@productmaker/mcp 8.3.0 → 8.3.1

package/README.md

@@ -268,6 +268,10 @@ The `base64` field was removed. MCP JSON-RPC transports truncate large tool argu
 
 ## Version history
 
+### 8.3.1 — Refresh token garantizado
+
+- OAuth alojado: el proxy `/oauth/authorize` añade `offline_access` al scope antes de redirigir a Auth0. Los hosts que siguen el spec piden solo `mcp:access` (lo que anuncian el challenge y la metadata del recurso) y sin esto Auth0 nunca emitía refresh token.
+
 ### 8.3.0 — Idempotencia de tools pagadas + refresh OAuth
 
 - Tools pagadas (`create_product_task`, `create_service_video`, `generate_video_creative`, `generate_free_video`, `generate_image_creatives`, `generate_landing`, `create_creative_variant`): envían un `Idempotency-Key` derivado de los argumentos semánticos (ventana de 15 min). Un reintento con los mismos argumentos devuelve la misma tarea (`replayed: true`) sin segundo cargo; una tarea en `error` sí se reintenta.

package/dist/http.js

@@ -16815,6 +16815,121 @@ var Auth0TokenVerifier = class {
   }
 };
 
+// src/oauth-analytics.ts
+import { PostHog } from "posthog-node";
+var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
+var REDACTED = "[REDACTED]";
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "token",
+  "authorization",
+  "apikey",
+  "clientsecret",
+  "subjecttoken",
+  "accesstoken",
+  "refreshtoken",
+  "idtoken",
+  "code",
+  "secret",
+  "password"
+]);
+var SENSITIVE_ASSIGNMENT_PATTERN = /(\b(?:access[_-]?token|authorization|client[_-]?secret|subject[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password|code)\b\s*[:=]\s*)(?:(bearer)\s+)?(?:(['"])(.*?)\3|([^\s,;&}"']+))/gi;
+var BEARER_TOKEN_PATTERN = /\b(bearer\s+)([A-Za-z0-9._~+/=-]+)/gi;
+var client = null;
+var KNOWN_MCP_OAUTH_ANALYTICS_EVENTS = [
+  MCP_OAUTH_ANALYTICS_EVENTS.STARTED,
+  MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED,
+  MCP_OAUTH_ANALYTICS_EVENTS.FAILED,
+  MCP_OAUTH_ANALYTICS_EVENTS.SAFE_VARIANT
+];
+function getPostHogClient() {
+  if (client) return client;
+  const apiKey = process.env.POSTHOG_API_KEY;
+  if (!apiKey) return null;
+  client = new PostHog(apiKey, {
+    host: process.env.POSTHOG_HOST || DEFAULT_POSTHOG_HOST,
+    flushAt: 20,
+    flushInterval: 1e4
+  });
+  return client;
+}
+__name(getPostHogClient, "getPostHogClient");
+function normalizeKey(key) {
+  return key.replace(/[^a-z0-9]/gi, "").toLowerCase();
+}
+__name(normalizeKey, "normalizeKey");
+function isSensitiveKey(key) {
+  const normalizedKey = normalizeKey(key);
+  return SENSITIVE_KEYS.has(normalizedKey) || normalizedKey.endsWith("token") || normalizedKey.endsWith("secret");
+}
+__name(isSensitiveKey, "isSensitiveKey");
+function sanitizeUrl(value) {
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return value;
+    }
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return value;
+  }
+}
+__name(sanitizeUrl, "sanitizeUrl");
+function sanitizeString(value) {
+  const redacted = value.replace(SENSITIVE_ASSIGNMENT_PATTERN, (_match, prefix, scheme, quote) => {
+    const replacement = quote ? `${quote}${REDACTED}${quote}` : REDACTED;
+    return `${prefix}${scheme ? `${scheme} ` : ""}${replacement}`;
+  }).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED}`);
+  const sanitizedUrl = sanitizeUrl(redacted);
+  if (sanitizedUrl !== redacted) return sanitizedUrl;
+  return redacted.replace(/https?:\/\/[^\s"'<>]+/gi, sanitizeUrl);
+}
+__name(sanitizeString, "sanitizeString");
+function sanitizeValue(value) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => sanitizeValue(entry));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
+      if (isSensitiveKey(key)) {
+        return [
+          key,
+          REDACTED
+        ];
+      }
+      return [
+        key,
+        sanitizeValue(entry)
+      ];
+    }));
+  }
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  return value;
+}
+__name(sanitizeValue, "sanitizeValue");
+var OAuthAnalytics = class {
+  static {
+    __name(this, "OAuthAnalytics");
+  }
+  capture(event, subject, properties) {
