@se-studio/contentful-cms 0.0.0-next16-20260822103555

package/dist/hosted/next/stage-site.d.ts

@@ -0,0 +1,11 @@
+export interface StageSiteOptions {
+    hostDir: string;
+    repoRoot?: string;
+    cmsEditRoot?: string;
+}
+export declare function resolveCmsEditRoot(hostDir: string, repoRoot: string, cmsEditRoot?: string): string;
+export declare function stageEditorPack(options: StageSiteOptions): {
+    projectKey: string;
+    skipped: boolean;
+};
+//# sourceMappingURL=stage-site.d.ts.map

package/dist/hosted/next/stage-site.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-site.d.ts","sourceRoot":"","sources":["../../../src/hosted/next/stage-site.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAsBR;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CA+BA"}

package/dist/hosted/next/stage-site.js

@@ -0,0 +1,50 @@
+import { cpSync, existsSync, rmSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { loadProjectConfig } from '../../project/load.js';
+import { assertHostedDeployReady } from '../../project/validate-hosted.js';
+function fail(message) {
+    throw new Error(message);
+}
+export function resolveCmsEditRoot(hostDir, repoRoot, cmsEditRoot) {
+    const hasSingleSiteLayout = existsSync(join(repoRoot, 'cms-edit/project.json'));
+    let root = cmsEditRoot ?? process.env['CMS_EDIT_ROOT'];
+    if (!root) {
+        if (process.env['VERCEL']) {
+            fail('CMS_EDIT_ROOT is required on Vercel. Set it on the cms-edit-host project (e.g. cms-edit for single-site, cms-edit/<site> for multi-site).');
+        }
+        if (hasSingleSiteLayout) {
+            root = 'cms-edit';
+        }
+        else if (existsSync(join(hostDir, 'editor-pack/manifest.json'))) {
+            return '';
+        }
+        else {
+            fail('CMS_EDIT_ROOT is required locally. Set it in cms-edit/host/.env.local (e.g. CMS_EDIT_ROOT=cms-edit/pedestal-health).');
+        }
+    }
+    return root;
+}
+export function stageEditorPack(options) {
+    const hostDir = resolve(options.hostDir);
+    const repoRoot = resolve(options.repoRoot ?? join(hostDir, '../..'));
+    const cmsEditRoot = resolveCmsEditRoot(hostDir, repoRoot, options.cmsEditRoot);
+    if (!cmsEditRoot) {
+        return { projectKey: 'unknown', skipped: true };
+    }
+    const siteDir = resolve(repoRoot, cmsEditRoot);
+    const projectJsonPath = join(siteDir, 'project.json');
+    if (!existsSync(projectJsonPath)) {
+        fail(`Missing ${projectJsonPath}. Check CMS_EDIT_ROOT (${cmsEditRoot}).`);
+    }
+    const project = loadProjectConfig(projectJsonPath);
+    assertHostedDeployReady(project);
+    const projectKey = project.projectKey;
+    const editorPackSrc = join(siteDir, 'editor-pack');
+    if (!existsSync(editorPackSrc)) {
+        fail(`Missing ${editorPackSrc} — run editor-pack generate for this site, then commit editor-pack/`);
+    }
+    rmSync(join(hostDir, 'editor-pack'), { force: true, recursive: true });
+    cpSync(editorPackSrc, join(hostDir, 'editor-pack'), { recursive: true });
+    return { projectKey, skipped: false };
+}
+//# sourceMappingURL=stage-site.js.map

package/dist/hosted/next/stage-site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-site.js","sourceRoot":"","sources":["../../../src/hosted/next/stage-site.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAQ3E,SAAS,IAAI,CAAC,OAAe;IAC3B,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB,EAChB,WAAoB;IAEpB,MAAM,mBAAmB,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAChF,IAAI,IAAI,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEvD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,IAAI,CACF,2IAA2I,CAC5I,CAAC;QACJ,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,IAAI,GAAG,UAAU,CAAC;QACpB,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,IAAI,CACF,sHAAsH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB;IAIvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE/E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAEtD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,WAAW,eAAe,0BAA0B,WAAW,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACnD,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,IAAI,CACF,WAAW,aAAa,qEAAqE,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC"}

