.config.tokenResolver.initialize) {\n      await this.config.tokenResolver.initialize();\n      this.logger.debug('Token resolver initialized');\n    }\n    \n    // Start appropriate transport\n    switch (this.config.transport.type) {\n      case 'stdio':\n        await this.startStdioTransport();\n        break;\n      case 'sse':\n        await this.startSSETransport();\n        break;\n      case 'http':\n        await this.startHTTPTransport();\n        break;\n      default:\n        throw new TransportError(`Unsupported transport type: ${this.config.transport.type}`);\n    }\n    \n    this.isRunning = true;\n    \n    this.logger.info('Server wrapper started successfully', {\n      name: this.config.name,\n      transport: this.config.transport.type,\n      port: this.config.transport.port\n    });\n  }\n  \n  /**\n   * Stop the wrapped server\n   */\n  async stop(): Promise<void> {\n    if (!this.isRunning) {\n      return;\n    }\n    \n    this.logger.info('Stopping server wrapper');\n    \n    // Clear cleanup timer\n    if (this.cleanupTimer) {\n      clearTimeout(this.cleanupTimer);\n      this.cleanupTimer = undefined;\n    }\n    \n    // Close all pooled servers\n    if (this.config.instanceMode === 'pooled') {\n      for (const [userId, instance] of this.serverPool.entries()) {\n        try {\n          await instance.server.close();\n          this.logger.debug('Closed pooled server instance', { userId });\n        } catch (error) {\n          this.logger.error('Error closing server instance', error as Error, { userId });\n        }\n      }\n      this.serverPool.clear();\n    }\n    \n    // Cleanup auth provider\n    if (this.config.authProvider.cleanup) {\n      await this.config.authProvider.cleanup();\n      this.logger.debug('Auth provider cleaned up');\n    }\n    \n    // Cleanup token resolver\n    if (this.config.tokenResolver.cleanup) {\n      await this.config.tokenResolver.cleanup();\n      this.logger.debug('Token resolver cleaned up');\n    }\n    \n    this.isRunning = false;\n    \n    this.logger.info('Server wrapper stopped');\n  }\n  \n  /**\n   * Handle incoming MCP request with authentication\n   */\n  private async handleRequest(request: any, context: RequestContext): Promise<any> {\n    const requestId = context.requestId ?? `req-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;\n    const requestLogger = this.logger.child({ requestId });\n    \n    try {\n      requestLogger.debug('Handling request', {\n        transport: context.transport,\n        hasHeaders: !!context.headers\n      });\n      \n      // 1. Authenticate request\n      const authResult = await this.config.authProvider.authenticate(context);\n      \n      if (!authResult.authenticated || !authResult.userId) {\n        requestLogger.warn('Authentication failed', {\n          error: authResult.error\n        });\n        throw new AuthenticationError(authResult.error || 'Authentication failed');\n      }\n      \n      const userId = validateUserId(authResult.userId);\n      \n      requestLogger.debug('Authentication successful', { userId });\n      \n      // 2. Resolve resource token\n      const accessToken = await this.config.tokenResolver.resolveToken(\n        userId,\n        this.config.resourceType\n      );\n      \n      if (!accessToken) {\n        requestLogger.warn('Token resolution failed', {\n          userId,\n          resourceType: this.config.resourceType\n        });\n        throw new TokenResolutionError(userId, this.config.resourceType);\n      }\n      \n      validateAccessToken(accessToken);\n      \n      requestLogger.debug('Token resolved', {\n        userId,\n        resourceType: this.config.resourceType,\n        tokenLength: accessToken.length\n      });\n      \n      // 3. Get server instance (ephemeral or pooled)\n      const server = await this.getServerInstance(userId, accessToken);\n      \n      // 4. Forward request to server\n      // Note: This is a simplified version. Actual implementation would need\n      // to properly handle MCP protocol messages\n      requestLogger.debug('Forwarding request to server instance', { userId });\n      \n      // TODO: Implement actual MCP request forwarding\n      // For now, this is a placeholder\n      const response = { success: true, userId, resourceType: this.config.resourceType };\n      \n      requestLogger.info('Request handled successfully', {\n        userId,\n        resourceType: this.config.resourceType\n      });\n      \n      return response;\n      \n    } catch (error) {\n      requestLogger.error('Request handling failed', error as Error);\n      throw error;\n    }\n  }\n  \n  /**\n   * Get server instance (ephemeral or from pool)\n   */\n  private async getServerInstance(userId: string, accessToken: string): Promise<Server> {\n    if (this.config.instanceMode === 'ephemeral') {\n      // Create new server instance for each request (recommended)\n      this.logger.debug('Creating ephemeral server instance', { userId });\n      return await this.config.serverFactory(accessToken, userId);\n    }\n    \n    // Pooled mode\n    return await this.getPooledServerInstance(userId, accessToken);\n  }\n  \n  /**\n   * Get or create pooled server instance\n   */\n  private async getPooledServerInstance(userId: string, accessToken: string): Promise<Server> {\n    // Check if we have a cached server instance\n    if (this.serverPool.has(userId)) {\n      const instance = this.serverPool.get(userId)!;\n      \n      // Check if token changed (user rotated token)\n      if (instance.accessToken !