@prmichaelsen/mcp-auth 0.1.2 → 0.2.0

package/README.md

@@ -230,6 +230,11 @@ transport: {
 }
 ```
 
+**Endpoints created:**
+- `GET /mcp` - Server info and available endpoints
+- `POST /mcp/message` - MCP protocol messages (requires JWT)
+- `GET /mcp/health` - Health check endpoint
+
 ### HTTP (Remote)
 
 ```typescript

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export type { TransportType, RequestContext, AuthResult, TransportConfig, RateLi
 export type { AuthProvider, ResourceTokenResolver, AuthenticatedContext, AuthProviderConfig, TokenResolverConfig } from './auth/types.js';
 export { BaseAuthProvider } from './auth/base-provider.js';
 export { EnvAuthProvider, type EnvAuthProviderConfig, SimpleTokenResolver, type SimpleTokenResolverConfig, JWTAuthProvider, type JWTAuthProviderConfig, type JWTPayload, JWTTokenResolver, type JWTTokenResolverConfig, APITokenResolver, type APITokenResolverConfig } from './auth/providers/index.js';
+export { type TenantAPIErrorResponse, type CredentialsAPIResponse, type CredentialsAPIHeaders, type TenantManagerAPI, TenantAPIStatusCode, TenantAPIErrorCode, createTenantAPIError, TenantAPIErrors } from './tenant/index.js';
 export { MCPAuthError, AuthenticationError, TokenResolutionError, InvalidTokenError, MissingCredentialsError, ConfigurationError, RateLimitError, ServerPoolError, TransportError, ValidationError, isMCPAuthError, isAuthenticationError, isTokenResolutionError, isRateLimitError, formatErrorForClient, Logger, LogLevel, defaultLogger, createLogger, sanitizeForLogging, validateNonEmptyString, validateUrl, validatePositiveNumber, validatePort, validateEnum, validateObject, validateFunction, validateRequiredFields, validateTransportConfig, validateRateLimitConfig, validateLoggingConfig, validatePoolingConfig, sanitizeString, validateUserId, validateResourceType, validateAccessToken } from './utils/index.js';
 export type { LogEntry } from './utils/logger.js';
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,EACL,UAAU,EACV,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EACL,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,OAAO,EACP,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,EACT,KAAK,IAAI,EACT,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAM3B,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,MAAM,EACN,aAAa,EACb,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AASnC,OAAO,EAEL,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EAGpB,MAAM,EACN,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,kBAAkB,EAGlB,sBAAsB,EACtB,WAAW,EACX,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAMlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,EACL,UAAU,EACV,0BAA0B,EAC1B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,6BAA6B,EACnC,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EACL,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,QAAQ,EACR,OAAO,EACP,WAAW,EACX,aAAa,EACb,WAAW,EACX,SAAS,EACT,KAAK,IAAI,EACT,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAM3B,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,MAAM,EACN,aAAa,EACb,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AAMpB,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EACL,eAAe,EACf,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,sBAAsB,EAC5B,MAAM,2BAA2B,CAAC;AAQnC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,EAEL,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,oBAAoB,EAGpB,MAAM,EACN,QAAQ,EACR,aAAa,EACb,YAAY,EACZ,kBAAkB,EAGlB,sBAAsB,EACtB,WAAW,EACX,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAMlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG"}

package/dist/index.js

@@ -21,6 +21,12 @@ import {
   JWTTokenResolver,
   APITokenResolver
 } from "./auth/providers/index.js";
+import {
+  TenantAPIStatusCode,
+  TenantAPIErrorCode,
+  createTenantAPIError,
+  TenantAPIErrors
+} from "./tenant/index.js";
 import {
   MCPAuthError,
   AuthenticationError,
@@ -78,12 +84,16 @@ export {
   RateLimitError,
   ServerPoolError,
   SimpleTokenResolver,
+  TenantAPIErrorCode,
+  TenantAPIErrors,
+  TenantAPIStatusCode,
   TokenResolutionError,
   TransportError,
   ValidationError,
   compose,
   createAuthenticatedTool,
   createLogger,
+  createTenantAPIError,
   defaultLogger,
   formatErrorForClient,
   isAuthenticationError,

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["/**\n * @prmichaelsen/mcp-auth\n *\n * Authentication and multi-tenancy framework for MCP (Model Context Protocol) servers.\n *\n * Supports two complementary patterns:\n * 1. **Server Wrapping** - Wrap existing MCP servers without modification (MCP-level auth)\n * 2. **Tool-Level Auth** - Build new MCP servers with integrated auth\n *\n * @packageDocumentation\n */\n\n// ============================================================================\n// PATTERN 1: SERVER WRAPPING (MCP-Level Auth)\n// ============================================================================\n// Use this to wrap existing MCP servers without modifying them\n// Ideal for multi-tenant services that host multiple MCP servers\n\nexport {\n  wrapServer,\n  AuthenticatedServerWrapper,\n  type ServerWrapperConfig,\n  type MCPServerFactory,\n  type NormalizedServerWrapperConfig\n} from './wrapper/index.js';\n\n// ============================================================================\n// PATTERN 2: TOOL-LEVEL AUTH\n// ============================================================================\n// Use this to build new MCP servers with integrated authentication\n// Provides fine-grained control over auth per tool\n\nexport {\n  AuthenticatedMCPServer,\n  type ServerConfig,\n  type NormalizedServerConfig,\n  withAuth,\n  compose,\n  withLogging,\n  withRateLimit,\n  withTimeout,\n  withRetry,\n  type Tool,\n  AuthenticatedTool,\n  createAuthenticatedTool,\n  type AuthenticatedToolHandler\n} from './server/index.js';\n\n// ============================================================================\n// SHARED: CORE TYPES\n// ============================================================================\n\nexport type {\n  TransportType,\n  RequestContext,\n  AuthResult,\n  TransportConfig,\n  RateLimitConfig,\n  LoggingConfig,\n  MiddlewareConfig,\n  PoolingConfig,\n  Result,\n  AsyncFunction,\n  ToolHandler,\n  Middleware\n} from './types.js';\n\n// ============================================================================\n// SHARED: AUTHENTICATION\n// ============================================================================\n\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './auth/types.js';\n\nexport { BaseAuthProvider } from './auth/base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig,\n  JWTAuthProvider,\n  type JWTAuthProviderConfig,\n  type JWTPayload,\n  JWTTokenResolver,\n  type JWTTokenResolverConfig,\n  APITokenResolver,\n  type APITokenResolverConfig\n} from './auth/providers/index.js';\n\n// Note: OAuth and API Key providers can be added in the future if needed\n// For now, JWT-based auth with embedded or API-resolved tokens covers most use cases\n\n// ============================================================================\n// SHARED: UTILITIES\n// ============================================================================\n\nexport {\n  // Errors\n  MCPAuthError,\n  AuthenticationError,\n  TokenResolutionError,\n  InvalidTokenError,\n  MissingCredentialsError,\n  ConfigurationError,\n  RateLimitError,\n  ServerPoolError,\n  TransportError,\n  ValidationError,\n  isMCPAuthError,\n  isAuthenticationError,\n  isTokenResolutionError,\n  isRateLimitError,\n  formatErrorForClient,\n  \n  // Logger\n  Logger,\n  LogLevel,\n  defaultLogger,\n  createLogger,\n  sanitizeForLogging,\n  \n  // Validation\n  validateNonEmptyString,\n  validateUrl,\n  validatePositiveNumber,\n  validatePort,\n  validateEnum,\n  validateObject,\n  validateFunction,\n  validateRequiredFields,\n  validateTransportConfig,\n  validateRateLimitConfig,\n  validateLoggingConfig,\n  validatePoolingConfig,\n  sanitizeString,\n  validateUserId,\n  validateResourceType,\n  validateAccessToken\n} from './utils/index.js';\n\n// Re-export types for convenience\nexport type { LogEntry } from './utils/logger.js';\n\n// ============================================================================\n// USAGE EXAMPLES\n// ============================================================================\n\n/**\n * @example Server Wrapping Pattern (MCP-Level Auth)\n * ```typescript\n * import { wrapServer, JWTAuthProvider, DatabaseTokenResolver } from '@prmichaelsen/mcp-auth';\n * import { createServer as createInstagramServer } from '@prmichaelsen/instagram-mcp';\n *\n * const wrapped = wrapServer({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken, userId),\n *   authProvider: new JWTAuthProvider({ jwtSecret: process.env.JWT_SECRET }),\n *   tokenResolver: new DatabaseTokenResolver({ database: {...} }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n *\n * await wrapped.start();\n * ```\n *\n * @example Tool-Level Auth Pattern\n * ```typescript\n * import { AuthenticatedMCPServer, withAuth, EnvAuthProvider } from '@prmichaelsen/mcp-auth';\n *\n * const server = new AuthenticatedMCPServer({\n *   name: 'my-server',\n *   authProvider: new EnvAuthProvider(),\n *   tokenResolver: new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' }),\n *   resourceType: 'myapi',\n *   transport: { type: 'stdio' }\n * });\n *\n * server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {\n *   const client = new MyAPIClient(accessToken);\n *   return client.getData(args);\n * }));\n *\n * await server.start();\n * ```\n */\n"],
-  "mappings": "AAkBA;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAQP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAEK;AAiCP,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAGA;AAAA,EAEA;AAAA,OAEK;AASP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "sourcesContent": ["/**\n * @prmichaelsen/mcp-auth\n *\n * Authentication and multi-tenancy framework for MCP (Model Context Protocol) servers.\n *\n * Supports two complementary patterns:\n * 1. **Server Wrapping** - Wrap existing MCP servers without modification (MCP-level auth)\n * 2. **Tool-Level Auth** - Build new MCP servers with integrated auth\n *\n * @packageDocumentation\n */\n\n// ============================================================================\n// PATTERN 1: SERVER WRAPPING (MCP-Level Auth)\n// ============================================================================\n// Use this to wrap existing MCP servers without modifying them\n// Ideal for multi-tenant services that host multiple MCP servers\n\nexport {\n  wrapServer,\n  AuthenticatedServerWrapper,\n  type ServerWrapperConfig,\n  type MCPServerFactory,\n  type NormalizedServerWrapperConfig\n} from './wrapper/index.js';\n\n// ============================================================================\n// PATTERN 2: TOOL-LEVEL AUTH\n// ============================================================================\n// Use this to build new MCP servers with integrated authentication\n// Provides fine-grained control over auth per tool\n\nexport {\n  AuthenticatedMCPServer,\n  type ServerConfig,\n  type NormalizedServerConfig,\n  withAuth,\n  compose,\n  withLogging,\n  withRateLimit,\n  withTimeout,\n  withRetry,\n  type Tool,\n  AuthenticatedTool,\n  createAuthenticatedTool,\n  type AuthenticatedToolHandler\n} from './server/index.js';\n\n// ============================================================================\n// SHARED: CORE TYPES\n// ============================================================================\n\nexport type {\n  TransportType,\n  RequestContext,\n  AuthResult,\n  TransportConfig,\n  RateLimitConfig,\n  LoggingConfig,\n  MiddlewareConfig,\n  PoolingConfig,\n  Result,\n  AsyncFunction,\n  ToolHandler,\n  Middleware\n} from './types.js';\n\n// ============================================================================\n// SHARED: AUTHENTICATION\n// ============================================================================\n\nexport type {\n  AuthProvider,\n  ResourceTokenResolver,\n  AuthenticatedContext,\n  AuthProviderConfig,\n  TokenResolverConfig\n} from './auth/types.js';\n\nexport { BaseAuthProvider } from './auth/base-provider.js';\n\n// Providers\nexport {\n  EnvAuthProvider,\n  type EnvAuthProviderConfig,\n  SimpleTokenResolver,\n  type SimpleTokenResolverConfig,\n  JWTAuthProvider,\n  type JWTAuthProviderConfig,\n  type JWTPayload,\n  JWTTokenResolver,\n  type JWTTokenResolverConfig,\n  APITokenResolver,\n  type APITokenResolverConfig\n} from './auth/providers/index.js';\n\n// ============================================================================\n// TENANT MANAGER INTEGRATION\n// ============================================================================\n// Standard interfaces for tenant manager APIs\n// Helps tenant platforms provide consistent APIs for MCP servers\n\nexport {\n  type TenantAPIErrorResponse,\n  type CredentialsAPIResponse,\n  type CredentialsAPIHeaders,\n  type TenantManagerAPI,\n  TenantAPIStatusCode,\n  TenantAPIErrorCode,\n  createTenantAPIError,\n  TenantAPIErrors\n} from './tenant/index.js';\n\n// ============================================================================\n// SHARED: UTILITIES\n// ============================================================================\n\nexport {\n  // Errors\n  MCPAuthError,\n  AuthenticationError,\n  TokenResolutionError,\n  InvalidTokenError,\n  MissingCredentialsError,\n  ConfigurationError,\n  RateLimitError,\n  ServerPoolError,\n  TransportError,\n  ValidationError,\n  isMCPAuthError,\n  isAuthenticationError,\n  isTokenResolutionError,\n  isRateLimitError,\n  formatErrorForClient,\n  \n  // Logger\n  Logger,\n  LogLevel,\n  defaultLogger,\n  createLogger,\n  sanitizeForLogging,\n  \n  // Validation\n  validateNonEmptyString,\n  validateUrl,\n  validatePositiveNumber,\n  validatePort,\n  validateEnum,\n  validateObject,\n  validateFunction,\n  validateRequiredFields,\n  validateTransportConfig,\n  validateRateLimitConfig,\n  validateLoggingConfig,\n  validatePoolingConfig,\n  sanitizeString,\n  validateUserId,\n  validateResourceType,\n  validateAccessToken\n} from './utils/index.js';\n\n// Re-export types for convenience\nexport type { LogEntry } from './utils/logger.js';\n\n// ============================================================================\n// USAGE EXAMPLES\n// ============================================================================\n\n/**\n * @example Server Wrapping Pattern (MCP-Level Auth)\n * ```typescript\n * import { wrapServer, JWTAuthProvider, DatabaseTokenResolver } from '@prmichaelsen/mcp-auth';\n * import { createServer as createInstagramServer } from '@prmichaelsen/instagram-mcp';\n *\n * const wrapped = wrapServer({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken, userId),\n *   authProvider: new JWTAuthProvider({ jwtSecret: process.env.JWT_SECRET }),\n *   tokenResolver: new DatabaseTokenResolver({ database: {...} }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n *\n * await wrapped.start();\n * ```\n *\n * @example Tool-Level Auth Pattern\n * ```typescript\n * import { AuthenticatedMCPServer, withAuth, EnvAuthProvider } from '@prmichaelsen/mcp-auth';\n *\n * const server = new AuthenticatedMCPServer({\n *   name: 'my-server',\n *   authProvider: new EnvAuthProvider(),\n *   tokenResolver: new SimpleTokenResolver({ tokenEnvVar: 'API_TOKEN' }),\n *   resourceType: 'myapi',\n *   transport: { type: 'stdio' }\n * });\n *\n * server.registerTool('get_data', withAuth(async (args, accessToken, userId) => {\n *   const client = new MyAPIClient(accessToken);\n *   return client.getData(args);\n * }));\n *\n * await server.start();\n * ```\n */\n"],
+  "mappings": "AAkBA;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AAQP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,OAEK;AAiCP,SAAS,wBAAwB;AAGjC;AAAA,EACE;AAAA,EAEA;AAAA,EAEA;AAAA,EAGA;AAAA,EAEA;AAAA,OAEK;AAQP;AAAA,EAKE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
   "names": []
 }