package/dist/hosted/oauth/auth.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthStore } from './store.js';
+export type McpAuthFailureReason = 'missing_bearer' | 'invalid_mcp_jwt' | 'missing_contentful_token' | 'invalid_contentful_token';
+export declare class McpUnauthorizedError extends Error {
+    readonly reason: McpAuthFailureReason;
+    constructor(reason: McpAuthFailureReason);
+}
+export declare function isMcpUnauthorizedError(error: unknown): error is McpUnauthorizedError;
+export declare function unauthorizedMcpResponse(reason?: McpAuthFailureReason): Response;
+export declare function resolveContentfulTokenFromRequest(request: Request, store: OAuthStore, 
+/** Host Contentful space — same isolation as session keys (deployment.spaceId). */
+spaceId?: string): Promise<{
+    sub: string;
+    contentfulToken: string;
+}>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/hosted/oauth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,iBAAiB,GACjB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBAE1B,MAAM,EAAE,oBAAoB;CAKzC;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAQD,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,oBAAuC,GAAG,QAAQ,CAajG;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU;AACjB,mFAAmF;AACnF,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnD"}

package/dist/hosted/oauth/auth.js

@@ -0,0 +1,54 @@
+import { extractBearerToken } from '../../config/hosted.js';
+import { getMcpResourceUrl, getProtectedResourceMetadataUrl } from './config.js';
+import { verifyMcpAccessToken } from './jwt.js';
+export class McpUnauthorizedError extends Error {
+    reason;
+    constructor(reason) {
+        super('unauthorized');
+        this.name = 'McpUnauthorizedError';
+        this.reason = reason;
+    }
+}
+export function isMcpUnauthorizedError(error) {
+    return error instanceof McpUnauthorizedError;
+}
+const INVALID_TOKEN_DESCRIPTIONS = {
+    invalid_mcp_jwt: 'MCP access token is invalid or expired.',
+    missing_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
+    invalid_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
+};
+export function unauthorizedMcpResponse(reason = 'missing_bearer') {
+    const metadataUrl = getProtectedResourceMetadataUrl();
+    const description = INVALID_TOKEN_DESCRIPTIONS[reason];
+    const www = description
+        ? `Bearer error="invalid_token", error_description="${description}", resource_metadata="${metadataUrl}"`
+        : `Bearer resource_metadata="${metadataUrl}"`;
+    return new Response(JSON.stringify({ error: 'unauthorized', reason }), {
+        status: 401,
+        headers: {
+            'Content-Type': 'application/json',
+            'WWW-Authenticate': www,
+        },
+    });
+}
+export async function resolveContentfulTokenFromRequest(request, store, 
+/** Host Contentful space — same isolation as session keys (deployment.spaceId). */
+spaceId) {
+    const bearer = extractBearerToken(request.headers.get('authorization'));
+    if (!bearer) {
+        throw new McpUnauthorizedError('missing_bearer');
+    }
+    let sub;
+    try {
+        ({ sub } = await verifyMcpAccessToken(bearer, getMcpResourceUrl()));
+    }
+    catch {
+        throw new McpUnauthorizedError('invalid_mcp_jwt');
+    }
+    const contentfulToken = await store.getContentfulToken(sub, spaceId);
+    if (!contentfulToken) {
+        throw new McpUnauthorizedError('missing_contentful_token');
+    }
+    return { sub, contentfulToken };
+}
+//# sourceMappingURL=auth.js.map

package/dist/hosted/oauth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;IAC9F,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAA+B,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}

package/dist/hosted/oauth/cached-cma.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthStore } from './store.js';
+export declare const CONTENTFUL_SESSION_EXPIRED = "Contentful session expired. Sign in with Contentful again.";
+export declare class CachedContentfulTokenError extends Error {
+    readonly reason: 'missing_contentful_token' | 'invalid_contentful_token';
+    constructor(reason: 'missing_contentful_token' | 'invalid_contentful_token', message: string);
+}
+export declare function isCachedContentfulTokenError(error: unknown): error is CachedContentfulTokenError;
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export declare function loadAndValidateContentfulToken(store: OAuthStore, sub: string, spaceId: string | undefined, validateContentfulToken?: (token: string) => Promise<void>): Promise<string>;
+//# sourceMappingURL=cached-cma.d.ts.map

package/dist/hosted/oauth/cached-cma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAE/D,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,CAAC;gBAE7D,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEhG;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzD,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/hosted/oauth/cached-cma.js