== accessToken) {\n        this.logger.info('Token changed, recreating server instance', { userId });\n        await instance.server.close();\n        this.serverPool.delete(userId);\n      } else {\n        // Reuse existing instance\n        instance.lastUsed = Date.now();\n        this.logger.debug('Reusing pooled server instance', { userId });\n        return instance.server;\n      }\n    }\n    \n    // Check pool size limit\n    if (this.serverPool.size >= this.config.pooling.maxTotalServers) {\n      this.logger.warn('Server pool limit reached, evicting oldest instance', {\n        poolSize: this.serverPool.size,\n        maxTotal: this.config.pooling.maxTotalServers\n      });\n      await this.evictOldestInstance();\n    }\n    \n    // Create new server instance\n    this.logger.info('Creating new pooled server instance', { userId });\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Add to pool\n    this.serverPool.set(userId, {\n      server,\n      accessToken,\n      userId,\n      createdAt: Date.now(),\n      lastUsed: Date.now()\n    });\n    \n    // Schedule cleanup if not already scheduled\n    if (!this.cleanupTimer) {\n      this.scheduleCleanup();\n    }\n    \n    return server;\n  }\n  \n  /**\n   * Evict oldest server instance from pool\n   */\n  private async evictOldestInstance(): Promise<void> {\n    let oldestUserId: string | null = null;\n    let oldestTime = Infinity;\n    \n    for (const [userId, instance] of this.serverPool.entries()) {\n      if (instance.lastUsed < oldestTime) {\n        oldestTime = instance.lastUsed;\n        oldestUserId = userId;\n      }\n    }\n    \n    if (oldestUserId) {\n      const instance = this.serverPool.get(oldestUserId)!;\n      await instance.server.close();\n      this.serverPool.delete(oldestUserId);\n      \n      this.logger.debug('Evicted oldest server instance', {\n        userId: oldestUserId,\n        age: Date.now() - instance.createdAt\n      });\n    }\n  }\n  \n  /**\n   * Schedule cleanup of idle server instances\n   */\n  private scheduleCleanup(): void {\n    const timeout = this.config.pooling.idleTimeoutMs;\n    \n    this.cleanupTimer = setTimeout(async () => {\n      const now = Date.now();\n      const toRemove: string[] = [];\n      \n      for (const [userId, instance] of this.serverPool.entries()) {\n        if (now - instance.lastUsed > timeout) {\n          toRemove.push(userId);\n        }\n      }\n      \n      for (const userId of toRemove) {\n        const instance = this.serverPool.get(userId)!;\n        try {\n          await instance.server.close();\n          this.serverPool.delete(userId);\n          \n          this.logger.debug('Cleaned up idle server instance', {\n            userId,\n            idleTime: now - instance.lastUsed\n          });\n        } catch (error) {\n          this.logger.error('Error cleaning up server instance', error as Error, { userId });\n        }\n      }\n      \n      // Reschedule if pool is not empty\n      if (this.serverPool.size > 0) {\n        this.scheduleCleanup();\n      } else {\n        this.cleanupTimer = undefined;\n      }\n    }, timeout);\n  }\n  \n  /**\n   * Start stdio transport (single-user mode)\n   */\n  private async startStdioTransport(): Promise<void> {\n    this.logger.info('Starting stdio transport');\n    \n    // For stdio, we use environment variable for token\n    const envVar = `${this.config.resourceType.toUpperCase()}_ACCESS_TOKEN`;\n    const accessToken = process.env[envVar];\n    \n    if (!accessToken) {\n      throw new ConfigurationError(\n        `${envVar} environment variable required for stdio mode`\n      );\n    }\n    \n    const userId = 'stdio-user';\n    \n    // Create server instance\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Connect to stdio transport\n    const transport = new StdioServerTransport();\n    await server.connect(transport);\n    \n    this.logger.info('Stdio transport started', { userId });\n  }\n  \n  /**\n   * Start SSE transport (multi-user mode)\n   */\n  private async startSSETransport(): Promise<void> {\n    this.logger.info('Starting SSE transport', {\n      port: this.config.transport.port,\n      basePath: this.config.transport.basePath\n    });\n    \n    // Import express dynamically\n    const express = await import('express');\n    const app = express.default();\n    \n    // Enable JSON parsing\n    app.use(express.json());\n    \n    // Enable CORS if configured\n    if (this.config.transport.cors) {\n      const cors = await import('cors');\n      app.use(cors.default({\n        origin: this.config.transport.corsOrigin || '*'\n      }));\n    }\n    \n    const basePath = this.config.transport.basePath || '/mcp';\n    \n    // SSE endpoint for MCP messages\n    app.post(`${basePath}/message`, async (req: any, res: any) => {\n      try {\n        const context: RequestContext = {\n          headers: req.headers as Record<string, string>,\n          transport: 'sse',\n          timestamp: new Date(),\n          requestId: req.headers['x-request-id'] as string | undefined\n        };\n        \n        const result = await this.handleRequest(req.body, context);\n        res.json(result);\n        \n      } catch (error) {\n        this.logger.error('SSE request failed', error as Error);\n        \n        if (error instanceof AuthenticationError || error instanceof TokenResolutionError) {\n          res.status(error.statusCode).json({\n            error: error.message,\n            code: error.code\n          });\n        } else {\n          res.status(500).json({\n            error: 'Internal server error',\n            code: 'INTERNAL_ERROR'\n          });\n        }\n      }\n    });\n    \n    // Health check endpoint\n    app.get(`${basePath}/health`, (req: any, res: any) => {\n      res.json({\n        status: 'healthy',\n        name: this.config.name,\n        version: this.config.version,\n        resourceType: this.config.resourceType,\n        instanceMode: this.config.instanceMode,\n        poolSize: this.serverPool.size\n      });\n    });\n    \n    // Start server\n    const port = this.config.transport.port || 3000;\n    const host = this.config.transport.host || '0.0.0.0';\n    \n    await new Promise<void>((resolve) => {\n      app.listen(port, host, () => {\n        this.logger.info('SSE transport listening', {\n          host,\n          port,\n          basePath,\n          url: `http://${host}:${port}${basePath}`\n        });\n        resolve();\n      });\n    });\n  }\n  \n  /**\n   * Start HTTP transport (multi-user mode)\n   */\n  private async startHTTPTransport(): Promise<void> {\n    this.logger.info('Starting HTTP transport', {\n      port: this.config.transport.port\n    });\n    \n    // HTTP transport is similar to SSE but with different endpoint structure\n    // For now, delegate to SSE implementation\n    await this.startSSETransport();\n  }\n  \n  /**\n   * Get server pool statistics\n   */\n  getPoolStats(): {\n    size: number;\n    instances: Array<{\n      userId: string;\n      createdAt: number;\n      lastUsed: number;\n      age: number;\n      idleTime: number;\n    }>;\n  } {\n    const now = Date.now();\n    const instances = Array.from(this.serverPool.entries()).map(([userId, instance]) => ({\n      userId,\n      createdAt: instance.createdAt,\n      lastUsed: instance.lastUsed,\n      age: now - instance.createdAt,\n      idleTime: now - instance.lastUsed\n    }));\n    \n    return {\n      size: this.serverPool.size,\n      instances\n    };\n  }\n  \n  /**\n   * Check if server is running\n   */\n  isServerRunning(): boolean {\n    return this.isRunning;\n  }\n}\n"],