package/dist/tenant/api-contracts.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Tenant Manager API Contracts
+ *
+ * Standard interfaces for tenant manager APIs that MCP servers integrate with.
+ * These interfaces help tenant platforms provide consistent APIs for MCP servers.
+ */
+/**
+ * Standard error response format
+ * Used by tenant manager APIs
+ */
+export interface TenantAPIErrorResponse {
+    /**
+     * Error type/title
+     */
+    error: string;
+    /**
+     * Human-readable error message
+     */
+    message?: string;
+    /**
+     * Error code for programmatic handling
+     */
+    code?: string;
+    /**
+     * Additional error details (development only)
+     */
+    details?: Record<string, unknown>;
+    /**
+     * Timestamp of the error
+     */
+    timestamp: string;
+}
+/**
+ * Credentials API response
+ * Returned by GET /api/credentials/:userId/:provider
+ */
+export interface CredentialsAPIResponse {
+    /**
+     * Access token for the provider
+     */
+    access_token: string;
+    /**
+     * Token expiration timestamp (ISO 8601)
+     */
+    expires_at?: string;
+    /**
+     * Provider-specific user ID
+     */
+    provider_user_id?: string;
+    /**
+     * Provider-specific username
+     */
+    provider_username?: string;
+    /**
+     * Additional provider-specific metadata
+     */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Standard HTTP status codes for tenant manager APIs
+ */
+export declare enum TenantAPIStatusCode {
+    OK = 200,
+    BAD_REQUEST = 400,
+    UNAUTHORIZED = 401,
+    FORBIDDEN = 403,
+    NOT_FOUND = 404,
+    CONFLICT = 409,
+    TOO_MANY_REQUESTS = 429,
+    INTERNAL_ERROR = 500,
+    NOT_IMPLEMENTED = 501
+}
+/**
+ * Standard error codes for tenant manager APIs
+ */
+export declare enum TenantAPIErrorCode {
+    VALIDATION_ERROR = "VALIDATION_ERROR",
+    AUTHENTICATION_ERROR = "AUTHENTICATION_ERROR",
+    AUTHORIZATION_ERROR = "AUTHORIZATION_ERROR",
+    NOT_FOUND = "NOT_FOUND",
+    TOKEN_EXPIRED = "TOKEN_EXPIRED",
+    RATE_LIMIT_EXCEEDED = "RATE_LIMIT_EXCEEDED",
+    INTERNAL_ERROR = "INTERNAL_ERROR"
+}
+/**
+ * Credentials API request headers
+ * Expected by GET /api/credentials/:userId/:provider
+ */
+export interface CredentialsAPIHeaders {
+    /**
+     * Service token for MCP server → tenant manager authentication
+     */
+    'Authorization': string;
+    /**
+     * Optional: User ID (alternative to path parameter)
+     */
+    'X-User-ID'?: string;
+    /**
+     * Optional: Request ID for tracing
+     */
+    'X-Request-ID'?: string;
+}
+/**
+ * Tenant Manager API Contract
+ *
+ * Interface that tenant managers should implement for MCP server integration.
+ */
+export interface TenantManagerAPI {
+    /**
+     * Get credentials for a user and provider
+     *
+     * @endpoint GET /api/credentials/:userId/:provider
+     * @auth Service token in Authorization header
+     *
+     * @param userId - User identifier
+     * @param provider - Provider name (e.g., 'instagram', 'github')
+     * @returns Credentials response or error
+     *
+     * @example
+     * ```
+     * GET /api/credentials/user-123/instagram
+     * Authorization: Bearer service-token-xyz
+     *
+     * Response 200:
+     * {
+     *   "access_token": "IGQVJXabc...",
+     *   "expires_at": "2026-12-31T23:59:59Z",
+     *   "provider_user_id": "17841400008460056",
+     *   "provider_username": "johndoe"
+     * }
+     *
+     * Response 404:
+     * {
+     *   "error": "Not Found",
+     *   "message": "Credentials not found for user",
+     *   "timestamp": "2026-02-09T21:00:00.000Z"
+     * }
+     *
+     * Response 401:
+     * {
+     *   "error": "Unauthorized",
+     *   "message": "Token expired",
+     *   "code": "TOKEN_EXPIRED",
+     *   "timestamp": "2026-02-09T21:00:00.000Z"
+     * }
+     * ```
+     */
+    getCredentials(userId: string, provider: string, headers: CredentialsAPIHeaders): Promise<CredentialsAPIResponse | TenantAPIErrorResponse>;
+}
+/**
+ * Helper function to create standardized error responses
+ * Tenant managers can use this to ensure consistency
+ */
+export declare function createTenantAPIError(error: string, statusCode: TenantAPIStatusCode, options?: {
+    message?: string;
+    code?: TenantAPIErrorCode;
+    details?: Record<string, unknown>;
+}): TenantAPIErrorResponse;
+/**
+ * Common error responses for tenant manager APIs
+ */
+export declare const TenantAPIErrors: {
+    missingHeader: (headerName: string) => TenantAPIErrorResponse;
+    unsupportedProvider: (provider: string) => TenantAPIErrorResponse;
+    credentialsNotFound: (userId: string, provider: string) => TenantAPIErrorResponse;
+    tokenExpired: (provider: string) => TenantAPIErrorResponse;
+    internalError: (message?: string) => TenantAPIErrorResponse;
+};
+//# sourceMappingURL=api-contracts.d.ts.map

package/dist/tenant/api-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contracts.d.ts","sourceRoot":"","sources":["../../src/tenant/api-contracts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAElC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,oBAAY,mBAAmB;IAC7B,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,iBAAiB,MAAM;IACvB,cAAc,MAAM;IACpB,eAAe,MAAM;CACtB;AAED;;GAEG;AACH,oBAAY,kBAAkB;IAC5B,gBAAgB,qBAAqB;IACrC,oBAAoB,yBAAyB;IAC7C,mBAAmB,wBAAwB;IAC3C,SAAS,cAAc;IACvB,aAAa,kBAAkB;IAC/B,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,eAAe,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IACH,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,GAAG,sBAAsB,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,mBAAmB,EAC/B,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GACA,sBAAsB,CAQxB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe;gCACE,MAAM;oCAUF,MAAM;kCAUR,MAAM,YAAY,MAAM;6BAW7B,MAAM;8BAUL,MAAM;CASjC,CAAC"}

package/dist/tenant/api-contracts.js

@@ -0,0 +1,81 @@
+var TenantAPIStatusCode = /* @__PURE__ */ ((TenantAPIStatusCode2) => {
+  TenantAPIStatusCode2[TenantAPIStatusCode2["OK"] = 200] = "OK";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["BAD_REQUEST"] = 400] = "BAD_REQUEST";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["UNAUTHORIZED"] = 401] = "UNAUTHORIZED";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["FORBIDDEN"] = 403] = "FORBIDDEN";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["NOT_FOUND"] = 404] = "NOT_FOUND";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["CONFLICT"] = 409] = "CONFLICT";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["TOO_MANY_REQUESTS"] = 429] = "TOO_MANY_REQUESTS";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["INTERNAL_ERROR"] = 500] = "INTERNAL_ERROR";
+  TenantAPIStatusCode2[TenantAPIStatusCode2["NOT_IMPLEMENTED"] = 501] = "NOT_IMPLEMENTED";
+  return TenantAPIStatusCode2;
+})(TenantAPIStatusCode || {});
+var TenantAPIErrorCode = /* @__PURE__ */ ((TenantAPIErrorCode2) => {
+  TenantAPIErrorCode2["VALIDATION_ERROR"] = "VALIDATION_ERROR";
+  TenantAPIErrorCode2["AUTHENTICATION_ERROR"] = "AUTHENTICATION_ERROR";
+  TenantAPIErrorCode2["AUTHORIZATION_ERROR"] = "AUTHORIZATION_ERROR";
+  TenantAPIErrorCode2["NOT_FOUND"] = "NOT_FOUND";
+  TenantAPIErrorCode2["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
+  TenantAPIErrorCode2["RATE_LIMIT_EXCEEDED"] = "RATE_LIMIT_EXCEEDED";
+  TenantAPIErrorCode2["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+  return TenantAPIErrorCode2;
+})(TenantAPIErrorCode || {});
+function createTenantAPIError(error, statusCode, options) {
+  return {
+    error,
+    message: options?.message || error,
+    code: options?.code,
+    details: options?.details,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+const TenantAPIErrors = {
+  missingHeader: (headerName) => createTenantAPIError(
+    "Bad Request",
+    400 /* BAD_REQUEST */,
+    {
+      message: `${headerName} header required`,
+      code: "VALIDATION_ERROR" /* VALIDATION_ERROR */
+    }
+  ),
+  unsupportedProvider: (provider) => createTenantAPIError(
+    "Bad Request",
+    400 /* BAD_REQUEST */,
+    {
+      message: `Unsupported provider: ${provider}`,
+      code: "VALIDATION_ERROR" /* VALIDATION_ERROR */
+    }
+  ),
+  credentialsNotFound: (userId, provider) => createTenantAPIError(
+    "Not Found",
+    404 /* NOT_FOUND */,
+    {
+      message: `No ${provider} credentials found for user`,
+      code: "NOT_FOUND" /* NOT_FOUND */,
+      details: { userId, provider }
+    }
+  ),
+  tokenExpired: (provider) => createTenantAPIError(
+    "Unauthorized",
+    401 /* UNAUTHORIZED */,
+    {
+      message: `${provider} token has expired`,
+      code: "TOKEN_EXPIRED" /* TOKEN_EXPIRED */
+    }
+  ),
+  internalError: (message) => createTenantAPIError(
+    "Internal Server Error",
+    500 /* INTERNAL_ERROR */,
+    {
+      message: message || "An unexpected error occurred",
+      code: "INTERNAL_ERROR" /* INTERNAL_ERROR */
+    }
+  )
+};
+export {
+  TenantAPIErrorCode,
+  TenantAPIErrors,
+  TenantAPIStatusCode,
+  createTenantAPIError
+};
+//# sourceMappingURL=api-contracts.js.map