@@ -0,0 +1,41 @@
+import { isUnusableContentfulCacheReason, patValidationFailureReason } from './log.js';
+export const CONTENTFUL_SESSION_EXPIRED = 'Contentful session expired. Sign in with Contentful again.';
+export class CachedContentfulTokenError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'CachedContentfulTokenError';
+        this.reason = reason;
+    }
+}
+export function isCachedContentfulTokenError(error) {
+    return error instanceof CachedContentfulTokenError;
+}
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export async function loadAndValidateContentfulToken(store, sub, spaceId, validateContentfulToken) {
+    const token = await store.getContentfulToken(sub, spaceId);
+    if (!token) {
+        throw new CachedContentfulTokenError('missing_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+    }
+    if (validateContentfulToken) {
+        try {
+            await validateContentfulToken(token);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const reason = patValidationFailureReason(message);
+            if (isUnusableContentfulCacheReason(reason)) {
+                await store.deleteContentfulToken(sub, spaceId);
+                throw new CachedContentfulTokenError('invalid_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+            }
+            throw error;
+        }
+    }
+    await store.touchContentfulToken(sub, spaceId);
+    return token;
+}
+//# sourceMappingURL=cached-cma.js.map

package/dist/hosted/oauth/cached-cma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGvF,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAE/D,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,MAAM,CAA0D;IAEzE,YAAY,MAA+D,EAAE,OAAe;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,KAAK,YAAY,0BAA0B,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,GAAW,EACX,OAA2B,EAC3B,uBAA0D;IAE1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,uBAAuB,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hosted/oauth/complete.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthStore, PendingAuthRequest } from './store.js';
+export declare function issueAuthorizationRedirect(store: OAuthStore, authRequestId: string, sub: string, request: PendingAuthRequest): Promise<string>;
+export declare function completeAuthorizationCodeGrant(store: OAuthStore, input: {
+    code: string;
+    redirectUri: string;
+    clientId: string;
+    codeVerifier: string;
+    spaceId?: string;
+    validateContentfulToken?: (token: string) => Promise<void>;
+}): Promise<{
+    accessToken: string;
+    tokenType: string;
+    expiresIn: number;
+    refreshToken: string;
+}>;
+//# sourceMappingURL=complete.d.ts.map

package/dist/hosted/oauth/complete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAmDD"}

package/dist/hosted/oauth/complete.js

@@ -0,0 +1,55 @@
+import { randomUUID } from 'node:crypto';
+import { loadAndValidateContentfulToken } from './cached-cma.js';
+import { signMcpAccessToken } from './jwt.js';
+import { generateAuthCode } from './pkce.js';
+import { redirectUrisEquivalent } from './redirect-uri.js';
+export async function issueAuthorizationRedirect(store, authRequestId, sub, request) {
+    const code = generateAuthCode();
+    await store.saveAuthCode(code, { authRequestId, sub });
+    const redirect = new URL(request.redirectUri);
+    redirect.searchParams.set('code', code);
+    if (request.state) {
+        redirect.searchParams.set('state', request.state);
+    }
+    return redirect.toString();
+}
+export async function completeAuthorizationCodeGrant(store, input) {
+    const codeRecord = await store.peekAuthCode(input.code);
+    if (!codeRecord) {
+        throw new Error('Invalid or expired authorization code.');
+    }
+    const authRequest = await store.getPendingAuthRequest(codeRecord.authRequestId);
+    if (!authRequest) {
+        throw new Error('Authorization request expired.');
+    }
+    if (authRequest.clientId !== input.clientId) {
+        throw new Error('Invalid client_id.');
+    }
+    if (!redirectUrisEquivalent(authRequest.redirectUri, input.redirectUri)) {
+        throw new Error('Invalid redirect_uri.');
+    }
+    const { createHash } = await import('node:crypto');
+    const digest = createHash('sha256').update(input.codeVerifier).digest('base64url');
+    if (digest !== authRequest.codeChallenge) {
+        throw new Error('Invalid code_verifier.');
+    }
+    await loadAndValidateContentfulToken(store, codeRecord.sub, input.spaceId, input.validateContentfulToken);
+    const consumed = await store.consumeAuthCode(input.code);
+    if (!consumed) {
+        throw new Error('Invalid or expired authorization code.');
+    }
+    const { accessToken, expiresIn } = await signMcpAccessToken(codeRecord.sub, authRequest.resource);
+    const refreshToken = randomUUID();
+    await store.saveRefreshToken(refreshToken, {
+        sub: codeRecord.sub,
+        clientId: authRequest.clientId,
+        resource: authRequest.resource,
+    });
+    return {
+        accessToken,
+        tokenType: 'Bearer',
+        expiresIn,
+        refreshToken,
+    };
+}
+//# sourceMappingURL=complete.js.map

package/dist/hosted/oauth/complete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/config.d.ts