+    const posthog = getPostHogClient();
+    if (!posthog) return;
+    try {
+      posthog.capture({
+        distinctId: subject ?? "mcp_oauth_aggregate",
+        event,
+        properties: sanitizeValue(properties)
+      });
+    } catch {
+    }
+  }
+};
+
 // src/auth/oauth-proxy.ts
 import { createHmac as createHmac2, hkdfSync, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import express from "express";
@@ -16901,6 +17016,15 @@ var OAUTH_PROXY_PATHS = {
   token: "/oauth/token"
 };
 var PROXY_CALLBACK_URL = new URL(OAUTH_PROXY_PATHS.callback.slice(1), STATIC_CLIENT_ISSUER).href;
+function responseIssuesRefreshToken(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    return typeof parsed === "object" && parsed !== null && "refresh_token" in parsed && typeof parsed.refresh_token === "string" && parsed.refresh_token !== "";
+  } catch {
+    return false;
+  }
+}
+__name(responseIssuesRefreshToken, "responseIssuesRefreshToken");
 function firstQueryValue(value) {
   if (typeof value === "string") return value;
   if (Array.isArray(value) && typeof value[0] === "string") return value[0];
@@ -16914,6 +17038,12 @@ function badRequest(res, description) {
   });
 }
 __name(badRequest, "badRequest");
+function withRefreshScope(requested) {
+  const scopes = (requested?.trim() ? requested : MCP_SCOPE).split(/\s+/).filter(Boolean);
+  if (!scopes.includes(REFRESH_SCOPE)) scopes.push(REFRESH_SCOPE);
+  return scopes.join(" ");
+}
+__name(withRefreshScope, "withRefreshScope");
 function createOAuthProxyRouter(options) {
   const router = express.Router();
   const stateKey3 = deriveStateKey(options.staticClient.clientSecret);
@@ -16937,13 +17067,14 @@ function createOAuthProxyRouter(options) {
     }
     const upstream = new URL(options.authorizationEndpoint);
     for (const [key, value] of Object.entries(req.query)) {
-      if (key === "redirect_uri" || key === "state") continue;
+      if (key === "redirect_uri" || key === "state" || key === "scope") continue;
       for (const v of Array.isArray(value) ? value : [
         value
       ]) {
         if (typeof v === "string") upstream.searchParams.append(key, v);
       }
     }
+    upstream.searchParams.set("scope", withRefreshScope(firstQueryValue(req.query.scope)));
     upstream.searchParams.set("redirect_uri", PROXY_CALLBACK_URL);
     upstream.searchParams.set("state", sealState(stateKey3, {
       redirectUri,
@@ -17023,6 +17154,14 @@ function createOAuthProxyRouter(options) {
       });
       return;
     }
+    try {
+      options.onTokenExchange?.({
+        grantType,
+        status: upstream.status,
+        refreshTokenIssued: responseIssuesRefreshToken(payload)
+      });
+    } catch {
+    }
     res.status(upstream.status).type(upstream.headers.get("content-type") ?? "application/json").send(payload);
   });
   return router;
@@ -17164,11 +17303,23 @@ function createMetadataRouter(config, metadata, fetchFn) {
     staticClient: config.staticClient,
     authorizationEndpoint: metadata.authorization_endpoint,
     tokenEndpoint: metadata.token_endpoint,
-    fetchFn
+    fetchFn,
+    onTokenExchange: captureTokenExchange
   }));
   return router;
 }
 __name(createMetadataRouter, "createMetadataRouter");
+var tokenExchangeAnalytics = new OAuthAnalytics();
+function captureTokenExchange(outcome) {
+  const ok = outcome.status >= 200 && outcome.status < 300;
+  tokenExchangeAnalytics.capture(ok ? MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED : MCP_OAUTH_ANALYTICS_EVENTS.FAILED, null, {
+    stage: "token_exchange",
+    grantType: outcome.grantType,
+    status: outcome.status,
+    refreshTokenIssued: outcome.refreshTokenIssued
+  });
+}
+__name(captureTokenExchange, "captureTokenExchange");
 function createHttpOAuth(config, metadata, fetchFn) {
   const verifier = new Auth0TokenVerifier(config, metadata.jwks_uri);
   const oboClient = new Auth0OboClient(config, {
@@ -17447,121 +17598,6 @@ function registerProductMakerPrompts(server) {
 }
 __name(registerProductMakerPrompts, "registerProductMakerPrompts");
 