-  "mappings": "AAQA,SAAS,4BAA4B;AAGrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAiC;AAC1C;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmCA,MAAM,2BAA2B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAqB;AAAA,EACrB;AAAA,EAER,YAAY,QAA6B;AAEvC,SAAK,eAAe,MAAM;AAG1B,SAAK,SAAS,KAAK,gBAAgB,MAAM;AAGzC,SAAK,SAAS,aAAa,KAAK,OAAO,WAAW,OAAO;AAGzD,SAAK,aAAa,oBAAI,IAAI;AAE1B,SAAK,OAAO,KAAK,sCAAsC;AAAA,MACrD,MAAM,KAAK,OAAO;AAAA,MAClB,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,cAAc,KAAK,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,QAAmC;AAExD,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI,mBAAmB,uBAAuB;AAAA,IACtD;AAEA,yBAAqB,OAAO,YAAY;AACxC,4BAAwB,OAAO,SAAS;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,QAA4D;AAClF,WAAO;AAAA,MACL,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY;AAAA,QACV,WAAW,OAAO,YAAY;AAAA,QAC9B,SAAS,OAAO,YAAY,WAAW,EAAE,SAAS,MAAM,OAAO,OAAO;AAAA,MACxE;AAAA,MACA,SAAS;AAAA,QACP,mBAAmB,OAAO,SAAS,qBAAqB;AAAA,QACxD,eAAe,OAAO,SAAS,iBAAiB;AAAA,QAChD,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACtD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,MAC7C,eAAe,OAAO,iBAAiB;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAuB;AAC3B,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,SAAK,OAAO,KAAK,yCAAyC;AAAA,MACxD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,IACnC,CAAC;AAGD,QAAI,KAAK,OAAO,aAAa,YAAY;AACvC,YAAM,KAAK,OAAO,aAAa,WAAW;AAC1C,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAGA,QAAI,KAAK,OAAO,cAAc,YAAY;AACxC,YAAM,KAAK,OAAO,cAAc,WAAW;AAC3C,WAAK,OAAO,MAAM,4BAA4B;AAAA,IAChD;AAGA,YAAQ,KAAK,OAAO,UAAU,MAAM;AAAA,MAClC,KAAK;AACH,cAAM,KAAK,oBAAoB;AAC/B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,kBAAkB;AAC7B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,mBAAmB;AAC9B;AAAA,MACF;AACE,cAAM,IAAI,eAAe,+BAA+B,KAAK,OAAO,UAAU,IAAI,EAAE;AAAA,IACxF;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,uCAAuC;AAAA,MACtD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,WAAW;AACnB;AAAA,IACF;AAEA,SAAK,OAAO,KAAK,yBAAyB;AAG1C,QAAI,KAAK,cAAc;AACrB,mBAAa,KAAK,YAAY;AAC9B,WAAK,eAAe;AAAA,IACtB;AAGA,QAAI,KAAK,OAAO,iBAAiB,UAAU;AACzC,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,OAAO,MAAM,iCAAiC,EAAE,OAAO,CAAC;AAAA,QAC/D,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,iCAAiC,OAAgB,EAAE,OAAO,CAAC;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,WAAW,MAAM;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,aAAa,SAAS;AACpC,YAAM,KAAK,OAAO,aAAa,QAAQ;AACvC,WAAK,OAAO,MAAM,0BAA0B;AAAA,IAC9C;AAGA,QAAI,KAAK,OAAO,cAAc,SAAS;AACrC,YAAM,KAAK,OAAO,cAAc,QAAQ;AACxC,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,wBAAwB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,SAAc,SAAuC;AAC/E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AACnG,UAAM,gBAAgB,KAAK,OAAO,MAAM,EAAE,UAAU,CAAC;AAErD,QAAI;AACF,oBAAc,MAAM,oBAAoB;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,YAAY,CAAC,CAAC,QAAQ;AAAA,MACxB,CAAC;AAGD,YAAM,aAAa,MAAM,KAAK,OAAO,aAAa,aAAa,OAAO;AAEtE,UAAI,CAAC,WAAW,iBAAiB,CAAC,WAAW,QAAQ;AACnD,sBAAc,KAAK,yBAAyB;AAAA,UAC1C,OAAO,WAAW;AAAA,QACpB,CAAC;AACD,cAAM,IAAI,oBAAoB,WAAW,SAAS,uBAAuB;AAAA,MAC3E;AAEA,YAAM,SAAS,eAAe,WAAW,MAAM;AAE/C,oBAAc,MAAM,6BAA6B,EAAE,OAAO,CAAC;AAG3D,YAAM,cAAc,MAAM,KAAK,OAAO,cAAc;AAAA,QAClD;AAAA,QACA,KAAK,OAAO;AAAA,MACd;AAEA,UAAI,CAAC,aAAa;AAChB,sBAAc,KAAK,2BAA2B;AAAA,UAC5C;AAAA,UACA,cAAc,KAAK,OAAO;AAAA,QAC5B,CAAC;AACD,cAAM,IAAI,qBAAqB,QAAQ,KAAK,OAAO,YAAY;AAAA,MACjE;AAEA,0BAAoB,WAAW;AAE/B,oBAAc,MAAM,kBAAkB;AAAA,QACpC;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,QAC1B,aAAa,YAAY;AAAA,MAC3B,CAAC;AAGD,YAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ,WAAW;AAK/D,oBAAc,MAAM,yCAAyC,EAAE,OAAO,CAAC;AAIvE,YAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,cAAc,KAAK,OAAO,aAAa;AAEjF,oBAAc,KAAK,gCAAgC;AAAA,QACjD;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAED,aAAO;AAAA,IAET,SAAS,OAAO;AACd,oBAAc,MAAM,2BAA2B,KAAc;AAC7D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,QAAgB,aAAsC;AACpF,QAAI,KAAK,OAAO,iBAAiB,aAAa;AAE5C,WAAK,OAAO,MAAM,sCAAsC,EAAE,OAAO,CAAC;AAClE,aAAO,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAAA,IAC5D;AAGA,WAAO,MAAM,KAAK,wBAAwB,QAAQ,WAAW;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBAAwB,QAAgB,aAAsC;AAE1F,QAAI,KAAK,WAAW,IAAI,MAAM,GAAG;AAC/B,YAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAG3C,UAAI,SAAS,gBAAgB,aAAa;AACxC,aAAK,OAAO,KAAK,6CAA6C,EAAE,OAAO,CAAC;AACxE,cAAM,SAAS,OAAO,MAAM;AAC5B,aAAK,WAAW,OAAO,MAAM;AAAA,MAC/B,OAAO;AAEL,iBAAS,WAAW,KAAK,IAAI;AAC7B,aAAK,OAAO,MAAM,kCAAkC,EAAE,OAAO,CAAC;AAC9D,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,QAAQ,KAAK,OAAO,QAAQ,iBAAiB;AAC/D,WAAK,OAAO,KAAK,uDAAuD;AAAA,QACtE,UAAU,KAAK,WAAW;AAAA,QAC1B,UAAU,KAAK,OAAO,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,KAAK,oBAAoB;AAAA,IACjC;AAGA,SAAK,OAAO,KAAK,uCAAuC,EAAE,OAAO,CAAC;AAClE,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,SAAK,WAAW,IAAI,QAAQ;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AAGD,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,gBAAgB;AAAA,IACvB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,QAAI,eAA8B;AAClC,QAAI,aAAa;AAEjB,eAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,UAAI,SAAS,WAAW,YAAY;AAClC,qBAAa,SAAS;AACtB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,WAAW,KAAK,WAAW,IAAI,YAAY;AACjD,YAAM,SAAS,OAAO,MAAM;AAC5B,WAAK,WAAW,OAAO,YAAY;AAEnC,WAAK,OAAO,MAAM,kCAAkC;AAAA,QAClD,QAAQ;AAAA,QACR,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAwB;AAC9B,UAAM,UAAU,KAAK,OAAO,QAAQ;AAEpC,SAAK,eAAe,WAAW,YAAY;AACzC,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,WAAqB,CAAC;AAE5B,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI,MAAM,SAAS,WAAW,SAAS;AACrC,mBAAS,KAAK,MAAM;AAAA,QACtB;AAAA,MACF;AAEA,iBAAW,UAAU,UAAU;AAC7B,cAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAC3C,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,WAAW,OAAO,MAAM;AAE7B,eAAK,OAAO,MAAM,mCAAmC;AAAA,YACnD;AAAA,YACA,UAAU,MAAM,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,qCAAqC,OAAgB,EAAE,OAAO,CAAC;AAAA,QACnF;AAAA,MACF;AAGA,UAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,aAAK,gBAAgB;AAAA,MACvB,OAAO;AACL,aAAK,eAAe;AAAA,MACtB;AAAA,IACF,GAAG,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,SAAK,OAAO,KAAK,0BAA0B;AAG3C,UAAM,SAAS,GAAG,KAAK,OAAO,aAAa,YAAY,CAAC;AACxD,UAAM,cAAc,QAAQ,IAAI,MAAM;AAEtC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS;AAGf,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,UAAM,YAAY,IAAI,qBAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,SAAK,OAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBAAmC;AAC/C,SAAK,OAAO,KAAK,0BAA0B;AAAA,MACzC,MAAM,KAAK,OAAO,UAAU;AAAA,MAC5B,UAAU,KAAK,OAAO,UAAU;AAAA,IAClC,CAAC;AAGD,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,MAAM,QAAQ,QAAQ;AAG5B,QAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,QAAI,KAAK,OAAO,UAAU,MAAM;AAC9B,YAAM,OAAO,MAAM,OAAO,MAAM;AAChC,UAAI,IAAI,KAAK,QAAQ;AAAA,QACnB,QAAQ,KAAK,OAAO,UAAU,cAAc;AAAA,MAC9C,CAAC,CAAC;AAAA,IACJ;AAEA,UAAM,WAAW,KAAK,OAAO,UAAU,YAAY;AAGnD,QAAI,KAAK,GAAG,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC5D,UAAI;AACF,cAAM,UAA0B;AAAA,UAC9B,SAAS,IAAI;AAAA,UACb,WAAW;AAAA,UACX,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,IAAI,QAAQ,cAAc;AAAA,QACvC;AAEA,cAAM,SAAS,MAAM,KAAK,cAAc,IAAI,MAAM,OAAO;AACzD,YAAI,KAAK,MAAM;AAAA,MAEjB,SAAS,OAAO;AACd,aAAK,OAAO,MAAM,sBAAsB,KAAc;AAEtD,YAAI,iBAAiB,uBAAuB,iBAAiB,sBAAsB;AACjF,cAAI,OAAO,MAAM,UAAU,EAAE,KAAK;AAAA,YAChC,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,UACd,CAAC;AAAA,QACH,OAAO;AACL,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,GAAG,QAAQ,WAAW,CAAC,KAAU,QAAa;AACpD,UAAI,KAAK;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,KAAK,OAAO;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,QACrB,cAAc,KAAK,OAAO;AAAA,QAC1B,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAGD,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAC3C,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAE3C,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,aAAK,OAAO,KAAK,2BAA2B;AAAA,UAC1C;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU,IAAI,IAAI,IAAI,GAAG,QAAQ;AAAA,QACxC,CAAC;AACD,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBAAoC;AAChD,SAAK,OAAO,KAAK,2BAA2B;AAAA,MAC1C,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAID,UAAM,KAAK,kBAAkB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,eASE;AACA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,QAAQ,OAAO;AAAA,MACnF;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS;AAAA,MACnB,KAAK,MAAM,SAAS;AAAA,MACpB,UAAU,MAAM,SAAS;AAAA,IAC3B,EAAE;AAEF,WAAO;AAAA,MACL,MAAM,KAAK,WAAW;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,kBAA2B;AACzB,WAAO,KAAK;AAAA,EACd;AACF;",
+  "sourcesContent": ["/**\n * Authenticated server wrapper implementation\n *\n * Wraps MCP servers with authentication and multi-tenancy support.\n * Uses ephemeral instances by default for security.\n */\n\nimport type { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport type { ServerWrapperConfig, NormalizedServerWrapperConfig } from './config.js';\nimport type { RequestContext } from '../types.js';\nimport { \n  AuthenticationError, \n  TokenResolutionError,\n  ConfigurationError,\n  TransportError\n} from '../utils/errors.js';\nimport { createLogger, type Logger } from '../utils/logger.js';\nimport {\n  validateRequiredFields,\n  validateResourceType,\n  validateUserId,\n  validateAccessToken,\n  validateTransportConfig\n} from '../utils/validation.js';\n\n/**\n * Server instance metadata (for pooled mode)\n */\ninterface ServerInstance {\n  server: Server;\n  accessToken: string;\n  userId: string;\n  createdAt: number;\n  lastUsed: number;\n}\n\n/**\n * Authenticated server wrapper\n * \n * Wraps an MCP server with authentication, automatically handling:\n * - Request authentication via AuthProvider\n * - Token resolution via ResourceTokenResolver\n * - Per-user server instance creation (ephemeral or pooled)\n * - Transport management (stdio, SSE, HTTP)\n * \n * @example\n * ```typescript\n * const wrapper = new AuthenticatedServerWrapper({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken),\n *   authProvider: new JWTAuthProvider({ ... }),\n *   tokenResolver: new DatabaseTokenResolver({ ... }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n * \n * await wrapper.start();\n * ```\n */\nexport class AuthenticatedServerWrapper {\n  private config: NormalizedServerWrapperConfig;\n  private logger: Logger;\n  private serverPool: Map<string, ServerInstance>;\n  private isRunning: boolean = false;\n  private cleanupTimer?: NodeJS.Timeout;\n  \n  constructor(config: ServerWrapperConfig) {\n    // Validate configuration\n    this.validateConfig(config);\n    \n    // Normalize configuration with defaults\n    this.config = this.normalizeConfig(config);\n    \n    // Initialize logger\n    this.logger = createLogger(this.config.middleware.logging);\n    \n    // Initialize server pool (only used in pooled mode)\n    this.serverPool = new Map();\n    \n    this.logger.info('AuthenticatedServerWrapper created', {\n      name: this.config.name,\n      resourceType: this.config.resourceType,\n      transport: this.config.transport.type,\n      instanceMode: this.config.instanceMode\n    });\n  }\n  \n  /**\n   * Validate wrapper configuration\n   */\n  private validateConfig(config: ServerWrapperConfig): void {\n    // Validate required fields manually for better type safety\n    if (!config.serverFactory) {\n      throw new ConfigurationError('serverFactory