@@ -0,0 +1,7 @@
+export declare function getPublicOrigin(): string;
+export declare function getMcpResourceUrl(): string;
+export declare function getContentfulOAuthClientId(): string;
+export declare function getContentfulOAuthRedirectUri(): string;
+export declare function getContentfulAuthorizeUrl(authRequestId: string): string;
+export declare function getProtectedResourceMetadataUrl(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/hosted/oauth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAQA,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAEtD;AAED,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CASvE;AAED,wBAAgB,+BAA+B,IAAI,MAAM,CAExD"}

package/dist/hosted/oauth/config.js

@@ -0,0 +1,33 @@
+function requireEnv(name) {
+    const value = process.env[name]?.trim();
+    if (!value) {
+        throw new Error(`Missing required environment variable: ${name}`);
+    }
+    return value;
+}
+export function getPublicOrigin() {
+    return requireEnv('CMS_EDIT_PUBLIC_ORIGIN').replace(/\/$/, '');
+}
+export function getMcpResourceUrl() {
+    return `${getPublicOrigin()}/api/mcp`;
+}
+export function getContentfulOAuthClientId() {
+    return requireEnv('CONTENTFUL_OAUTH_CLIENT_ID');
+}
+export function getContentfulOAuthRedirectUri() {
+    return `${getPublicOrigin()}/oauth/contentful-callback`;
+}
+export function getContentfulAuthorizeUrl(authRequestId) {
+    const params = new URLSearchParams({
+        response_type: 'token',
+        client_id: getContentfulOAuthClientId(),
+        redirect_uri: getContentfulOAuthRedirectUri(),
+        scope: 'content_management_manage',
+        state: authRequestId,
+    });
+    return `https://be.contentful.com/oauth/authorize?${params.toString()}`;
+}
+export function getProtectedResourceMetadataUrl() {
+    return `${getPublicOrigin()}/.well-known/oauth-protected-resource`;
+}
+//# sourceMappingURL=config.js.map

package/dist/hosted/oauth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/hosted/oauth/config.ts"],"names":[],"mappings":"AAAA,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,eAAe,EAAE,UAAU,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,CAAC,4BAA4B,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,GAAG,eAAe,EAAE,4BAA4B,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,OAAO;QACtB,SAAS,EAAE,0BAA0B,EAAE;QACvC,YAAY,EAAE,6BAA6B,EAAE;QAC7C,KAAK,EAAE,2BAA2B;QAClC,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC;IACH,OAAO,6CAA6C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,GAAG,eAAe,EAAE,uCAAuC,CAAC;AACrE,CAAC"}

package/dist/hosted/oauth/handlers.d.ts

@@ -0,0 +1,18 @@
+import { type HostedDeploymentConfig } from '../../config/hosted.js';
+import { type OAuthStore } from './store.js';
+export interface OAuthHandlerContext {
+    store: OAuthStore;
+    deployment: HostedDeploymentConfig;
+    displayName?: string;
+}
+export declare function handleOAuthAuthorizeGet(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
+export declare function handleOAuthRegisterPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
+export declare function handleOAuthTokenPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
+export declare function handleLinkContentfulPost(request: Request, ctx: OAuthHandlerContext): Promise<Response>;
+export declare function handleOAuthAuthorizationServerMetadataGet(): Response;
+export declare function handleOAuthProtectedResourceMetadataGet(): Response;
+export declare function handleOAuthHealthCheck(): Promise<{
+    ok: boolean;
+    detail: string;
+}>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/hosted/oauth/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAW/F,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAG3E,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiDnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}