package/dist/tenant/api-contracts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/tenant/api-contracts.ts"],
+  "sourcesContent": ["/**\n * Tenant Manager API Contracts\n * \n * Standard interfaces for tenant manager APIs that MCP servers integrate with.\n * These interfaces help tenant platforms provide consistent APIs for MCP servers.\n */\n\n/**\n * Standard error response format\n * Used by tenant manager APIs\n */\nexport interface TenantAPIErrorResponse {\n  /**\n   * Error type/title\n   */\n  error: string;\n  \n  /**\n   * Human-readable error message\n   */\n  message?: string;\n  \n  /**\n   * Error code for programmatic handling\n   */\n  code?: string;\n  \n  /**\n   * Additional error details (development only)\n   */\n  details?: Record<string, unknown>;\n  \n  /**\n   * Timestamp of the error\n   */\n  timestamp: string;\n}\n\n/**\n * Credentials API response\n * Returned by GET /api/credentials/:userId/:provider\n */\nexport interface CredentialsAPIResponse {\n  /**\n   * Access token for the provider\n   */\n  access_token: string;\n  \n  /**\n   * Token expiration timestamp (ISO 8601)\n   */\n  expires_at?: string;\n  \n  /**\n   * Provider-specific user ID\n   */\n  provider_user_id?: string;\n  \n  /**\n   * Provider-specific username\n   */\n  provider_username?: string;\n  \n  /**\n   * Additional provider-specific metadata\n   */\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Standard HTTP status codes for tenant manager APIs\n */\nexport enum TenantAPIStatusCode {\n  OK = 200,\n  BAD_REQUEST = 400,\n  UNAUTHORIZED = 401,\n  FORBIDDEN = 403,\n  NOT_FOUND = 404,\n  CONFLICT = 409,\n  TOO_MANY_REQUESTS = 429,\n  INTERNAL_ERROR = 500,\n  NOT_IMPLEMENTED = 501\n}\n\n/**\n * Standard error codes for tenant manager APIs\n */\nexport enum TenantAPIErrorCode {\n  VALIDATION_ERROR = 'VALIDATION_ERROR',\n  AUTHENTICATION_ERROR = 'AUTHENTICATION_ERROR',\n  AUTHORIZATION_ERROR = 'AUTHORIZATION_ERROR',\n  NOT_FOUND = 'NOT_FOUND',\n  TOKEN_EXPIRED = 'TOKEN_EXPIRED',\n  RATE_LIMIT_EXCEEDED = 'RATE_LIMIT_EXCEEDED',\n  INTERNAL_ERROR = 'INTERNAL_ERROR'\n}\n\n/**\n * Credentials API request headers\n * Expected by GET /api/credentials/:userId/:provider\n */\nexport interface CredentialsAPIHeaders {\n  /**\n   * Service token for MCP server \u2192 tenant manager authentication\n   */\n  'Authorization': string; // Bearer <service-token>\n  \n  /**\n   * Optional: User ID (alternative to path parameter)\n   */\n  'X-User-ID'?: string;\n  \n  /**\n   * Optional: Request ID for tracing\n   */\n  'X-Request-ID'?: string;\n}\n\n/**\n * Tenant Manager API Contract\n * \n * Interface that tenant managers should implement for MCP server integration.\n */\nexport interface TenantManagerAPI {\n  /**\n   * Get credentials for a user and provider\n   * \n   * @endpoint GET /api/credentials/:userId/:provider\n   * @auth Service token in Authorization header\n   * \n   * @param userId - User identifier\n   * @param provider - Provider name (e.g., 'instagram', 'github')\n   * @returns Credentials response or error\n   * \n   * @example\n   * ```\n   * GET /api/credentials/user-123/instagram\n   * Authorization: Bearer service-token-xyz\n   * \n   * Response 200:\n   * {\n   *   \"access_token\": \"IGQVJXabc...\",\n   *   \"expires_at\": \"2026-12-31T23:59:59Z\",\n   *   \"provider_user_id\": \"17841400008460056\",\n   *   \"provider_username\": \"johndoe\"\n   * }\n   * \n   * Response 404:\n   * {\n   *   \"error\": \"Not Found\",\n   *   \"message\": \"Credentials not found for user\",\n   *   \"timestamp\": \"2026-02-09T21:00:00.000Z\"\n   * }\n   * \n   * Response 401:\n   * {\n   *   \"error\": \"Unauthorized\",\n   *   \"message\": \"Token expired\",\n   *   \"code\": \"TOKEN_EXPIRED\",\n   *   \"timestamp\": \"2026-02-09T21:00:00.000Z\"\n   * }\n   * ```\n   */\n  getCredentials(\n    userId: string,\n    provider: string,\n    headers: CredentialsAPIHeaders\n  ): Promise<CredentialsAPIResponse | TenantAPIErrorResponse>;\n}\n\n/**\n * Helper function to create standardized error responses\n * Tenant managers can use this to ensure consistency\n */\nexport function createTenantAPIError(\n  error: string,\n  statusCode: TenantAPIStatusCode,\n  options?: {\n    message?: string;\n    code?: TenantAPIErrorCode;\n    details?: Record<string, unknown>;\n  }\n): TenantAPIErrorResponse {\n  return {\n    error,\n    message: options?.message || error,\n    code: options?.code,\n    details: options?.details,\n    timestamp: new Date().toISOString()\n  };\n}\n\n/**\n * Common error responses for tenant manager APIs\n */\nexport const TenantAPIErrors = {\n  missingHeader: (headerName: string) =>\n    createTenantAPIError(\n      'Bad Request',\n      TenantAPIStatusCode.BAD_REQUEST,\n      {\n        message: `${headerName} header required`,\n        code: TenantAPIErrorCode.VALIDATION_ERROR\n      }\n    ),\n  \n  unsupportedProvider: (provider: string) =>\n    createTenantAPIError(\n      'Bad Request',\n      TenantAPIStatusCode.BAD_REQUEST,\n      {\n        message: `Unsupported provider: ${provider}`,\n        code: TenantAPIErrorCode.VALIDATION_ERROR\n      }\n    ),\n  \n  credentialsNotFound: (userId: string, provider: string) =>\n    createTenantAPIError(\n      'Not Found',\n      TenantAPIStatusCode.NOT_FOUND,\n      {\n        message: `No ${provider} credentials found for user`,\n        code: TenantAPIErrorCode.NOT_FOUND,\n        details: { userId, provider }\n      }\n    ),\n  \n  tokenExpired: (provider: string) =>\n    createTenantAPIError(\n      'Unauthorized',\n      TenantAPIStatusCode.UNAUTHORIZED,\n      {\n        message: `${provider} token has expired`,\n        code: TenantAPIErrorCode.TOKEN_EXPIRED\n      }\n    ),\n  \n  internalError: (message?: string) =>\n    createTenantAPIError(\n      'Internal Server Error',\n      TenantAPIStatusCode.INTERNAL_ERROR,\n      {\n        message: message || 'An unexpected error occurred',\n        code: TenantAPIErrorCode.INTERNAL_ERROR\n      }\n    )\n};\n"],
+  "mappings": "AAwEO,IAAK,sBAAL,kBAAKA,yBAAL;AACL,EAAAA,0CAAA,QAAK,OAAL;AACA,EAAAA,0CAAA,iBAAc,OAAd;AACA,EAAAA,0CAAA,kBAAe,OAAf;AACA,EAAAA,0CAAA,eAAY,OAAZ;AACA,EAAAA,0CAAA,eAAY,OAAZ;AACA,EAAAA,0CAAA,cAAW,OAAX;AACA,EAAAA,0CAAA,uBAAoB,OAApB;AACA,EAAAA,0CAAA,oBAAiB,OAAjB;AACA,EAAAA,0CAAA,qBAAkB,OAAlB;AATU,SAAAA;AAAA,GAAA;AAeL,IAAK,qBAAL,kBAAKC,wBAAL;AACL,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,0BAAuB;AACvB,EAAAA,oBAAA,yBAAsB;AACtB,EAAAA,oBAAA,eAAY;AACZ,EAAAA,oBAAA,mBAAgB;AAChB,EAAAA,oBAAA,yBAAsB;AACtB,EAAAA,oBAAA,oBAAiB;AAPP,SAAAA;AAAA,GAAA;AAuFL,SAAS,qBACd,OACA,YACA,SAKwB;AACxB,SAAO;AAAA,IACL;AAAA,IACA,SAAS,SAAS,WAAW;AAAA,IAC7B,MAAM,SAAS;AAAA,IACf,SAAS,SAAS;AAAA,IAClB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACF;AAKO,MAAM,kBAAkB;AAAA,EAC7B,eAAe,CAAC,eACd;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,GAAG,UAAU;AAAA,MACtB,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEF,qBAAqB,CAAC,aACpB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,yBAAyB,QAAQ;AAAA,MAC1C,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEF,qBAAqB,CAAC,QAAgB,aACpC;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,MAAM,QAAQ;AAAA,MACvB,MAAM;AAAA,MACN,SAAS,EAAE,QAAQ,SAAS;AAAA,IAC9B;AAAA,EACF;AAAA,EAEF,cAAc,CAAC,aACb;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,GAAG,QAAQ;AAAA,MACpB,MAAM;AAAA,IACR;AAAA,EACF;AAAA,EAEF,eAAe,CAAC,YACd;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,WAAW;AAAA,MACpB,MAAM;AAAA,IACR;AAAA,EACF;AACJ;",
+  "names": ["TenantAPIStatusCode", "TenantAPIErrorCode"]
+}

package/dist/tenant/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Tenant Manager Integration Module
+ *
+ * Provides interfaces and utilities for tenant managers to integrate with MCP servers.
+ */
+export type { TenantAPIErrorResponse, CredentialsAPIResponse, CredentialsAPIHeaders, TenantManagerAPI } from './api-contracts.js';
+export { TenantAPIStatusCode, TenantAPIErrorCode, createTenantAPIError, TenantAPIErrors } from './api-contracts.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tenant/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tenant/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EAChB,MAAM,oBAAoB,CAAC"}

package/dist/tenant/index.js

@@ -0,0 +1,13 @@
+import {
+  TenantAPIStatusCode,
+  TenantAPIErrorCode,
+  createTenantAPIError,
+  TenantAPIErrors
+} from "./api-contracts.js";
+export {
+  TenantAPIErrorCode,
+  TenantAPIErrors,
+  TenantAPIStatusCode,
+  createTenantAPIError
+};
+//# sourceMappingURL=index.js.map

package/dist/tenant/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/tenant/index.ts"],
+  "sourcesContent": ["/**\n * Tenant Manager Integration Module\n * \n * Provides interfaces and utilities for tenant managers to integrate with MCP servers.\n */\n\nexport type {\n  TenantAPIErrorResponse,\n  CredentialsAPIResponse,\n  CredentialsAPIHeaders,\n  TenantManagerAPI\n} from './api-contracts.js';\n\nexport {\n  TenantAPIStatusCode,\n  TenantAPIErrorCode,\n  createTenantAPIError,\n  TenantAPIErrors\n} from './api-contracts.js';\n"],
+  "mappings": "AAaA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;",
+  "names": []
+}

package/dist/wrapper/server-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-wrapper.d.ts","sourceRoot":"","sources":["../../src/wrapper/server-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAiC,MAAM,aAAa,CAAC;AA4BtF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,MAAM,EAAE,mBAAmB;IAqBvC;;OAEG;IACH,OAAO,CAAC,cAAc;IAsBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAwBvB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8C5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C3B;;OAEG;YACW,aAAa;IAuE3B;;OAEG;YACW,iBAAiB;IAW/B;;OAEG;YACW,uBAAuB;IAgDrC;;OAEG;YACW,mBAAmB;IAuBjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAqCvB;;OAEG;YACW,mBAAmB;IAyBjC;;OAEG;YACW,iBAAiB;IAoF/B;;OAEG;YACW,kBAAkB;IAUhC;;OAEG;IACH,YAAY,IAAI;QACd,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,KAAK,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ;IAgBD;;OAEG;IACH,eAAe,IAAI,OAAO;CAG3B"}
+{"version":3,"file":"server-wrapper.d.ts","sourceRoot":"","sources":["../../src/wrapper/server-wrapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAiC,MAAM,aAAa,CAAC;AA4BtF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,0BAA0B;IACrC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,YAAY,CAAC,CAAiB;gBAE1B,MAAM,EAAE,mBAAmB;IAqBvC;;OAEG;IACH,OAAO,CAAC,cAAc;IAsBtB;;OAEG;IACH,OAAO,CAAC,eAAe;IAwBvB;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8C5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA2C3B;;OAEG;YACW,aAAa;IAuE3B;;OAEG;YACW,iBAAiB;IAW/B;;OAEG;YACW,uBAAuB;IAgDrC;;OAEG;YACW,mBAAmB;IAuBjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAqCvB;;OAEG;YACW,mBAAmB;IAyBjC;;OAEG;YACW,iBAAiB;IAkG/B;;OAEG;YACW,kBAAkB;IAUhC;;OAEG;IACH,YAAY,IAAI;QACd,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,KAAK,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ;IAgBD;;OAEG;IACH,eAAe,IAAI,OAAO;CAG3B"}