is required');\n    }\n    if (!config.authProvider) {\n      throw new ConfigurationError('authProvider is required');\n    }\n    if (!config.tokenResolver) {\n      throw new ConfigurationError('tokenResolver is required');\n    }\n    if (!config.resourceType) {\n      throw new ConfigurationError('resourceType is required');\n    }\n    if (!config.transport) {\n      throw new ConfigurationError('transport is required');\n    }\n    \n    validateResourceType(config.resourceType);\n    validateTransportConfig(config.transport);\n  }\n  \n  /**\n   * Normalize configuration with defaults\n   */\n  private normalizeConfig(config: ServerWrapperConfig): NormalizedServerWrapperConfig {\n    return {\n      serverFactory: config.serverFactory,\n      authProvider: config.authProvider,\n      tokenResolver: config.tokenResolver,\n      resourceType: config.resourceType,\n      transport: config.transport,\n      name: config.name ?? 'mcp-auth-wrapped-server',\n      version: config.version ?? '1.0.0',\n      instanceMode: config.instanceMode ?? 'ephemeral',\n      middleware: {\n        rateLimit: config.middleware?.rateLimit,\n        logging: config.middleware?.logging ?? { enabled: true, level: 'info' }\n      },\n      pooling: {\n        maxServersPerUser: config.pooling?.maxServersPerUser ?? 1,\n        idleTimeoutMs: config.pooling?.idleTimeoutMs ?? 300000,\n        maxTotalServers: config.pooling?.maxTotalServers ?? 100\n      },\n      requestTimeoutMs: config.requestTimeoutMs ?? 30000,\n      enableTracing: config.enableTracing ?? false\n    };\n  }\n  \n  /**\n   * Start the wrapped server\n   */\n  async start(): Promise<void> {\n    if (this.isRunning) {\n      throw new ConfigurationError('Server is already running');\n    }\n    \n    this.logger.info('Starting authenticated server wrapper', {\n      name: this.config.name,\n      transport: this.config.transport.type\n    });\n    \n    // Initialize auth provider\n    if (this.config.authProvider.initialize) {\n      await this.config.authProvider.initialize();\n      this.logger.debug('Auth provider initialized');\n    }\n    \n    // Initialize token resolver\n    if (this.config.tokenResolver.initialize) {\n      await this.config.tokenResolver.initialize();\n      this.logger.debug('Token resolver initialized');\n    }\n    \n    // Start appropriate transport\n    switch (this.config.transport.type) {\n      case 'stdio':\n        await this.startStdioTransport();\n        break;\n      case 'sse':\n        await this.startSSETransport();\n        break;\n      case 'http':\n        await this.startHTTPTransport();\n        break;\n      default:\n        throw new TransportError(`Unsupported transport type: ${this.config.transport.type}`);\n    }\n    \n    this.isRunning = true;\n    \n    this.logger.info('Server wrapper started successfully', {\n      name: this.config.name,\n      transport: this.config.transport.type,\n      port: this.config.transport.port\n    });\n  }\n  \n  /**\n   * Stop the wrapped server\n   */\n  async stop(): Promise<void> {\n    if (!this.isRunning) {\n      return;\n    }\n    \n    this.logger.info('Stopping server wrapper');\n    \n    // Clear cleanup timer\n    if (this.cleanupTimer) {\n      clearTimeout(this.cleanupTimer);\n      this.cleanupTimer = undefined;\n    }\n    \n    // Close all pooled servers\n    if (this.config.instanceMode === 'pooled') {\n      for (const [userId, instance] of this.serverPool.entries()) {\n        try {\n          await instance.server.close();\n          this.logger.debug('Closed pooled server instance', { userId });\n        } catch (error) {\n          this.logger.error('Error closing server instance', error as Error, { userId });\n        }\n      }\n      this.serverPool.clear();\n    }\n    \n    // Cleanup auth provider\n    if (this.config.authProvider.cleanup) {\n      await this.config.authProvider.cleanup();\n      this.logger.debug('Auth provider cleaned up');\n    }\n    \n    // Cleanup token resolver\n    if (this.config.tokenResolver.cleanup) {\n      await this.config.tokenResolver.cleanup();\n      this.logger.debug('Token resolver cleaned up');\n    }\n    \n    this.isRunning = false;\n    \n    this.logger.info('Server wrapper stopped');\n  }\n  \n  /**\n   * Handle incoming MCP request with authentication\n   */\n  private async handleRequest(request: any, context: RequestContext): Promise<any> {\n    const requestId = context.requestId ?? `req-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;\n    const requestLogger = this.logger.child({ requestId });\n    \n    try {\n      requestLogger.debug('Handling request', {\n        transport: context.transport,\n        hasHeaders: !!context.headers\n      });\n      \n      // 1. Authenticate request\n      const authResult = await this.config.authProvider.authenticate(context);\n      \n      if (!authResult.authenticated || !authResult.userId) {\n        requestLogger.warn('Authentication failed', {\n          error: authResult.error\n        });\n        throw new AuthenticationError(authResult.error || 'Authentication failed');\n      }\n      \n      const userId = validateUserId(authResult.userId);\n      \n      requestLogger.debug('Authentication successful', { userId });\n      \n      // 2. Resolve resource token\n      const accessToken = await this.config.tokenResolver.resolveToken(\n        userId,\n        this.config.resourceType\n      );\n      \n      if (!accessToken) {\n        requestLogger.warn('Token resolution failed', {\n          userId,\n          resourceType: this.config.resourceType\n        });\n        throw new TokenResolutionError(userId, this.config.resourceType);\n      }\n      \n      validateAccessToken(accessToken);\n      \n      requestLogger.debug('Token resolved', {\n        userId,\n        resourceType: this.config.resourceType,\n        tokenLength: accessToken.length\n      });\n      \n      // 3. Get server instance (ephemeral or pooled)\n      const server = await this.getServerInstance(userId, accessToken);\n      \n      // 4. Forward request to server\n      // Note: This is a simplified version. Actual