package/dist/hosted/oauth/handlers.js

@@ -0,0 +1,262 @@
+import { validatePatForDeployment } from '../../config/hosted.js';
+import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
+import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
+import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
+import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
+import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
+import { completeRefreshTokenGrant } from './refresh.js';
+import { CONTENTFUL_TOKEN_TTL_SECONDS } from './store.js';
+import { oauthTokenGrantFailureResponse } from './token-grant-response.js';
+function errorRedirect(redirectUri, message, state) {
+    if (!redirectUri) {
+        return new Response(message, { status: 400 });
+    }
+    const url = new URL(redirectUri);
+    url.searchParams.set('error', 'access_denied');
+    url.searchParams.set('error_description', message);
+    if (state) {
+        url.searchParams.set('state', state);
+    }
+    return Response.redirect(url.toString(), 302);
+}
+export async function handleOAuthAuthorizeGet(request, ctx) {
+    const url = new URL(request.url);
+    const responseType = url.searchParams.get('response_type');
+    const clientId = url.searchParams.get('client_id');
+    const redirectUri = url.searchParams.get('redirect_uri');
+    const codeChallenge = url.searchParams.get('code_challenge');
+    const codeChallengeMethod = url.searchParams.get('code_challenge_method');
+    const state = url.searchParams.get('state') ?? undefined;
+    const resource = url.searchParams.get('resource');
+    const resumeAuthRequestId = url.searchParams.get('resume');
+    const linkedSub = url.searchParams.get('sub');
+    if (resumeAuthRequestId && linkedSub) {
+        const pending = await ctx.store.getPendingAuthRequest(resumeAuthRequestId);
+        if (!pending) {
+            return new Response('Authorization request expired. Restart Connect in Claude.', {
+                status: 400,
+            });
+        }
+        const redirect = await issueAuthorizationRedirect(ctx.store, resumeAuthRequestId, linkedSub, pending);
+        return Response.redirect(redirect, 302);
+    }
+    if (responseType !== 'code') {
+        return errorRedirect(redirectUri, 'Unsupported response_type', state);
+    }
+    if (!clientId || !redirectUri || !codeChallenge || !resource) {
+        return errorRedirect(redirectUri, 'Missing required OAuth parameters', state);
+    }
+    if (codeChallengeMethod && codeChallengeMethod !== 'S256') {
+        return errorRedirect(redirectUri, 'Only S256 code challenge is supported', state);
+    }
+    const client = await ctx.store.getOAuthClient(clientId);
+    if (!client || !redirectUriMatchesRegistered(client.redirectUris, redirectUri)) {
+        return errorRedirect(redirectUri, 'Invalid client or redirect_uri', state);
+    }
+    const normalizedRedirectUri = normalizeLoopbackRedirectUri(redirectUri);
+    const { authRequestId } = await ctx.store.savePendingAuthRequest({
+        clientId,
+        redirectUri: normalizedRedirectUri,
+        codeChallenge,
+        state,
+        resource,
+    });
+    const contentfulAuthorizeUrl = getContentfulAuthorizeUrl(authRequestId);
+    return Response.redirect(contentfulAuthorizeUrl, 302);
+}
+export async function handleOAuthRegisterPost(request, ctx) {
+    let body;
+    try {
+        body = (await request.json());
+    }
+    catch {
+        return Response.json({ error: 'invalid_request' }, { status: 400 });
+    }
+    const redirectUris = body.redirect_uris?.filter((uri) => typeof uri === 'string') ?? [];
+    if (redirectUris.length === 0) {
+        return Response.json({ error: 'redirect_uris required' }, { status: 400 });
+    }
+    const client = await ctx.store.registerOAuthClient({
+        redirectUris,
+        clientName: body.client_name,
+    });
+    return Response.json({
+        client_id: client.clientId,
+        client_id_issued_at: Math.floor(Date.now() / 1000),
+        redirect_uris: client.redirectUris,
+        client_name: client.clientName,
+        token_endpoint_auth_method: 'none',
+    });
+}
+export async function handleOAuthTokenPost(request, ctx) {
+    const contentType = request.headers.get('content-type') ?? '';
+    let params;
+    if (contentType.includes('application/json')) {
+        const body = (await request.json());
+        params = new URLSearchParams(body);
+    }
+    else {
+        const body = await request.text();
+        params = new URLSearchParams(body);
+    }
+    const grantType = params.get('grant_type');
+    if (grantType === 'authorization_code') {
+        const code = params.get('code');
+        const redirectUri = params.get('redirect_uri');
+        const clientId = params.get('client_id');
+        const codeVerifier = params.get('code_verifier');
+        if (!code || !redirectUri || !clientId || !codeVerifier) {
+            recordOAuthTelemetryFailure('authorization-code', 'invalid_request');
+            await flushTelemetry();
+            return Response.json({ error: 'invalid_request' }, { status: 400 });
+        }
+        try {
+            const token = await completeAuthorizationCodeGrant(ctx.store, {
+                code,
+                redirectUri,