package/dist/wrapper/server-wrapper.js

@@ -339,6 +339,18 @@ class AuthenticatedServerWrapper {
       }));
     }
     const basePath = this.config.transport.basePath || "/mcp";
+    app.get(basePath, (req, res) => {
+      res.json({
+        name: this.config.name,
+        version: this.config.version,
+        resourceType: this.config.resourceType,
+        endpoints: {
+          message: `POST ${basePath}/message`,
+          health: `GET ${basePath}/health`
+        },
+        documentation: "https://github.com/prmichaelsen/mcp-auth"
+      });
+    });
     app.post(`${basePath}/message`, async (req, res) => {
       try {
         const context = {

package/dist/wrapper/server-wrapper.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/wrapper/server-wrapper.ts"],
-  "sourcesContent": ["/**\n * Authenticated server wrapper implementation\n *\n * Wraps MCP servers with authentication and multi-tenancy support.\n * Uses ephemeral instances by default for security.\n */\n\nimport type { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport type { ServerWrapperConfig, NormalizedServerWrapperConfig } from './config.js';\nimport type { RequestContext } from '../types.js';\nimport { \n  AuthenticationError, \n  TokenResolutionError,\n  ConfigurationError,\n  TransportError\n} from '../utils/errors.js';\nimport { createLogger, type Logger } from '../utils/logger.js';\nimport {\n  validateRequiredFields,\n  validateResourceType,\n  validateUserId,\n  validateAccessToken,\n  validateTransportConfig\n} from '../utils/validation.js';\n\n/**\n * Server instance metadata (for pooled mode)\n */\ninterface ServerInstance {\n  server: Server;\n  accessToken: string;\n  userId: string;\n  createdAt: number;\n  lastUsed: number;\n}\n\n/**\n * Authenticated server wrapper\n * \n * Wraps an MCP server with authentication, automatically handling:\n * - Request authentication via AuthProvider\n * - Token resolution via ResourceTokenResolver\n * - Per-user server instance creation (ephemeral or pooled)\n * - Transport management (stdio, SSE, HTTP)\n * \n * @example\n * ```typescript\n * const wrapper = new AuthenticatedServerWrapper({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken),\n *   authProvider: new JWTAuthProvider({ ... }),\n *   tokenResolver: new DatabaseTokenResolver({ ... }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n * \n * await wrapper.start();\n * ```\n */\nexport class AuthenticatedServerWrapper {\n  private config: NormalizedServerWrapperConfig;\n  private logger: Logger;\n  private serverPool: Map<string, ServerInstance>;\n  private isRunning: boolean = false;\n  private cleanupTimer?: NodeJS.Timeout;\n  \n  constructor(config: ServerWrapperConfig) {\n    // Validate configuration\n    this.validateConfig(config);\n    \n    // Normalize configuration with defaults\n    this.config = this.normalizeConfig(config);\n    \n    // Initialize logger\n    this.logger = createLogger(this.config.middleware.logging);\n    \n    // Initialize server pool (only used in pooled mode)\n    this.serverPool = new Map();\n    \n    this.logger.info('AuthenticatedServerWrapper created', {\n      name: this.config.name,\n      resourceType: this.config.resourceType,\n      transport: this.config.transport.type,\n      instanceMode: this.config.instanceMode\n    });\n  }\n  \n  /**\n   * Validate wrapper configuration\n   */\n  private validateConfig(config: ServerWrapperConfig): void {\n    // Validate required fields manually for better type safety\n    if (!config.serverFactory) {\n      throw new ConfigurationError('serverFactory is required');\n    }\n    if (!config.authProvider) {\n      throw new ConfigurationError('authProvider is required');\n    }\n    if (!config.tokenResolver) {\n      throw new ConfigurationError('tokenResolver is required');\n    }\n    if (!config.resourceType) {\n      throw new ConfigurationError('resourceType is required');\n    }\n    if (!config.transport) {\n      throw new ConfigurationError('transport is required');\n    }\n    \n    validateResourceType(config.resourceType);\n    validateTransportConfig(config.transport);\n  }\n  \n  /**\n   * Normalize configuration with defaults\n   */\n  private normalizeConfig(config: ServerWrapperConfig): NormalizedServerWrapperConfig {\n    return {\n      serverFactory: config.serverFactory,\n      authProvider: config.authProvider,\n      tokenResolver: config.tokenResolver,\n      resourceType: config.resourceType,\n      transport: config.transport,\n      name: config.name ?? 'mcp-auth-wrapped-server',\n      version: config.version ?? '1.0.0',\n      instanceMode: config.instanceMode ?? 'ephemeral',\n      middleware: {\n        rateLimit: config.middleware?.rateLimit,\n        logging: config.middleware?.logging ?? { enabled: true, level: 'info' }\n      },\n      pooling: {\n        maxServersPerUser: config.pooling?.maxServersPerUser ?? 1,\n        idleTimeoutMs: config.pooling?.idleTimeoutMs ?? 300000,\n        maxTotalServers: config.pooling?.maxTotalServers ?? 100\n      },\n      requestTimeoutMs: config.requestTimeoutMs ?? 30000,\n      enableTracing: config.enableTracing ?? false\n    };\n  }\n  \n  /**\n   * Start the wrapped server\n   */\n  async start(): Promise<void> {\n    if (this.isRunning) {\n      throw new ConfigurationError('Server is already running');\n    }\n    \n    this.logger.info('Starting authenticated server wrapper', {\n      name: this.config.name,\n      transport: this.config.transport.type\n    });\n    \n    // Initialize auth provider\n    if (this.config.authProvider.initialize) {\n      await this.config.authProvider.initialize();\n      this.logger.debug('Auth provider initialized');\n    }\n    \n    // Initialize token resolver\n    if (this.config.tokenResolver.initialize) {\n      await this.config.tokenResolver.initialize();\n      this.logger.debug('Token resolver initialized');\n    }\n    \n    // Start appropriate transport\n    switch (this.config.transport.type) {\n      case 'stdio':\n        await this.startStdioTransport();\n        break;\n      case 'sse':\n        await this.startSSETransport();\n        break;\n      case 'http':\n        await this.startHTTPTransport();\n        break;\n      default:\n        throw new TransportError(`Unsupported transport type: ${this.config.transport.type}`);\n    }\n    \n    this.isRunning = true;\n    \n    this.logger.info('Server wrapper started successfully', {\n      name: this.config.name,\n      transport: this.config.transport.type,\n      port: this.config.transport.port\n    });\n  }\n  \n  /**\n   * Stop the wrapped server\n   */\n  async stop(): Promise<void> {\n    if (!this.isRunning) {\n      return;\n    }\n    \n    this.logger.info('Stopping server wrapper');\n    \n    // Clear cleanup timer\n    if (this.cleanupTimer) {\n      clearTimeout(this.cleanupTimer);\n      this.cleanupTimer = undefined;\n    }\n    \n    // Close all pooled servers\n    if (this.config.instanceMode === 'pooled') {\n      for (const [userId, instance] of this.serverPool.entries()) {\n        try {\n          await instance.server.close();\n          this.logger.debug('Closed pooled server instance', { userId });\n        } catch (error) {\n          this.logger.error('Error closing server instance', error as Error, { userId });\n        }\n      }\n      this.serverPool.clear();\n    }\n    \n    // Cleanup auth provider\n    if (this.config.authProvider.cleanup) {\n      await this.config.authProvider.cleanup();\n      this.logger.debug('Auth provider cleaned up');\n    }\n    \n    // Cleanup token resolver\n    if (this.config.tokenResolver.cleanup) {\n      await this.config.tokenResolver.cleanup();\n      this.logger.debug('Token resolver cleaned up');\n    }\n    \n    this.isRunning = false;\n    \n    this.logger.info('Server wrapper stopped');\n  }\n  \n  /**\n   * Handle incoming MCP request with authentication\n   */\n  private async handleRequest(request: any, context: RequestContext): Promise<any> {\n    const requestId = context.requestId ?? `req-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;\n    const requestLogger = this.logger.child({ requestId });\n    \n    try {\n      requestLogger.debug('Handling request', {\n        transport: context.transport,\n        hasHeaders: !!context.headers\n      });\n      \n      // 1. Authenticate request\n      const authResult = await this.config.authProvider.authenticate(context);\n      \n      if (!authResult.authenticated || !authResult.userId) {\n        requestLogger.warn('Authentication failed', {\n          error: authResult.error\n        });\n        throw new AuthenticationError(authResult.error || 'Authentication failed');\n      }\n      \n      const userId = validateUserId(authResult.userId);\n      \n      requestLogger.debug('Authentication successful', { userId });\n      \n      // 2. Resolve resource token\n      const accessToken = await this.config.tokenResolver.resolveToken(\n        userId,\n        this.config.resourceType\n      );\n      \n      if (!accessToken) {\n        requestLogger.warn('Token resolution failed', {\n          userId,\n          resourceType: this.config.resourceType\n        });\n        throw new TokenResolutionError(userId, this.config.resourceType);\n      }\n      \n      validateAccessToken(accessToken);\n      \n      requestLogger.debug('Token resolved', {\n        userId,\n        resourceType: this.config.resourceType,\n        tokenLength: accessToken.length\n      });\n      \n      // 3. Get server instance (ephemeral or pooled)\n      const server = await this.getServerInstance(userId, accessToken);\n      \n      // 4. Forward request to server\n      // Note: This is a simplified version. Actual implementation would need\n      // to properly handle MCP protocol messages\n      requestLogger.debug('Forwarding request to server instance', { userId });\n      \n      // TODO: Implement actual MCP request forwarding\n      // For now, this is a placeholder\n      const response = { success: true, userId, resourceType: this.config.resourceType };\n      \n      requestLogger.info('Request handled successfully', {\n        userId,\n        resourceType: this.config.resourceType\n      });\n      \n      return response;\n      \n    } catch (error) {\n      requestLogger.error('Request handling failed', error as Error);\n      throw error;\n    }\n  }\n  \n  /**\n   * Get server instance (ephemeral or from pool)\n   */\n  private async getServerInstance(userId: string, accessToken: string): Promise<Server> {\n    if (this.config.instanceMode === 'ephemeral') {\n      // Create new server instance for each request (recommended)\n      this.logger.debug('Creating ephemeral server instance', { userId });\n      return await this.config.serverFactory(accessToken, userId);\n    }\n    \n    // Pooled mode\n    return await this.getPooledServerInstance(userId, accessToken);\n  }\n  \n  /**\n   * Get or create pooled server instance\n   */\n  private async getPooledServerInstance(userId: string, accessToken: string): Promise<Server> {\n    // Check if we have a cached server instance\n    if (this.serverPool.has(userId)) {\n      const instance = this.serverPool.get(userId)!;\n      \n      // Check if token changed (user rotated token)\n      if (instance.accessToken !