-// src/oauth-analytics.ts
-import { PostHog } from "posthog-node";
-var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
-var REDACTED = "[REDACTED]";
-var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
-  "token",
-  "authorization",
-  "apikey",
-  "clientsecret",
-  "subjecttoken",
-  "accesstoken",
-  "refreshtoken",
-  "idtoken",
-  "code",
-  "secret",
-  "password"
-]);
-var SENSITIVE_ASSIGNMENT_PATTERN = /(\b(?:access[_-]?token|authorization|client[_-]?secret|subject[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password|code)\b\s*[:=]\s*)(?:(bearer)\s+)?(?:(['"])(.*?)\3|([^\s,;&}"']+))/gi;
-var BEARER_TOKEN_PATTERN = /\b(bearer\s+)([A-Za-z0-9._~+/=-]+)/gi;
-var client = null;
-var KNOWN_MCP_OAUTH_ANALYTICS_EVENTS = [
-  MCP_OAUTH_ANALYTICS_EVENTS.STARTED,
-  MCP_OAUTH_ANALYTICS_EVENTS.CONNECTED,
-  MCP_OAUTH_ANALYTICS_EVENTS.FAILED,
-  MCP_OAUTH_ANALYTICS_EVENTS.SAFE_VARIANT
-];
-function getPostHogClient() {
-  if (client) return client;
-  const apiKey = process.env.POSTHOG_API_KEY;
-  if (!apiKey) return null;
-  client = new PostHog(apiKey, {
-    host: process.env.POSTHOG_HOST || DEFAULT_POSTHOG_HOST,
-    flushAt: 20,
-    flushInterval: 1e4
-  });
-  return client;
-}
-__name(getPostHogClient, "getPostHogClient");
-function normalizeKey(key) {
-  return key.replace(/[^a-z0-9]/gi, "").toLowerCase();
-}
-__name(normalizeKey, "normalizeKey");
-function isSensitiveKey(key) {
-  const normalizedKey = normalizeKey(key);
-  return SENSITIVE_KEYS.has(normalizedKey) || normalizedKey.endsWith("token") || normalizedKey.endsWith("secret");
-}
-__name(isSensitiveKey, "isSensitiveKey");
-function sanitizeUrl(value) {
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return value;
-    }
-    parsed.username = "";
-    parsed.password = "";
-    parsed.search = "";
-    parsed.hash = "";
-    return parsed.toString();
-  } catch {
-    return value;
-  }
-}
-__name(sanitizeUrl, "sanitizeUrl");
-function sanitizeString(value) {
-  const redacted = value.replace(SENSITIVE_ASSIGNMENT_PATTERN, (_match, prefix, scheme, quote) => {
-    const replacement = quote ? `${quote}${REDACTED}${quote}` : REDACTED;
-    return `${prefix}${scheme ? `${scheme} ` : ""}${replacement}`;
-  }).replace(BEARER_TOKEN_PATTERN, `$1${REDACTED}`);
-  const sanitizedUrl = sanitizeUrl(redacted);
-  if (sanitizedUrl !== redacted) return sanitizedUrl;
-  return redacted.replace(/https?:\/\/[^\s"'<>]+/gi, sanitizeUrl);
-}
-__name(sanitizeString, "sanitizeString");
-function sanitizeValue(value) {
-  if (Array.isArray(value)) {
-    return value.map((entry) => sanitizeValue(entry));
-  }
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([key, entry]) => {
-      if (isSensitiveKey(key)) {
-        return [
-          key,
-          REDACTED
-        ];
-      }
-      return [
-        key,
-        sanitizeValue(entry)
-      ];
-    }));
-  }
-  if (typeof value === "string") {
-    return sanitizeString(value);
-  }
-  return value;
-}
-__name(sanitizeValue, "sanitizeValue");
-var OAuthAnalytics = class {
-  static {
-    __name(this, "OAuthAnalytics");
-  }
-  capture(event, subject, properties) {
-    const posthog = getPostHogClient();
-    if (!posthog) return;
-    try {
-      posthog.capture({
-        distinctId: subject ?? "mcp_oauth_aggregate",
-        event,
-        properties: sanitizeValue(properties)
-      });
-    } catch {
-    }
-  }
-};
-
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
@@ -17749,7 +17785,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "8.3.0";
+var MCP_VERSION = "8.3.1";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";

package/dist/stdio.js

@@ -16117,7 +16117,7 @@ var ApiClient = class {
 };
 
 // src/index.ts
-var MCP_VERSION = "8.3.0";
+var MCP_VERSION = "8.3.1";
 
 // src/meta-upload-app.ts
 import { readFileSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@productmaker/mcp",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "type": "module",
   "private": false,
   "description": "ProductMaker MCP server — cost products, generate landing pages, UGC videos, and ad creatives, and publish to Shopify, Meta Ads, and TikTok Ads.",