+                clientId,
+                codeVerifier,
+                spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
+            });
+            recordOAuthTelemetrySuccess('authorization-code');
+            await flushTelemetry();
+            return Response.json({
+                access_token: token.accessToken,
+                token_type: token.tokenType,
+                expires_in: token.expiresIn,
+                refresh_token: token.refreshToken,
+                refresh_token_expires_in: CONTENTFUL_TOKEN_TTL_SECONDS,
+            });
+        }
+        catch (error) {
+            const response = oauthTokenGrantFailureResponse(error, 'authorization-code');
+            await flushTelemetry();
+            return response;
+        }
+    }
+    if (grantType === 'refresh_token') {
+        const refreshToken = params.get('refresh_token');
+        const clientId = params.get('client_id') ?? undefined;
+        const resource = params.get('resource') ?? undefined;
+        if (!refreshToken) {
+            recordOAuthTelemetryFailure('refresh-token', 'invalid_request');
+            await flushTelemetry();
+            return Response.json({ error: 'invalid_request' }, { status: 400 });
+        }
+        try {
+            const token = await completeRefreshTokenGrant(ctx.store, {
+                refreshToken,
+                clientId,
+                resource,
+                spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
+            });
+            oauthLogVerbose('refresh-token ok');
+            recordOAuthTelemetrySuccess('refresh-token');
+            await flushTelemetry();
+            return Response.json({
+                access_token: token.accessToken,
+                token_type: token.tokenType,
+                expires_in: token.expiresIn,
+                refresh_token: token.refreshToken,
+                refresh_token_expires_in: CONTENTFUL_TOKEN_TTL_SECONDS,
+            });
+        }
+        catch (error) {
+            const response = oauthTokenGrantFailureResponse(error, 'refresh-token');
+            await flushTelemetry();
+            return response;
+        }
+    }
+    recordOAuthTelemetryFailure('token', 'unsupported_grant_type');
+    await flushTelemetry();
+    return Response.json({ error: 'unsupported_grant_type' }, { status: 400 });
+}
+export async function handleLinkContentfulPost(request, ctx) {
+    let body;
+    try {
+        body = (await request.json());
+    }
+    catch {
+        return Response.json({ error: 'invalid_request' }, { status: 400 });
+    }
+    const contentfulToken = body.contentfulToken?.trim();
+    const authRequestId = body.authRequestId?.trim();
+    if (!contentfulToken || !authRequestId) {
+        return Response.json({ error: 'contentfulToken and authRequestId are required' }, { status: 400 });
+    }
+    try {
+        const user = await validatePatForDeployment(contentfulToken, ctx.deployment);
+        await ctx.store.storeContentfulToken(user.userId, user.token, ctx.deployment.spaceId, {
+            userId: user.userId,
+            email: user.email,
+        });
+        oauthLogVerbose('link-contentful ok', {
+            userId: user.userId,
+            email: user.email,
+            spaceId: ctx.deployment.spaceId,
+            projectKey: ctx.deployment.projectKey,
+        });
+        const origin = getPublicOrigin();
+        const resumeUrl = new URL(`${origin}/oauth/authorize`);
+        resumeUrl.searchParams.set('resume', authRequestId);
+        resumeUrl.searchParams.set('sub', user.userId);
+        return Response.json({ redirectUrl: resumeUrl.toString(), userId: user.userId });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const reason = patValidationFailureReason(message);
+        oauthLogAuthFailure('link-contentful', reason, {
+            spaceId: ctx.deployment.spaceId,
+            projectKey: ctx.deployment.projectKey,
+            message,
+        });
+        recordOAuthTelemetryFailure('link-contentful', reason);
+        await flushTelemetry();
+        return Response.json({ error: message }, { status: 401 });
+    }
+}
+export function handleOAuthAuthorizationServerMetadataGet() {
+    const origin = getPublicOrigin();
+    return Response.json({
+        issuer: origin,
+        authorization_endpoint: `${origin}/oauth/authorize`,
+        token_endpoint: `${origin}/oauth/token`,
+        registration_endpoint: `${origin}/oauth/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+    });
+}
+export function handleOAuthProtectedResourceMetadataGet() {
+    const origin = getPublicOrigin();
+    return Response.json({
+        resource: getMcpResourceUrl(),
+        authorization_servers: [origin],
+    });
+}
+export async function handleOAuthHealthCheck() {
+    try {
+        getPublicOrigin();
+        if (!process.env['MCP_OAUTH_JWT_SECRET']?.trim()) {
+            return { ok: false, detail: 'Missing MCP_OAUTH_JWT_SECRET' };
+        }
+        if (!process.env['CONTENTFUL_OAUTH_CLIENT_ID']?.trim()) {
+            return { ok: false, detail: 'Missing CONTENTFUL_OAUTH_CLIENT_ID' };
+        }
+        return { ok: true, detail: 'OAuth configuration present' };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+//# sourceMappingURL=handlers.js.map