== accessToken) {\n        this.logger.info('Token changed, recreating server instance', { userId });\n        await instance.server.close();\n        this.serverPool.delete(userId);\n      } else {\n        // Reuse existing instance\n        instance.lastUsed = Date.now();\n        this.logger.debug('Reusing pooled server instance', { userId });\n        return instance.server;\n      }\n    }\n    \n    // Check pool size limit\n    if (this.serverPool.size >= this.config.pooling.maxTotalServers) {\n      this.logger.warn('Server pool limit reached, evicting oldest instance', {\n        poolSize: this.serverPool.size,\n        maxTotal: this.config.pooling.maxTotalServers\n      });\n      await this.evictOldestInstance();\n    }\n    \n    // Create new server instance\n    this.logger.info('Creating new pooled server instance', { userId });\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Add to pool\n    this.serverPool.set(userId, {\n      server,\n      accessToken,\n      userId,\n      createdAt: Date.now(),\n      lastUsed: Date.now()\n    });\n    \n    // Schedule cleanup if not already scheduled\n    if (!this.cleanupTimer) {\n      this.scheduleCleanup();\n    }\n    \n    return server;\n  }\n  \n  /**\n   * Evict oldest server instance from pool\n   */\n  private async evictOldestInstance(): Promise<void> {\n    let oldestUserId: string | null = null;\n    let oldestTime = Infinity;\n    \n    for (const [userId, instance] of this.serverPool.entries()) {\n      if (instance.lastUsed < oldestTime) {\n        oldestTime = instance.lastUsed;\n        oldestUserId = userId;\n      }\n    }\n    \n    if (oldestUserId) {\n      const instance = this.serverPool.get(oldestUserId)!;\n      await instance.server.close();\n      this.serverPool.delete(oldestUserId);\n      \n      this.logger.debug('Evicted oldest server instance', {\n        userId: oldestUserId,\n        age: Date.now() - instance.createdAt\n      });\n    }\n  }\n  \n  /**\n   * Schedule cleanup of idle server instances\n   */\n  private scheduleCleanup(): void {\n    const timeout = this.config.pooling.idleTimeoutMs;\n    \n    this.cleanupTimer = setTimeout(async () => {\n      const now = Date.now();\n      const toRemove: string[] = [];\n      \n      for (const [userId, instance] of this.serverPool.entries()) {\n        if (now - instance.lastUsed > timeout) {\n          toRemove.push(userId);\n        }\n      }\n      \n      for (const userId of toRemove) {\n        const instance = this.serverPool.get(userId)!;\n        try {\n          await instance.server.close();\n          this.serverPool.delete(userId);\n          \n          this.logger.debug('Cleaned up idle server instance', {\n            userId,\n            idleTime: now - instance.lastUsed\n          });\n        } catch (error) {\n          this.logger.error('Error cleaning up server instance', error as Error, { userId });\n        }\n      }\n      \n      // Reschedule if pool is not empty\n      if (this.serverPool.size > 0) {\n        this.scheduleCleanup();\n      } else {\n        this.cleanupTimer = undefined;\n      }\n    }, timeout);\n  }\n  \n  /**\n   * Start stdio transport (single-user mode)\n   */\n  private async startStdioTransport(): Promise<void> {\n    this.logger.info('Starting stdio transport');\n    \n    // For stdio, we use environment variable for token\n    const envVar = `${this.config.resourceType.toUpperCase()}_ACCESS_TOKEN`;\n    const accessToken = process.env[envVar];\n    \n    if (!accessToken) {\n      throw new ConfigurationError(\n        `${envVar} environment variable required for stdio mode`\n      );\n    }\n    \n    const userId = 'stdio-user';\n    \n    // Create server instance\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Connect to stdio transport\n    const transport = new StdioServerTransport();\n    await server.connect(transport);\n    \n    this.logger.info('Stdio transport started', { userId });\n  }\n  \n  /**\n   * Start SSE transport (multi-user mode)\n   */\n  private async startSSETransport(): Promise<void> {\n    this.logger.info('Starting SSE transport', {\n      port: this.config.transport.port,\n      basePath: this.config.transport.basePath\n    });\n    \n    // Import express dynamically (optional dependency)\n    // @ts-ignore - Dynamic import of optional dependency\n    const express = await import('express');\n    const app = express.default();\n    \n    // Enable JSON parsing\n    app.use(express.json());\n    \n    // Enable CORS if configured\n    if (this.config.transport.cors) {\n      // @ts-ignore - Dynamic import of optional dependency\n      const cors = await import('cors');\n      app.use(cors.default({\n        origin: this.config.transport.corsOrigin || '*'\n      }));\n    }\n    \n    const basePath = this.config.transport.basePath || '/mcp';\n    \n    // SSE endpoint for MCP messages\n    app.post(`${basePath}/message`, async (req: any, res: any) => {\n      try {\n        const context: RequestContext = {\n          headers: req.headers as Record<string, string>,\n          transport: 'sse',\n          timestamp: new Date(),\n          requestId: req.headers['x-request-id'] as string | undefined\n        };\n        \n        const result = await this.handleRequest(req.body, context);\n        res.json(result);\n        \n      } catch (error) {\n        this.logger.error('SSE request failed', error as Error);\n        \n        if (error instanceof AuthenticationError || error instanceof TokenResolutionError) {\n          res.status(error.statusCode).json({\n            error: error.message,\n            code: error.code\n          });\n        } else {\n          res.status(500).json({\n            error: 'Internal server error',\n            code: 'INTERNAL_ERROR'\n          });\n        }\n      }\n    });\n    \n    // Health check endpoint\n    app.get(`${basePath}/health`, (req: any, res: any) => {\n      res.json({\n        status: 'healthy',\n        name: this.config.name,\n        version: this.config.version,\n        resourceType: this.config.resourceType,\n        instanceMode: this.config.instanceMode,\n        poolSize: this.serverPool.size\n      });\n    });\n    \n    // Start server\n    const port = this.config.transport.port || 3000;\n    const host = this.config.transport.host || '0.0.0.0';\n    \n    await new Promise<void>((resolve) => {\n      app.listen(port, host, () => {\n        this.logger.info('SSE transport listening', {\n          host,\n          port,\n          basePath,\n          url: `http://${host}:${port}${basePath}`\n        });\n        resolve();\n      });\n    });\n  }\n  \n  /**\n   * Start HTTP transport (multi-user mode)\n   */\n  private async startHTTPTransport(): Promise<void> {\n    this.logger.info('Starting HTTP transport', {\n      port: this.config.transport.port\n    });\n    \n    // HTTP transport is similar to SSE but with different endpoint structure\n    // For now, delegate to SSE implementation\n    await this.startSSETransport();\n  }\n  \n  /**\n   * Get server pool statistics\n   */\n  getPoolStats(): {\n    size: number;\n    instances: Array<{\n      userId: string;\n      createdAt: number;\n      lastUsed: number;\n      age: number;\n      idleTime: number;\n    }>;\n  } {\n    const now = Date.now();\n    const instances = Array.from(this.serverPool.entries()).map(([userId, instance]) => ({\n      userId,\n      createdAt: instance.createdAt,\n      lastUsed: instance.lastUsed,\n      age: now - instance.createdAt,\n      idleTime: now - instance.lastUsed\n    }));\n    \n    return {\n      size: this.serverPool.size,\n      instances\n    };\n  }\n  \n  /**\n   * Check if server is running\n   */\n  isServerRunning(): boolean {\n    return this.isRunning;\n  }\n}\n"],
-  "mappings": "AAQA,SAAS,4BAA4B;AAGrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAiC;AAC1C;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmCA,MAAM,2BAA2B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAqB;AAAA,EACrB;AAAA,EAER,YAAY,QAA6B;AAEvC,SAAK,eAAe,MAAM;AAG1B,SAAK,SAAS,KAAK,gBAAgB,MAAM;AAGzC,SAAK,SAAS,aAAa,KAAK,OAAO,WAAW,OAAO;AAGzD,SAAK,aAAa,oBAAI,IAAI;AAE1B,SAAK,OAAO,KAAK,sCAAsC;AAAA,MACrD,MAAM,KAAK,OAAO;AAAA,MAClB,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,cAAc,KAAK,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,QAAmC;AAExD,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI,mBAAmB,uBAAuB;AAAA,IACtD;AAEA,yBAAqB,OAAO,YAAY;AACxC,4BAAwB,OAAO,SAAS;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,QAA4D;AAClF,WAAO;AAAA,MACL,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY;AAAA,QACV,WAAW,OAAO,YAAY;AAAA,QAC9B,SAAS,OAAO,YAAY,WAAW,EAAE,SAAS,MAAM,OAAO,OAAO;AAAA,MACxE;AAAA,MACA,SAAS;AAAA,QACP,mBAAmB,OAAO,SAAS,qBAAqB;AAAA,QACxD,eAAe,OAAO,SAAS,iBAAiB;AAAA,QAChD,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACtD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,MAC7C,eAAe,OAAO,iBAAiB;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAuB;AAC3B,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,SAAK,OAAO,KAAK,yCAAyC;AAAA,MACxD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,IACnC,CAAC;AAGD,QAAI,KAAK,OAAO,aAAa,YAAY;AACvC,YAAM,KAAK,OAAO,aAAa,WAAW;AAC1C,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAGA,QAAI,KAAK,OAAO,cAAc,YAAY;AACxC,YAAM,KAAK,OAAO,cAAc,WAAW;AAC3C,WAAK,OAAO,MAAM,4BAA4B;AAAA,IAChD;AAGA,YAAQ,KAAK,OAAO,UAAU,MAAM;AAAA,MAClC,KAAK;AACH,cAAM,KAAK,oBAAoB;AAC/B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,kBAAkB;AAC7B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,mBAAmB;AAC9B;AAAA,MACF;AACE,cAAM,IAAI,eAAe,+BAA+B,KAAK,OAAO,UAAU,IAAI,EAAE;AAAA,IACxF;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,uCAAuC;AAAA,MACtD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,WAAW;AACnB;AAAA,IACF;AAEA,SAAK,OAAO,KAAK,yBAAyB;AAG1C,QAAI,KAAK,cAAc;AACrB,mBAAa,KAAK,YAAY;AAC9B,WAAK,eAAe;AAAA,IACtB;AAGA,QAAI,KAAK,OAAO,iBAAiB,UAAU;AACzC,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,OAAO,MAAM,iCAAiC,EAAE,OAAO,CAAC;AAAA,QAC/D,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,iCAAiC,OAAgB,EAAE,OAAO,CAAC;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,WAAW,MAAM;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,aAAa,SAAS;AACpC,YAAM,KAAK,OAAO,aAAa,QAAQ;AACvC,WAAK,OAAO,MAAM,0BAA0B;AAAA,IAC9C;AAGA,QAAI,KAAK,OAAO,cAAc,SAAS;AACrC,YAAM,KAAK,OAAO,cAAc,QAAQ;AACxC,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,wBAAwB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,SAAc,SAAuC;AAC/E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AACnG,UAAM,gBAAgB,KAAK,OAAO,MAAM,EAAE,UAAU,CAAC;AAErD,QAAI;AACF,oBAAc,MAAM,oBAAoB;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,YAAY,CAAC,CAAC,QAAQ;AAAA,MACxB,CAAC;AAGD,YAAM,aAAa,MAAM,KAAK,OAAO,aAAa,aAAa,OAAO;AAEtE,UAAI,CAAC,WAAW,iBAAiB,CAAC,WAAW,QAAQ;AACnD,sBAAc,KAAK,yBAAyB;AAAA,UAC1C,OAAO,WAAW;AAAA,QACpB,CAAC;AACD,cAAM,IAAI,oBAAoB,WAAW,SAAS,uBAAuB;AAAA,MAC3E;AAEA,YAAM,SAAS,eAAe,WAAW,MAAM;AAE/C,oBAAc,MAAM,6BAA6B,EAAE,OAAO,CAAC;AAG3D,YAAM,cAAc,MAAM,KAAK,OAAO,cAAc;AAAA,QAClD;AAAA,QACA,KAAK,OAAO;AAAA,MACd;AAEA,UAAI,CAAC,aAAa;AAChB,sBAAc,KAAK,2BAA2B;AAAA,UAC5C;AAAA,UACA,cAAc,KAAK,OAAO;AAAA,QAC5B,CAAC;AACD,cAAM,IAAI,qBAAqB,QAAQ,KAAK,OAAO,YAAY;AAAA,MACjE;AAEA,0BAAoB,WAAW;AAE/B,oBAAc,MAAM,kBAAkB;AAAA,QACpC;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,QAC1B,aAAa,YAAY;AAAA,MAC3B,CAAC;AAGD,YAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ,WAAW;AAK/D,oBAAc,MAAM,yCAAyC,EAAE,OAAO,CAAC;AAIvE,YAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,cAAc,KAAK,OAAO,aAAa;AAEjF,oBAAc,KAAK,gCAAgC;AAAA,QACjD;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAED,aAAO;AAAA,IAET,SAAS,OAAO;AACd,oBAAc,MAAM,2BAA2B,KAAc;AAC7D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,QAAgB,aAAsC;AACpF,QAAI,KAAK,OAAO,iBAAiB,aAAa;AAE5C,WAAK,OAAO,MAAM,sCAAsC,EAAE,OAAO,CAAC;AAClE,aAAO,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAAA,IAC5D;AAGA,WAAO,MAAM,KAAK,wBAAwB,QAAQ,WAAW;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBAAwB,QAAgB,aAAsC;AAE1F,QAAI,KAAK,WAAW,IAAI,MAAM,GAAG;AAC/B,YAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAG3C,UAAI,SAAS,gBAAgB,aAAa;AACxC,aAAK,OAAO,KAAK,6CAA6C,EAAE,OAAO,CAAC;AACxE,cAAM,SAAS,OAAO,MAAM;AAC5B,aAAK,WAAW,OAAO,MAAM;AAAA,MAC/B,OAAO;AAEL,iBAAS,WAAW,KAAK,IAAI;AAC7B,aAAK,OAAO,MAAM,kCAAkC,EAAE,OAAO,CAAC;AAC9D,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,QAAQ,KAAK,OAAO,QAAQ,iBAAiB;AAC/D,WAAK,OAAO,KAAK,uDAAuD;AAAA,QACtE,UAAU,KAAK,WAAW;AAAA,QAC1B,UAAU,KAAK,OAAO,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,KAAK,oBAAoB;AAAA,IACjC;AAGA,SAAK,OAAO,KAAK,uCAAuC,EAAE,OAAO,CAAC;AAClE,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,SAAK,WAAW,IAAI,QAAQ;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AAGD,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,gBAAgB;AAAA,IACvB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,QAAI,eAA8B;AAClC,QAAI,aAAa;AAEjB,eAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,UAAI,SAAS,WAAW,YAAY;AAClC,qBAAa,SAAS;AACtB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,WAAW,KAAK,WAAW,IAAI,YAAY;AACjD,YAAM,SAAS,OAAO,MAAM;AAC5B,WAAK,WAAW,OAAO,YAAY;AAEnC,WAAK,OAAO,MAAM,kCAAkC;AAAA,QAClD,QAAQ;AAAA,QACR,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAwB;AAC9B,UAAM,UAAU,KAAK,OAAO,QAAQ;AAEpC,SAAK,eAAe,WAAW,YAAY;AACzC,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,WAAqB,CAAC;AAE5B,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI,MAAM,SAAS,WAAW,SAAS;AACrC,mBAAS,KAAK,MAAM;AAAA,QACtB;AAAA,MACF;AAEA,iBAAW,UAAU,UAAU;AAC7B,cAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAC3C,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,WAAW,OAAO,MAAM;AAE7B,eAAK,OAAO,MAAM,mCAAmC;AAAA,YACnD;AAAA,YACA,UAAU,MAAM,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,qCAAqC,OAAgB,EAAE,OAAO,CAAC;AAAA,QACnF;AAAA,MACF;AAGA,UAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,aAAK,gBAAgB;AAAA,MACvB,OAAO;AACL,aAAK,eAAe;AAAA,MACtB;AAAA,IACF,GAAG,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,SAAK,OAAO,KAAK,0BAA0B;AAG3C,UAAM,SAAS,GAAG,KAAK,OAAO,aAAa,YAAY,CAAC;AACxD,UAAM,cAAc,QAAQ,IAAI,MAAM;AAEtC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS;AAGf,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,UAAM,YAAY,IAAI,qBAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,SAAK,OAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBAAmC;AAC/C,SAAK,OAAO,KAAK,0BAA0B;AAAA,MACzC,MAAM,KAAK,OAAO,UAAU;AAAA,MAC5B,UAAU,KAAK,OAAO,UAAU;AAAA,IAClC,CAAC;AAID,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,MAAM,QAAQ,QAAQ;AAG5B,QAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,QAAI,KAAK,OAAO,UAAU,MAAM;AAE9B,YAAM,OAAO,MAAM,OAAO,MAAM;AAChC,UAAI,IAAI,KAAK,QAAQ;AAAA,QACnB,QAAQ,KAAK,OAAO,UAAU,cAAc;AAAA,MAC9C,CAAC,CAAC;AAAA,IACJ;AAEA,UAAM,WAAW,KAAK,OAAO,UAAU,YAAY;AAGnD,QAAI,KAAK,GAAG,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC5D,UAAI;AACF,cAAM,UAA0B;AAAA,UAC9B,SAAS,IAAI;AAAA,UACb,WAAW;AAAA,UACX,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,IAAI,QAAQ,cAAc;AAAA,QACvC;AAEA,cAAM,SAAS,MAAM,KAAK,cAAc,IAAI,MAAM,OAAO;AACzD,YAAI,KAAK,MAAM;AAAA,MAEjB,SAAS,OAAO;AACd,aAAK,OAAO,MAAM,sBAAsB,KAAc;AAEtD,YAAI,iBAAiB,uBAAuB,iBAAiB,sBAAsB;AACjF,cAAI,OAAO,MAAM,UAAU,EAAE,KAAK;AAAA,YAChC,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,UACd,CAAC;AAAA,QACH,OAAO;AACL,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,GAAG,QAAQ,WAAW,CAAC,KAAU,QAAa;AACpD,UAAI,KAAK;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,KAAK,OAAO;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,QACrB,cAAc,KAAK,OAAO;AAAA,QAC1B,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAGD,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAC3C,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAE3C,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,aAAK,OAAO,KAAK,2BAA2B;AAAA,UAC1C;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU,IAAI,IAAI,IAAI,GAAG,QAAQ;AAAA,QACxC,CAAC;AACD,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBAAoC;AAChD,SAAK,OAAO,KAAK,2BAA2B;AAAA,MAC1C,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAID,UAAM,KAAK,kBAAkB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,eASE;AACA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,QAAQ,OAAO;AAAA,MACnF;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS;AAAA,MACnB,KAAK,MAAM,SAAS;AAAA,MACpB,UAAU,MAAM,SAAS;AAAA,IAC3B,EAAE;AAEF,WAAO;AAAA,MACL,MAAM,KAAK,WAAW;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,kBAA2B;AACzB,WAAO,KAAK;AAAA,EACd;AACF;",
+  "sourcesContent": ["/**\n * Authenticated server wrapper implementation\n *\n * Wraps MCP servers with authentication and multi-tenancy support.\n * Uses ephemeral instances by default for security.\n */\n\nimport type { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport type { ServerWrapperConfig, NormalizedServerWrapperConfig } from './config.js';\nimport type { RequestContext } from '../types.js';\nimport { \n  AuthenticationError, \n  TokenResolutionError,\n  ConfigurationError,\n  TransportError\n} from '../utils/errors.js';\nimport { createLogger, type Logger } from '../utils/logger.js';\nimport {\n  validateRequiredFields,\n  validateResourceType,\n  validateUserId,\n  validateAccessToken,\n  validateTransportConfig\n} from '../utils/validation.js';\n\n/**\n * Server instance metadata (for pooled mode)\n */\ninterface ServerInstance {\n  server: Server;\n  accessToken: string;\n  userId: string;\n  createdAt: number;\n  lastUsed: number;\n}\n\n/**\n * Authenticated server wrapper\n * \n * Wraps an MCP server with authentication, automatically handling:\n * - Request authentication via AuthProvider\n * - Token resolution via ResourceTokenResolver\n * - Per-user server instance creation (ephemeral or pooled)\n * - Transport management (stdio, SSE, HTTP)\n * \n * @example\n * ```typescript\n * const wrapper = new AuthenticatedServerWrapper({\n *   serverFactory: (accessToken, userId) => createInstagramServer(accessToken),\n *   authProvider: new JWTAuthProvider({ ... }),\n *   tokenResolver: new DatabaseTokenResolver({ ... }),\n *   resourceType: 'instagram',\n *   transport: { type: 'sse', port: 3000 }\n * });\n * \n * await wrapper.start();\n * ```\n */\nexport class AuthenticatedServerWrapper {\n  private config: NormalizedServerWrapperConfig;\n  private logger: Logger;\n  private serverPool: Map<string, ServerInstance>;\n  private isRunning: boolean = false;\n  private cleanupTimer?: NodeJS.Timeout;\n  \n  constructor(config: ServerWrapperConfig) {\n    // Validate configuration\n    this.validateConfig(config);\n    \n    // Normalize configuration with defaults\n    this.config = this.normalizeConfig(config);\n    \n    // Initialize logger\n    this.logger = createLogger(this.config.middleware.logging);\n    \n    // Initialize server pool (only used in pooled mode)\n    this.serverPool = new Map();\n    \n    this.logger.info('AuthenticatedServerWrapper created', {\n      name: this.config.name,\n      resourceType: this.config.resourceType,\n      transport: this.config.transport.type,\n      instanceMode: this.config.instanceMode\n    });\n  }\n  \n  /**\n   * Validate wrapper configuration\n   */\n  private validateConfig(config: ServerWrapperConfig): void {\n    // Validate required fields manually for better type safety\n    if (!config.serverFactory) {\n      throw new ConfigurationError('serverFactory is required');\n    }\n    if (!config.authProvider) {\n      throw new ConfigurationError('authProvider is required');\n    }\n    if (!config.tokenResolver) {\n      throw new ConfigurationError('tokenResolver is required');\n    }\n    if (!config.resourceType) {\n      throw new ConfigurationError('resourceType is required');\n    }\n    if (!config.transport) {\n      throw new ConfigurationError('transport is required');\n    }\n    \n    validateResourceType(config.resourceType);\n    validateTransportConfig(config.transport);\n  }\n  \n  /**\n   * Normalize configuration with defaults\n   */\n  private normalizeConfig(config: ServerWrapperConfig): NormalizedServerWrapperConfig {\n    return {\n      serverFactory: config.serverFactory,\n      authProvider: config.authProvider,\n      tokenResolver: config.tokenResolver,\n      resourceType: config.resourceType,\n      transport: config.transport,\n      name: config.name ?? 'mcp-auth-wrapped-server',\n      version: config.version ?? '1.0.0',\n      instanceMode: config.instanceMode ?? 'ephemeral',\n      middleware: {\n        rateLimit: config.middleware?.rateLimit,\n        logging: config.middleware?.logging ?? { enabled: true, level: 'info' }\n      },\n      pooling: {\n        maxServersPerUser: config.pooling?.maxServersPerUser ?? 1,\n        idleTimeoutMs: config.pooling?.idleTimeoutMs ?? 300000,\n        maxTotalServers: config.pooling?.maxTotalServers ?? 100\n      },\n      requestTimeoutMs: config.requestTimeoutMs ?? 