implementation would need\n      // to properly handle MCP protocol messages\n      requestLogger.debug('Forwarding request to server instance', { userId });\n      \n      // TODO: Implement actual MCP request forwarding\n      // For now, this is a placeholder\n      const response = { success: true, userId, resourceType: this.config.resourceType };\n      \n      requestLogger.info('Request handled successfully', {\n        userId,\n        resourceType: this.config.resourceType\n      });\n      \n      return response;\n      \n    } catch (error) {\n      requestLogger.error('Request handling failed', error as Error);\n      throw error;\n    }\n  }\n  \n  /**\n   * Get server instance (ephemeral or from pool)\n   */\n  private async getServerInstance(userId: string, accessToken: string): Promise<Server> {\n    if (this.config.instanceMode === 'ephemeral') {\n      // Create new server instance for each request (recommended)\n      this.logger.debug('Creating ephemeral server instance', { userId });\n      return await this.config.serverFactory(accessToken, userId);\n    }\n    \n    // Pooled mode\n    return await this.getPooledServerInstance(userId, accessToken);\n  }\n  \n  /**\n   * Get or create pooled server instance\n   */\n  private async getPooledServerInstance(userId: string, accessToken: string): Promise<Server> {\n    // Check if we have a cached server instance\n    if (this.serverPool.has(userId)) {\n      const instance = this.serverPool.get(userId)!;\n      \n      // Check if token changed (user rotated token)\n      if (instance.accessToken !== accessToken) {\n        this.logger.info('Token changed, recreating server instance', { userId });\n        await instance.server.close();\n        this.serverPool.delete(userId);\n      } else {\n        // Reuse existing instance\n        instance.lastUsed = Date.now();\n        this.logger.debug('Reusing pooled server instance', { userId });\n        return instance.server;\n      }\n    }\n    \n    // Check pool size limit\n    if (this.serverPool.size >= this.config.pooling.maxTotalServers) {\n      this.logger.warn('Server pool limit reached, evicting oldest instance', {\n        poolSize: this.serverPool.size,\n        maxTotal: this.config.pooling.maxTotalServers\n      });\n      await this.evictOldestInstance();\n    }\n    \n    // Create new server instance\n    this.logger.info('Creating new pooled server instance', { userId });\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Add to pool\n    this.serverPool.set(userId, {\n      server,\n      accessToken,\n      userId,\n      createdAt: Date.now(),\n      lastUsed: Date.now()\n    });\n    \n    // Schedule cleanup if not already scheduled\n    if (!this.cleanupTimer) {\n      this.scheduleCleanup();\n    }\n    \n    return server;\n  }\n  \n  /**\n   * Evict oldest server instance from pool\n   */\n  private async evictOldestInstance(): Promise<void> {\n    let oldestUserId: string | null = null;\n    let oldestTime = Infinity;\n    \n    for (const [userId, instance] of this.serverPool.entries()) {\n      if (instance.lastUsed < oldestTime) {\n        oldestTime = instance.lastUsed;\n        oldestUserId = userId;\n      }\n    }\n    \n    if (oldestUserId) {\n      const instance = this.serverPool.get(oldestUserId)!;\n      await instance.server.close();\n      this.serverPool.delete(oldestUserId);\n      \n      this.logger.debug('Evicted oldest server instance', {\n        userId: oldestUserId,\n        age: Date.now() - instance.createdAt\n      });\n    }\n  }\n  \n  /**\n   * Schedule cleanup of idle server instances\n   */\n  private scheduleCleanup(): void {\n    const timeout = this.config.pooling.idleTimeoutMs;\n    \n    this.cleanupTimer = setTimeout(async () => {\n      const now = Date.now();\n      const toRemove: string[] = [];\n      \n      for (const [userId, instance] of this.serverPool.entries()) {\n        if (now - instance.lastUsed > timeout) {\n          toRemove.push(userId);\n        }\n      }\n      \n      for (const userId of toRemove) {\n        const instance = this.serverPool.get(userId)!;\n        try {\n          await instance.server.close();\n          this.serverPool.delete(userId);\n          \n          this.logger.debug('Cleaned up idle server instance', {\n            userId,\n            idleTime: now - instance.lastUsed\n          });\n        } catch (error) {\n          this.logger.error('Error cleaning up server instance', error as Error, { userId });\n        }\n      }\n      \n      // Reschedule if pool is not empty\n      if (this.serverPool.size > 0) {\n        this.scheduleCleanup();\n      } else {\n        this.cleanupTimer = undefined;\n      }\n    }, timeout);\n  }\n  \n  /**\n   * Start stdio transport (single-user mode)\n   */\n  private async startStdioTransport(): Promise<void> {\n    this.logger.info('Starting stdio transport');\n    \n    // For stdio, we use environment variable for token\n    const envVar = `${this.config.resourceType.toUpperCase()}_ACCESS_TOKEN`;\n    const accessToken = process.env[envVar];\n    \n    if (!accessToken) {\n      throw new ConfigurationError(\n        `${envVar} environment variable required for stdio mode`\n      );\n    }\n    \n    const userId = 'stdio-user';\n    \n    // Create server instance\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Connect to stdio transport\n    const transport = new StdioServerTransport();\n    await server.connect(transport);\n    \n    this.logger.info('Stdio transport started', { userId });\n  }\n  \n  /**\n   * Start SSE transport (multi-user mode)\n   */\n  private async startSSETransport(): Promise<void> {\n    this.logger.info('Starting SSE transport', {\n      port: this.config.transport.port,\n      basePath: this.config.transport.basePath\n    });\n    \n    // Import express dynamically (optional dependency)\n    // @ts-ignore - Dynamic import of optional dependency\n    const express = await import('express');\n    const app = express.default();\n    \n    // Enable JSON parsing\n    app.use(express.json());\n    \n    // Enable CORS if configured\n    if (this.config.transport.cors) {\n      // @ts-ignore - Dynamic import of optional dependency\n      const cors = await import('cors');\n      app.use(cors.default({\n        origin: this.config.transport.corsOrigin || '*'\n      }));\n    }\n    \n    const basePath = this.config.transport.basePath || '/mcp';\n    \n    // SSE endpoint for MCP messages\n    app.post(`${basePath}/message`, async (req: any, res: any) => {\n      try {\n        const context: RequestContext = {\n          headers: req.headers as Record<string, string>,\n          transport: 'sse',\n          timestamp: new Date(),\n          requestId: req.headers['x-request-id'] as string | undefined\n        };\n        \n        const result = await this.handleRequest(req.body, context);\n        res.json(result);\n        \n      } catch (error) {\n        this.logger.error('SSE request failed', error as Error);\n        \n        if (error instanceof AuthenticationError || error instanceof TokenResolutionError) {\n          res.status(error.statusCode).json({\n            error: error.message,\n            code: error.code\n          });\n        } else {\n          res.status(500).json({\n            error: 'Internal server error',\n            code: 'INTERNAL_ERROR'\n          });\n        }\n      }\n    });\n    \n    // Health check endpoint\n    app.get(`${basePath}/health`, (req: any, res: any) => {\n      res.json({\n        status: 'healthy',\n        name: this.config.name,\n        version: this.config.version,\n        resourceType: this.config.resourceType,\n        instanceMode: this.config.instanceMode,\n        poolSize: this.serverPool.size\n      });\n    });\n    \n    // Start server\n    const port = this.config.transport.port || 3000;\n    const host = this.config.transport.host || '0.0.0.0';\n    \n    await new Promise<void>((resolve) => {\n      app.listen(port, host, () => {\n        this.logger.info('SSE transport listening', {\n          host,\n          port,\n          basePath,\n          url: `http://${host}:${port}${basePath}`\n        });\n        resolve();\n      });\n    });\n  }\n  \n  /**\n   * Start HTTP transport (multi-user mode)\n   */\n  private async startHTTPTransport(): Promise<void> {\n    this.logger.info('Starting HTTP transport', {\n      port: this.config.transport.port\n    });\n    \n    // HTTP transport is similar to SSE but with different endpoint structure\n    // For now, delegate to SSE implementation\n    await this.startSSETransport();\n  }\n  \n  /**\n   * Get server pool statistics\n   */\n  getPoolStats(): {\n    size: number;\n    instances: Array<{\n      userId: string;\n      createdAt: number;\n      lastUsed: number;\n      age: number;\n      idleTime: number;\n    }>;\n  } {\n    const now = Date.now();\n    const instances = Array.from(this.serverPool.entries()).map(([userId, instance]) => ({\n      userId,\n      createdAt: instance.createdAt,\n      lastUsed: instance.lastUsed,\n      age: now - instance.createdAt,\n      idleTime: now - instance.lastUsed\n    }));\n    \n    return {\n      size: this.serverPool.size,\n      instances\n    };\n  }\n  \n  /**\n   * Check if server is running\n   */\n  isServerRunning(): boolean {\n    return this.isRunning;\n  }\n}\n"],
+  "mappings": "AAQA,SAAS,4BAA4B;AAGrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAiC;AAC1C;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmCA,MAAM,2BAA2B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAqB;AAAA,EACrB;AAAA,EAER,YAAY,QAA6B;AAEvC,SAAK,eAAe,MAAM;AAG1B,SAAK,SAAS,KAAK,gBAAgB,MAAM;AAGzC,SAAK,SAAS,aAAa,KAAK,OAAO,WAAW,OAAO;AAGzD,SAAK,aAAa,oBAAI,IAAI;AAE1B,SAAK,OAAO,KAAK,sCAAsC;AAAA,MACrD,MAAM,KAAK,OAAO;AAAA,MAClB,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,cAAc,KAAK,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,QAAmC;AAExD,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI,mBAAmB,uBAAuB;AAAA,IACtD;AAEA,yBAAqB,OAAO,YAAY;AACxC,4BAAwB,OAAO,SAAS;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,QAA4D;AAClF,WAAO;AAAA,MACL,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY;AAAA,QACV,WAAW,OAAO,YAAY;AAAA,QAC9B,SAAS,OAAO,YAAY,WAAW,EAAE,SAAS,MAAM,OAAO,OAAO;AAAA,MACxE;AAAA,MACA,SAAS;AAAA,QACP,mBAAmB,OAAO,SAAS,qBAAqB;AAAA,QACxD,eAAe,OAAO,SAAS,iBAAiB;AAAA,QAChD,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACtD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,MAC7C,eAAe,OAAO,iBAAiB;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAuB;AAC3B,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,SAAK,OAAO,KAAK,yCAAyC;AAAA,MACxD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,IACnC,CAAC;AAGD,QAAI,KAAK,OAAO,aAAa,YAAY;AACvC,YAAM,KAAK,OAAO,aAAa,WAAW;AAC1C,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAGA,QAAI,KAAK,OAAO,cAAc,YAAY;AACxC,YAAM,KAAK,OAAO,cAAc,WAAW;AAC3C,WAAK,OAAO,MAAM,4BAA4B;AAAA,IAChD;AAGA,YAAQ,KAAK,OAAO,UAAU,MAAM;AAAA,MAClC,KAAK;AACH,cAAM,KAAK,oBAAoB;AAC/B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,kBAAkB;AAC7B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,mBAAmB;AAC9B;AAAA,MACF;AACE,cAAM,IAAI,eAAe,+BAA+B,KAAK,OAAO,UAAU,IAAI,EAAE;AAAA,IACxF;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,uCAAuC;AAAA,MACtD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,WAAW;AACnB;AAAA,IACF;AAEA,SAAK,OAAO,KAAK,yBAAyB;AAG1C,QAAI,KAAK,cAAc;AACrB,mBAAa,KAAK,YAAY;AAC9B,WAAK,eAAe;AAAA,IACtB;AAGA,QAAI,KAAK,OAAO,iBAAiB,UAAU;AACzC,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,OAAO,MAAM,iCAAiC,EAAE,OAAO,CAAC;AAAA,QAC/D,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,iCAAiC,OAAgB,EAAE,OAAO,CAAC;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,WAAW,MAAM;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,aAAa,SAAS;AACpC,YAAM,KAAK,OAAO,aAAa,QAAQ;AACvC,WAAK,OAAO,MAAM,0BAA0B;AAAA,IAC9C;AAGA,QAAI,KAAK,OAAO,cAAc,SAAS;AACrC,YAAM,KAAK,OAAO,cAAc,QAAQ;AACxC,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,wBAAwB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,SAAc,SAAuC;AAC/E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AACnG,UAAM,gBAAgB,KAAK,OAAO,MAAM,EAAE,UAAU,CAAC;AAErD,QAAI;AACF,oBAAc,MAAM,oBAAoB;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,YAAY,CAAC,CAAC,QAAQ;AAAA,MACxB,CAAC;AAGD,YAAM,aAAa,MAAM,KAAK,