30000,\n      enableTracing: config.enableTracing ?? false\n    };\n  }\n  \n  /**\n   * Start the wrapped server\n   */\n  async start(): Promise<void> {\n    if (this.isRunning) {\n      throw new ConfigurationError('Server is already running');\n    }\n    \n    this.logger.info('Starting authenticated server wrapper', {\n      name: this.config.name,\n      transport: this.config.transport.type\n    });\n    \n    // Initialize auth provider\n    if (this.config.authProvider.initialize) {\n      await this.config.authProvider.initialize();\n      this.logger.debug('Auth provider initialized');\n    }\n    \n    // Initialize token resolver\n    if (this.config.tokenResolver.initialize) {\n      await this.config.tokenResolver.initialize();\n      this.logger.debug('Token resolver initialized');\n    }\n    \n    // Start appropriate transport\n    switch (this.config.transport.type) {\n      case 'stdio':\n        await this.startStdioTransport();\n        break;\n      case 'sse':\n        await this.startSSETransport();\n        break;\n      case 'http':\n        await this.startHTTPTransport();\n        break;\n      default:\n        throw new TransportError(`Unsupported transport type: ${this.config.transport.type}`);\n    }\n    \n    this.isRunning = true;\n    \n    this.logger.info('Server wrapper started successfully', {\n      name: this.config.name,\n      transport: this.config.transport.type,\n      port: this.config.transport.port\n    });\n  }\n  \n  /**\n   * Stop the wrapped server\n   */\n  async stop(): Promise<void> {\n    if (!this.isRunning) {\n      return;\n    }\n    \n    this.logger.info('Stopping server wrapper');\n    \n    // Clear cleanup timer\n    if (this.cleanupTimer) {\n      clearTimeout(this.cleanupTimer);\n      this.cleanupTimer = undefined;\n    }\n    \n    // Close all pooled servers\n    if (this.config.instanceMode === 'pooled') {\n      for (const [userId, instance] of this.serverPool.entries()) {\n        try {\n          await instance.server.close();\n          this.logger.debug('Closed pooled server instance', { userId });\n        } catch (error) {\n          this.logger.error('Error closing server instance', error as Error, { userId });\n        }\n      }\n      this.serverPool.clear();\n    }\n    \n    // Cleanup auth provider\n    if (this.config.authProvider.cleanup) {\n      await this.config.authProvider.cleanup();\n      this.logger.debug('Auth provider cleaned up');\n    }\n    \n    // Cleanup token resolver\n    if (this.config.tokenResolver.cleanup) {\n      await this.config.tokenResolver.cleanup();\n      this.logger.debug('Token resolver cleaned up');\n    }\n    \n    this.isRunning = false;\n    \n    this.logger.info('Server wrapper stopped');\n  }\n  \n  /**\n   * Handle incoming MCP request with authentication\n   */\n  private async handleRequest(request: any, context: RequestContext): Promise<any> {\n    const requestId = context.requestId ?? `req-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;\n    const requestLogger = this.logger.child({ requestId });\n    \n    try {\n      requestLogger.debug('Handling request', {\n        transport: context.transport,\n        hasHeaders: !!context.headers\n      });\n      \n      // 1. Authenticate request\n      const authResult = await this.config.authProvider.authenticate(context);\n      \n      if (!authResult.authenticated || !authResult.userId) {\n        requestLogger.warn('Authentication failed', {\n          error: authResult.error\n        });\n        throw new AuthenticationError(authResult.error || 'Authentication failed');\n      }\n      \n      const userId = validateUserId(authResult.userId);\n      \n      requestLogger.debug('Authentication successful', { userId });\n      \n      // 2. Resolve resource token\n      const accessToken = await this.config.tokenResolver.resolveToken(\n        userId,\n        this.config.resourceType\n      );\n      \n      if (!accessToken) {\n        requestLogger.warn('Token resolution failed', {\n          userId,\n          resourceType: this.config.resourceType\n        });\n        throw new TokenResolutionError(userId, this.config.resourceType);\n      }\n      \n      validateAccessToken(accessToken);\n      \n      requestLogger.debug('Token resolved', {\n        userId,\n        resourceType: this.config.resourceType,\n        tokenLength: accessToken.length\n      });\n      \n      // 3. Get server instance (ephemeral or pooled)\n      const server = await this.getServerInstance(userId, accessToken);\n      \n      // 4. Forward request to server\n      // Note: This is a simplified version. Actual implementation would need\n      // to properly handle MCP protocol messages\n      requestLogger.debug('Forwarding request to server instance', { userId });\n      \n      // TODO: Implement actual MCP request forwarding\n      // For now, this is a placeholder\n      const response = { success: true, userId, resourceType: this.config.resourceType };\n      \n      requestLogger.info('Request handled successfully', {\n        userId,\n        resourceType: this.config.resourceType\n      });\n      \n      return response;\n      \n    } catch (error) {\n      requestLogger.error('Request handling failed', error as Error);\n      throw error;\n    }\n  }\n  \n  /**\n   * Get server instance (ephemeral or from pool)\n   */\n  private async getServerInstance(userId: string, accessToken: string): Promise<Server> {\n    if (this.config.instanceMode === 'ephemeral') {\n      // Create new server instance for each request (recommended)\n      this.logger.debug('Creating ephemeral server instance', { userId });\n      return await this.config.serverFactory(accessToken, userId);\n    }\n    \n    // Pooled mode\n    return await this.getPooledServerInstance(userId, accessToken);\n  }\n  \n  /**\n   * Get or create pooled server instance\n   */\n  private async getPooledServerInstance(userId: string, accessToken: string): Promise<Server> {\n    // Check if we have a cached server instance\n    if (this.serverPool.has(userId)) {\n      const instance = this.serverPool.get(userId)!;\n      \n      // Check if token changed (user rotated token)\n      if (instance.accessToken !== accessToken) {\n        this.logger.info('Token changed, recreating server instance', { userId });\n        await instance.server.close();\n        this.serverPool.delete(userId);\n      } else {\n        // Reuse existing instance\n        instance.lastUsed = Date.now();\n        this.logger.debug('Reusing pooled server instance', { userId });\n        return instance.server;\n      }\n    }\n    \n    // Check pool size limit\n    if (this.serverPool.size >= this.config.pooling.maxTotalServers) {\n      this.logger.warn('Server pool limit reached, evicting oldest instance', {\n        poolSize: this.serverPool.size,\n        maxTotal: this.config.pooling.maxTotalServers\n      });\n      await this.evictOldestInstance();\n    }\n    \n    // Create new server instance\n    this.logger.info('Creating new pooled server instance', { userId });\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Add to pool\n    this.serverPool.set(userId, {\n      server,\n      accessToken,\n      userId,\n      createdAt: Date.now(),\n      lastUsed: Date.now()\n    });\n    \n    // Schedule cleanup if not already scheduled\n    if (!this.cleanupTimer) {\n      this.scheduleCleanup();\n    }\n    \n    return server;\n  }\n  \n  /**\n   * Evict oldest server instance from pool\n   */\n  private async evictOldestInstance(): Promise<void> {\n    let oldestUserId: string | null = null;\n    let oldestTime = Infinity;\n    \n    for (const [userId, instance] of this.serverPool.entries()) {\n      if (instance.lastUsed < oldestTime) {\n        oldestTime = instance.lastUsed;\n        oldestUserId = userId;\n      }\n    }\n    \n    if (oldestUserId) {\n      const instance = this.serverPool.get(oldestUserId)!;\n      await instance.server.close();\n      this.serverPool.delete(oldestUserId);\n      \n      this.logger.debug('Evicted oldest server instance', {\n        userId: oldestUserId,\n        age: Date.now() - instance.createdAt\n      });\n    }\n  }\n  \n  /**\n   * Schedule cleanup of idle server instances\n   */\n  private scheduleCleanup(): void {\n    const timeout = this.config.pooling.idleTimeoutMs;\n    \n    this.cleanupTimer = setTimeout(async () => {\n      const now = Date.now();\n      const toRemove: string[] = [];\n      \n      for (const [userId, instance] of this.serverPool.entries()) {\n        if (now - instance.lastUsed > timeout) {\n          toRemove.push(userId);\n        }\n      }\n      \n      for (const userId of toRemove) {\n        const instance = this.serverPool.get(userId)!;\n        try {\n          await instance.server.close();\n          this.serverPool.delete(userId);\n          \n          this.logger.debug('Cleaned up idle server instance', {\n            userId,\n            idleTime: now - instance.lastUsed\n          });\n        } catch (error) {\n          this.logger.error('Error cleaning up server instance', error as Error, { userId });\n        }\n      }\n      \n      // Reschedule if pool is not empty\n      if (this.serverPool.size > 0) {\n        this.scheduleCleanup();\n      } else {\n        this.cleanupTimer = undefined;\n      }\n    }, timeout);\n  }\n  \n  /**\n   * Start stdio transport (single-user mode)\n   */\n  private async startStdioTransport(): Promise<void> {\n    this.logger.info('Starting stdio transport');\n    \n    // For stdio, we use environment variable for token\n    const envVar = `${this.config.resourceType.toUpperCase()}_ACCESS_TOKEN`;\n    const accessToken = process.env[envVar];\n    \n    if (!accessToken) {\n      throw new ConfigurationError(\n        `${envVar} environment variable required for stdio mode`\n      );\n    }\n    \n    const userId = 'stdio-user';\n    \n    // Create server instance\n    const server = await this.config.serverFactory(accessToken, userId);\n    \n    // Connect to stdio transport\n    const transport = new StdioServerTransport();\n    await server.connect(transport);\n    \n    this.logger.info('Stdio transport started', { userId });\n  }\n  \n  /**\n   * Start SSE transport (multi-user mode)\n   */\n  private async startSSETransport(): Promise<void> {\n    this.logger.info('Starting SSE transport', {\n      port: this.config.transport.port,\n      basePath: this.config.transport.basePath\n    });\n    \n    // Import express dynamically (optional dependency)\n    // @ts-ignore - Dynamic import of optional dependency\n    const express = await import('express');\n    const app = express.default();\n    \n    // Enable JSON parsing\n    app.use(express.json());\n    \n    // Enable CORS if configured\n    if (this.config.transport.cors) {\n      // @ts-ignore - Dynamic import of optional dependency\n      const cors = await import('cors');\n      app.use(cors.default({\n        origin: this.config.transport.corsOrigin || '*'\n      }));\n    }\n    \n    const basePath = this.config.transport.basePath || '/mcp';\n    \n    // Root endpoint info\n    app.get(basePath, (req: any, res: any) => {\n      res.json({\n        name: this.config.name,\n        version: this.config.version,\n        resourceType: this.config.resourceType,\n        endpoints: {\n          message: `POST ${basePath}/message`,\n          health: `GET ${basePath}/health`\n        },\n        documentation: 'https://github.com/prmichaelsen/mcp-auth'\n      });\n    });\n    \n    // SSE endpoint for MCP messages\n    app.post(`${basePath}/message`, async (req: any, res: any) => {\n      try {\n        const context: RequestContext = {\n          headers: req.headers as Record<string, string>,\n          transport: 'sse',\n          timestamp: new Date(),\n          requestId: req.headers['x-request-id'] as string | undefined\n        };\n        \n        const result = await this.handleRequest(req.body, context);\n        res.json(result);\n        \n      } catch (error) {\n        this.logger.error('SSE request failed', error as Error);\n        \n        if (error instanceof AuthenticationError || error instanceof TokenResolutionError) {\n          res.status(error.statusCode).json({\n            error: error.message,\n            code: error.code\n          });\n        } else {\n          res.status(500).json({\n            error: 'Internal server error',\n            code: 'INTERNAL_ERROR'\n          });\n        }\n      }\n    });\n    \n    // Health check endpoint\n    app.get(`${basePath}/health`, (req: any, res: any) => {\n      res.json({\n        status: 'healthy',\n        name: this.config.name,\n        version: this.config.version,\n        resourceType: this.config.resourceType,\n        instanceMode: this.config.instanceMode,\n        poolSize: this.serverPool.size\n      });\n    });\n    \n    // Start server\n    const port = this.config.transport.port || 3000;\n    const host = this.config.transport.host || '0.0.0.0';\n    \n    await new Promise<void>((resolve) => {\n      app.listen(port, host, () => {\n        this.logger.info('SSE transport listening', {\n          host,\n          port,\n          basePath,\n          url: `http://${host}:${port}${basePath}`\n        });\n        resolve();\n      });\n    });\n  }\n  \n  /**\n   * Start HTTP transport (multi-user mode)\n   */\n  private async startHTTPTransport(): Promise<void> {\n    this.logger.info('Starting HTTP transport', {\n      port: this.config.transport.port\n    });\n    \n    // HTTP transport is similar to SSE but with different endpoint structure\n    // For now, delegate to SSE implementation\n    await this.startSSETransport();\n  }\n  \n  /**\n   * Get server pool statistics\n   */\n  getPoolStats(): {\n    size: number;\n    instances: Array<{\n      userId: string;\n      createdAt: number;\n      lastUsed: number;\n      age: number;\n      idleTime: number;\n    }>;\n  } {\n    const now = Date.now();\n    const instances = Array.from(this.serverPool.entries()).map(([userId, instance]) => ({\n      userId,\n      createdAt: instance.createdAt,\n      lastUsed: instance.lastUsed,\n      age: now - instance.createdAt,\n      idleTime: now - instance.lastUsed\n    }));\n    \n    return {\n      size: this.serverPool.size,\n      instances\n    };\n  }\n  \n  /**\n   * Check if server is running\n   */\n  isServerRunning(): boolean {\n    return this.isRunning;\n  }\n}\n"],
+  "mappings": "AAQA,SAAS,4BAA4B;AAGrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAiC;AAC1C;AAAA,EAEE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmCA,MAAM,2BAA2B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,YAAqB;AAAA,EACrB;AAAA,EAER,YAAY,QAA6B;AAEvC,SAAK,eAAe,MAAM;AAG1B,SAAK,SAAS,KAAK,gBAAgB,MAAM;AAGzC,SAAK,SAAS,aAAa,KAAK,OAAO,WAAW,OAAO;AAGzD,SAAK,aAAa,oBAAI,IAAI;AAE1B,SAAK,OAAO,KAAK,sCAAsC;AAAA,MACrD,MAAM,KAAK,OAAO;AAAA,MAClB,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,cAAc,KAAK,OAAO;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,QAAmC;AAExD,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,eAAe;AACzB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AACA,QAAI,CAAC,OAAO,cAAc;AACxB,YAAM,IAAI,mBAAmB,0BAA0B;AAAA,IACzD;AACA,QAAI,CAAC,OAAO,WAAW;AACrB,YAAM,IAAI,mBAAmB,uBAAuB;AAAA,IACtD;AAEA,yBAAqB,OAAO,YAAY;AACxC,4BAAwB,OAAO,SAAS;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,QAA4D;AAClF,WAAO;AAAA,MACL,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,cAAc,OAAO,gBAAgB;AAAA,MACrC,YAAY;AAAA,QACV,WAAW,OAAO,YAAY;AAAA,QAC9B,SAAS,OAAO,YAAY,WAAW,EAAE,SAAS,MAAM,OAAO,OAAO;AAAA,MACxE;AAAA,MACA,SAAS;AAAA,QACP,mBAAmB,OAAO,SAAS,qBAAqB;AAAA,QACxD,eAAe,OAAO,SAAS,iBAAiB;AAAA,QAChD,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACtD;AAAA,MACA,kBAAkB,OAAO,oBAAoB;AAAA,MAC7C,eAAe,OAAO,iBAAiB;AAAA,IACzC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,QAAuB;AAC3B,QAAI,KAAK,WAAW;AAClB,YAAM,IAAI,mBAAmB,2BAA2B;AAAA,IAC1D;AAEA,SAAK,OAAO,KAAK,yCAAyC;AAAA,MACxD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,IACnC,CAAC;AAGD,QAAI,KAAK,OAAO,aAAa,YAAY;AACvC,YAAM,KAAK,OAAO,aAAa,WAAW;AAC1C,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAGA,QAAI,KAAK,OAAO,cAAc,YAAY;AACxC,YAAM,KAAK,OAAO,cAAc,WAAW;AAC3C,WAAK,OAAO,MAAM,4BAA4B;AAAA,IAChD;AAGA,YAAQ,KAAK,OAAO,UAAU,MAAM;AAAA,MAClC,KAAK;AACH,cAAM,KAAK,oBAAoB;AAC/B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,kBAAkB;AAC7B;AAAA,MACF,KAAK;AACH,cAAM,KAAK,mBAAmB;AAC9B;AAAA,MACF;AACE,cAAM,IAAI,eAAe,+BAA+B,KAAK,OAAO,UAAU,IAAI,EAAE;AAAA,IACxF;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,uCAAuC;AAAA,MACtD,MAAM,KAAK,OAAO;AAAA,MAClB,WAAW,KAAK,OAAO,UAAU;AAAA,MACjC,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAsB;AAC1B,QAAI,CAAC,KAAK,WAAW;AACnB;AAAA,IACF;AAEA,SAAK,OAAO,KAAK,yBAAyB;AAG1C,QAAI,KAAK,cAAc;AACrB,mBAAa,KAAK,YAAY;AAC9B,WAAK,eAAe;AAAA,IACtB;AAGA,QAAI,KAAK,OAAO,iBAAiB,UAAU;AACzC,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,OAAO,MAAM,iCAAiC,EAAE,OAAO,CAAC;AAAA,QAC/D,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,iCAAiC,OAAgB,EAAE,OAAO,CAAC;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,WAAW,MAAM;AAAA,IACxB;AAGA,QAAI,KAAK,OAAO,aAAa,SAAS;AACpC,YAAM,KAAK,OAAO,aAAa,QAAQ;AACvC,WAAK,OAAO,MAAM,0BAA0B;AAAA,IAC9C;AAGA,QAAI,KAAK,OAAO,cAAc,SAAS;AACrC,YAAM,KAAK,OAAO,cAAc,QAAQ;AACxC,WAAK,OAAO,MAAM,2BAA2B;AAAA,IAC/C;AAEA,SAAK,YAAY;AAEjB,SAAK,OAAO,KAAK,wBAAwB;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAc,SAAc,SAAuC;AAC/E,UAAM,YAAY,QAAQ,aAAa,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,GAAG,CAAC,CAAC;AACnG,UAAM,gBAAgB,KAAK,OAAO,MAAM,EAAE,UAAU,CAAC;AAErD,QAAI;AACF,oBAAc,MAAM,oBAAoB;AAAA,QACtC,WAAW,QAAQ;AAAA,QACnB,YAAY,CAAC,CAAC,QAAQ;AAAA,MACxB,CAAC;AAGD,YAAM,aAAa,MAAM,KAAK,OAAO,aAAa,aAAa,OAAO;AAEtE,UAAI,CAAC,WAAW,iBAAiB,CAAC,WAAW,QAAQ;AACnD,sBAAc,KAAK,yBAAyB;AAAA,UAC1C,OAAO,WAAW;AAAA,QACpB,CAAC;AACD,cAAM,IAAI,oBAAoB,WAAW,SAAS,uBAAuB;AAAA,MAC3E;AAEA,YAAM,SAAS,eAAe,WAAW,MAAM;AAE/C,oBAAc,MAAM,6BAA6B,EAAE,OAAO,CAAC;AAG3D,YAAM,cAAc,MAAM,KAAK,OAAO,cAAc;AAAA,QAClD;AAAA,QACA,KAAK,OAAO;AAAA,MACd;AAEA,UAAI,CAAC,aAAa;AAChB,sBAAc,KAAK,2BAA2B;AAAA,UAC5C;AAAA,UACA,cAAc,KAAK,OAAO;AAAA,QAC5B,CAAC;AACD,cAAM,IAAI,qBAAqB,QAAQ,KAAK,OAAO,YAAY;AAAA,MACjE;AAEA,0BAAoB,WAAW;AAE/B,oBAAc,MAAM,kBAAkB;AAAA,QACpC;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,QAC1B,aAAa,YAAY;AAAA,MAC3B,CAAC;AAGD,YAAM,SAAS,MAAM,KAAK,kBAAkB,QAAQ,WAAW;AAK/D,oBAAc,MAAM,yCAAyC,EAAE,OAAO,CAAC;AAIvE,YAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,cAAc,KAAK,OAAO,aAAa;AAEjF,oBAAc,KAAK,gCAAgC;AAAA,QACjD;AAAA,QACA,cAAc,KAAK,OAAO;AAAA,MAC5B,CAAC;AAED,aAAO;AAAA,IAET,SAAS,OAAO;AACd,oBAAc,MAAM,2BAA2B,KAAc;AAC7D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,QAAgB,aAAsC;AACpF,QAAI,KAAK,OAAO,iBAAiB,aAAa;AAE5C,WAAK,OAAO,MAAM,sCAAsC,EAAE,OAAO,CAAC;AAClE,aAAO,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAAA,IAC5D;AAGA,WAAO,MAAM,KAAK,wBAAwB,QAAQ,WAAW;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,wBAAwB,QAAgB,aAAsC;AAE1F,QAAI,KAAK,WAAW,IAAI,MAAM,GAAG;AAC/B,YAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAG3C,UAAI,SAAS,gBAAgB,aAAa;AACxC,aAAK,OAAO,KAAK,6CAA6C,EAAE,OAAO,CAAC;AACxE,cAAM,SAAS,OAAO,MAAM;AAC5B,aAAK,WAAW,OAAO,MAAM;AAAA,MAC/B,OAAO;AAEL,iBAAS,WAAW,KAAK,IAAI;AAC7B,aAAK,OAAO,MAAM,kCAAkC,EAAE,OAAO,CAAC;AAC9D,eAAO,SAAS;AAAA,MAClB;AAAA,IACF;AAGA,QAAI,KAAK,WAAW,QAAQ,KAAK,OAAO,QAAQ,iBAAiB;AAC/D,WAAK,OAAO,KAAK,uDAAuD;AAAA,QACtE,UAAU,KAAK,WAAW;AAAA,QAC1B,UAAU,KAAK,OAAO,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,KAAK,oBAAoB;AAAA,IACjC;AAGA,SAAK,OAAO,KAAK,uCAAuC,EAAE,OAAO,CAAC;AAClE,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,SAAK,WAAW,IAAI,QAAQ;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,UAAU,KAAK,IAAI;AAAA,IACrB,CAAC;AAGD,QAAI,CAAC,KAAK,cAAc;AACtB,WAAK,gBAAgB;AAAA,IACvB;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,QAAI,eAA8B;AAClC,QAAI,aAAa;AAEjB,eAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,UAAI,SAAS,WAAW,YAAY;AAClC,qBAAa,SAAS;AACtB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,QAAI,cAAc;AAChB,YAAM,WAAW,KAAK,WAAW,IAAI,YAAY;AACjD,YAAM,SAAS,OAAO,MAAM;AAC5B,WAAK,WAAW,OAAO,YAAY;AAEnC,WAAK,OAAO,MAAM,kCAAkC;AAAA,QAClD,QAAQ;AAAA,QACR,KAAK,KAAK,IAAI,IAAI,SAAS;AAAA,MAC7B,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAwB;AAC9B,UAAM,UAAU,KAAK,OAAO,QAAQ;AAEpC,SAAK,eAAe,WAAW,YAAY;AACzC,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,WAAqB,CAAC;AAE5B,iBAAW,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,QAAQ,GAAG;AAC1D,YAAI,MAAM,SAAS,WAAW,SAAS;AACrC,mBAAS,KAAK,MAAM;AAAA,QACtB;AAAA,MACF;AAEA,iBAAW,UAAU,UAAU;AAC7B,cAAM,WAAW,KAAK,WAAW,IAAI,MAAM;AAC3C,YAAI;AACF,gBAAM,SAAS,OAAO,MAAM;AAC5B,eAAK,WAAW,OAAO,MAAM;AAE7B,eAAK,OAAO,MAAM,mCAAmC;AAAA,YACnD;AAAA,YACA,UAAU,MAAM,SAAS;AAAA,UAC3B,CAAC;AAAA,QACH,SAAS,OAAO;AACd,eAAK,OAAO,MAAM,qCAAqC,OAAgB,EAAE,OAAO,CAAC;AAAA,QACnF;AAAA,MACF;AAGA,UAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,aAAK,gBAAgB;AAAA,MACvB,OAAO;AACL,aAAK,eAAe;AAAA,MACtB;AAAA,IACF,GAAG,OAAO;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,sBAAqC;AACjD,SAAK,OAAO,KAAK,0BAA0B;AAG3C,UAAM,SAAS,GAAG,KAAK,OAAO,aAAa,YAAY,CAAC;AACxD,UAAM,cAAc,QAAQ,IAAI,MAAM;AAEtC,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS;AAGf,UAAM,SAAS,MAAM,KAAK,OAAO,cAAc,aAAa,MAAM;AAGlE,UAAM,YAAY,IAAI,qBAAqB;AAC3C,UAAM,OAAO,QAAQ,SAAS;AAE9B,SAAK,OAAO,KAAK,2BAA2B,EAAE,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBAAmC;AAC/C,SAAK,OAAO,KAAK,0BAA0B;AAAA,MACzC,MAAM,KAAK,OAAO,UAAU;AAAA,MAC5B,UAAU,KAAK,OAAO,UAAU;AAAA,IAClC,CAAC;AAID,UAAM,UAAU,MAAM,OAAO,SAAS;AACtC,UAAM,MAAM,QAAQ,QAAQ;AAG5B,QAAI,IAAI,QAAQ,KAAK,CAAC;AAGtB,QAAI,KAAK,OAAO,UAAU,MAAM;AAE9B,YAAM,OAAO,MAAM,OAAO,MAAM;AAChC,UAAI,IAAI,KAAK,QAAQ;AAAA,QACnB,QAAQ,KAAK,OAAO,UAAU,cAAc;AAAA,MAC9C,CAAC,CAAC;AAAA,IACJ;AAEA,UAAM,WAAW,KAAK,OAAO,UAAU,YAAY;AAGnD,QAAI,IAAI,UAAU,CAAC,KAAU,QAAa;AACxC,UAAI,KAAK;AAAA,QACP,MAAM,KAAK,OAAO;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,QACrB,cAAc,KAAK,OAAO;AAAA,QAC1B,WAAW;AAAA,UACT,SAAS,QAAQ,QAAQ;AAAA,UACzB,QAAQ,OAAO,QAAQ;AAAA,QACzB;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH,CAAC;AAGD,QAAI,KAAK,GAAG,QAAQ,YAAY,OAAO,KAAU,QAAa;AAC5D,UAAI;AACF,cAAM,UAA0B;AAAA,UAC9B,SAAS,IAAI;AAAA,UACb,WAAW;AAAA,UACX,WAAW,oBAAI,KAAK;AAAA,UACpB,WAAW,IAAI,QAAQ,cAAc;AAAA,QACvC;AAEA,cAAM,SAAS,MAAM,KAAK,cAAc,IAAI,MAAM,OAAO;AACzD,YAAI,KAAK,MAAM;AAAA,MAEjB,SAAS,OAAO;AACd,aAAK,OAAO,MAAM,sBAAsB,KAAc;AAEtD,YAAI,iBAAiB,uBAAuB,iBAAiB,sBAAsB;AACjF,cAAI,OAAO,MAAM,UAAU,EAAE,KAAK;AAAA,YAChC,OAAO,MAAM;AAAA,YACb,MAAM,MAAM;AAAA,UACd,CAAC;AAAA,QACH,OAAO;AACL,cAAI,OAAO,GAAG,EAAE,KAAK;AAAA,YACnB,OAAO;AAAA,YACP,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF,CAAC;AAGD,QAAI,IAAI,GAAG,QAAQ,WAAW,CAAC,KAAU,QAAa;AACpD,UAAI,KAAK;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,KAAK,OAAO;AAAA,QAClB,SAAS,KAAK,OAAO;AAAA,QACrB,cAAc,KAAK,OAAO;AAAA,QAC1B,cAAc,KAAK,OAAO;AAAA,QAC1B,UAAU,KAAK,WAAW;AAAA,MAC5B,CAAC;AAAA,IACH,CAAC;AAGD,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAC3C,UAAM,OAAO,KAAK,OAAO,UAAU,QAAQ;AAE3C,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,UAAI,OAAO,MAAM,MAAM,MAAM;AAC3B,aAAK,OAAO,KAAK,2BAA2B;AAAA,UAC1C;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU,IAAI,IAAI,IAAI,GAAG,QAAQ;AAAA,QACxC,CAAC;AACD,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,qBAAoC;AAChD,SAAK,OAAO,KAAK,2BAA2B;AAAA,MAC1C,MAAM,KAAK,OAAO,UAAU;AAAA,IAC9B,CAAC;AAID,UAAM,KAAK,kBAAkB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA,EAKA,eASE;AACA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,QAAQ,OAAO;AAAA,MACnF;AAAA,MACA,WAAW,SAAS;AAAA,MACpB,UAAU,SAAS;AAAA,MACnB,KAAK,MAAM,SAAS;AAAA,MACpB,UAAU,MAAM,SAAS;AAAA,IAC3B,EAAE;AAEF,WAAO;AAAA,MACL,MAAM,KAAK,WAAW;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,kBAA2B;AACzB,WAAO,KAAK;AAAA,EACd;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prmichaelsen/mcp-auth",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Authentication and multi-tenancy framework for MCP servers",
   "type": "module",
   "main": "dist/index.js",