OAAO,aAAa,aAAa,OAAO;AAEtE,UAAI,CAAC,WAAW,iBAAiB,CAAC,WAAW,QAAQ;AACnD,sBAAc,KAAK,yBAAyB;AAAA,UAC1C,OAAO,WAAW;AAAA,QACpB,CAAC;AACD,cAAM,IAAI,oBAAoB,WAAW,SAAS,uBAAuB;AAAA,MAC3E;AAEA,YAAM,SAAS,eAAe,WAAW,MAAM;AAE/C,oBAAc,MAAM,6BAA6B,EAAE,OAAO,CAAC;AAG3D,YAAM,cAAc,MAAM,KAAK,OAAO,cAAc;AAAA,QAClD;AAAA,QACA,KAAK,OAAO;AAAA,MACd;AAEA,UAAI,CAAC,aAAa;AAChB,sBAAc,KAAK,2BAA2B;AAAA,UAC5C;AAAA,UACA,cAAc,KAAK,OAAO;AAAA,QAC5B,CAAC;AACD,cAAM,IAAI,qBAAqB,QAAQ,KAAK,OAAO,YAAY;AAAA,MACjE;AAEA,0BAAoB,WAAW;AAE/B,oBAAc,MAAM,kBAAkB;AAAA,QACpC;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,QAC1B,aAAa,YAAY;AAAA,MAC3B,CAAC;AAGD,YAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ,WAAW;AAK/D,oBAAc,MAAM,yCAAyC,EAAE,OAAO,CAAC;AAIvE,YAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,cAAc,KAAK,OAAO,aAAa;AAEjF,oBAAc,KAAK,gCAAgC;AAAA,QACjD;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAED,aAAO;AAAA,IAET,SAAS,OAAO;AACd,oBAAc,MAAM,2BAA2B,KAAc;AAC7D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,QAAgB,aAAsC;AACpF,QAAI,KAAK,OAAO,iBAAiB,aAAa;AAE5C,WAAK,OAAO,MAAM,sCAAsC,EAAE,OAAO,CAAC;AAClE,aAAO,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAAA,IAC5D;AAGA,WAAO,MAAM,KAAK,wBAAwB,QAAQ,WAAW;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBAAwB,QAAgB,aAAsC;AAE1F,QAAI,KAAK,WAAW,IAAI,MAAM,GAAG;AAC/B,YAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAG3C,UAAI,SAAS,gBAAgB,aAAa;AACxC,aAAK,OAAO,KAAK,6CAA6C,EAAE,OAAO,CAAC;AACxE,cAAM,SAAS,OAAO,MAAM;AAC5B,aAAK,WAAW,OAAO,MAAM;AAAA,MAC/B,OAAO;AAEL,iBAAS,WAAW,KAAK,IAAI;AAC7B,aAAK,OAAO,MAAM,kCAAkC,EAAE,OAAO,CAAC;AAC9D,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,QAAQ,KAAK,OAAO,QAAQ,iBAAiB;AAC/D,WAAK,OAAO,KAAK,uDAAuD;AAAA,QACtE,UAAU,KAAK,WAAW;AAAA,QAC1B,UAAU,KAAK,OAAO,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,KAAK,oBAAoB;AAAA,IACjC;AAGA,SAAK,OAAO,KAAK,uCAAuC,EAAE,OAAO,CAAC;AAClE,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,SAAK,WAAW,IAAI,QAAQ;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AAGD,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,gBAAgB;AAAA,IACvB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,QAAI,eAA8B;AAClC,QAAI,aAAa;AAEjB,eAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,UAAI,SAAS,WAAW,YAAY;AAClC,qBAAa,SAAS;AACtB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,WAAW,KAAK,WAAW,IAAI,YAAY;AACjD,YAAM,SAAS,OAAO,MAAM;AAC5B,WAAK,WAAW,OAAO,YAAY;AAEnC,WAAK,OAAO,MAAM,kCAAkC;AAAA,QAClD,QAAQ;AAAA,QACR,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAwB;AAC9B,UAAM,UAAU,KAAK,OAAO,QAAQ;AAEpC,SAAK,eAAe,WAAW,YAAY;AACzC,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,WAAqB,CAAC;AAE5B,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI,MAAM,SAAS,WAAW,SAAS;AACrC,mBAAS,KAAK,MAAM;AAAA,QACtB;AAAA,MACF;AAEA,iBAAW,UAAU,UAAU;AAC7B,cAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAC3C,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,WAAW,OAAO,MAAM;AAE7B,eAAK,OAAO,MAAM,mCAAmC;AAAA,YACnD;AAAA,YACA,UAAU,MAAM,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,qCAAqC,OAAgB,EAAE,OAAO,CAAC;AAAA,QACnF;AAAA,MACF;AAGA,UAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,aAAK,gBAAgB;AAAA,MACvB,OAAO;AACL,aAAK,eAAe;AAAA,MACtB;AAAA,IACF,GAAG,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,SAAK,OAAO,KAAK,0BAA0B;AAG3C,UAAM,SAAS,GAAG,KAAK,OAAO,aAAa,YAAY,CAAC;AACxD,UAAM,cAAc,QAAQ,IAAI,MAAM;AAEtC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS;AAGf,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,UAAM,YAAY,IAAI,qBAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,SAAK,OAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBAAmC;AAC/C,SAAK,OAAO,KAAK,0BAA0B;AAAA,MACzC,MAAM,KAAK,OAAO,UAAU;AAAA,MAC5B,UAAU,KAAK,OAAO,UAAU;AAAA,IAClC,CAAC;AAID,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,MAAM,QAAQ,QAAQ;AAG5B,QAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,QAAI,KAAK,OAAO,UAAU,MAAM;AAE9B,YAAM,OAAO,MAAM,OAAO,MAAM;AAChC,UAAI,IAAI,KAAK,QAAQ;AAAA,QACnB,QAAQ,KAAK,OAAO,UAAU,cAAc;AAAA,MAC9C,CAAC,CAAC;AAAA,IACJ;AAEA,UAAM,WAAW,KAAK,OAAO,UAAU,YAAY;AAGnD,QAAI,KAAK,GAAG,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC5D,UAAI;AACF,cAAM,UAA0B;AAAA,UAC9B,SAAS,IAAI;AAAA,UACb,WAAW;AAAA,UACX,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,IAAI,QAAQ,cAAc;AAAA,QACvC;AAEA,cAAM,SAAS,MAAM,KAAK,cAAc,IAAI,MAAM,OAAO;AACzD,YAAI,KAAK,MAAM;AAAA,MAEjB,SAAS,OAAO;AACd,aAAK,OAAO,MAAM,sBAAsB,KAAc;AAEtD,YAAI,iBAAiB,uBAAuB,iBAAiB,sBAAsB;AACjF,cAAI,OAAO,MAAM,UAAU,EAAE,KAAK;AAAA,YAChC,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,UACd,CAAC;AAAA,QACH,OAAO;AACL,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,GAAG,QAAQ,WAAW,CAAC,KAAU,QAAa;AACpD,UAAI,KAAK;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,KAAK,OAAO;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,QACrB,cAAc,KAAK,OAAO;AAAA,QAC1B,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAGD,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAC3C,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAE3C,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,aAAK,OAAO,KAAK,2BAA2B;AAAA,UAC1C;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU,IAAI,IAAI,IAAI,GAAG,QAAQ;AAAA,QACxC,CAAC;AACD,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBAAoC;AAChD,SAAK,OAAO,KAAK,2BAA2B;AAAA,MAC1C,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAID,UAAM,KAAK,kBAAkB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,eASE;AACA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,QAAQ,OAAO;AAAA,MACnF;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS;AAAA,MACnB,KAAK,MAAM,SAAS;AAAA,MACpB,UAAU,MAAM,SAAS;AAAA,IAC3B,EAAE;AAEF,WAAO;AAAA,MACL,MAAM,KAAK,WAAW;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,kBAA2B;AACzB,WAAO,KAAK;AAAA,EACd;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prmichaelsen/mcp-auth",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Authentication and multi-tenancy framework for MCP servers",
   "type": "module",
   "main": "dist/index.js",
@@ -85,7 +85,9 @@
   },
   "optionalDependencies": {
     "@types/jsonwebtoken": "^9.0.0",
-    "jsonwebtoken": "^9.0.0"
+    "jsonwebtoken": "^9.0.0",
+    "express": "^4.21.2",
+    "cors": "^2.8.5"
   },
   "publishConfig": {
     "access": "public"