@se-studio/contentful-cms 3.5.1 → 3.5.3

package/dist/hosted/oauth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAQhD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAA+B,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;IAC9F,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAA+B,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}

package/dist/hosted/oauth/cached-cma.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthStore } from './store.js';
+export declare const CONTENTFUL_SESSION_EXPIRED = "Contentful session expired. Sign in with Contentful again.";
+export declare class CachedContentfulTokenError extends Error {
+    readonly reason: 'missing_contentful_token' | 'invalid_contentful_token';
+    constructor(reason: 'missing_contentful_token' | 'invalid_contentful_token', message: string);
+}
+export declare function isCachedContentfulTokenError(error: unknown): error is CachedContentfulTokenError;
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export declare function loadAndValidateContentfulToken(store: OAuthStore, sub: string, spaceId: string | undefined, validateContentfulToken?: (token: string) => Promise<void>): Promise<string>;
+//# sourceMappingURL=cached-cma.d.ts.map

package/dist/hosted/oauth/cached-cma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAE/D,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,CAAC;gBAE7D,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEhG;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzD,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/hosted/oauth/cached-cma.js

@@ -0,0 +1,41 @@
+import { isUnusableContentfulCacheReason, patValidationFailureReason } from './log.js';
+export const CONTENTFUL_SESSION_EXPIRED = 'Contentful session expired. Sign in with Contentful again.';
+export class CachedContentfulTokenError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'CachedContentfulTokenError';
+        this.reason = reason;
+    }
+}
+export function isCachedContentfulTokenError(error) {
+    return error instanceof CachedContentfulTokenError;
+}
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export async function loadAndValidateContentfulToken(store, sub, spaceId, validateContentfulToken) {
+    const token = await store.getContentfulToken(sub, spaceId);
+    if (!token) {
+        throw new CachedContentfulTokenError('missing_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+    }
+    if (validateContentfulToken) {
+        try {
+            await validateContentfulToken(token);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const reason = patValidationFailureReason(message);
+            if (isUnusableContentfulCacheReason(reason)) {
+                await store.deleteContentfulToken(sub, spaceId);
+                throw new CachedContentfulTokenError('invalid_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+            }
+            throw error;
+        }
+    }
+    await store.touchContentfulToken(sub, spaceId);
+    return token;
+}
+//# sourceMappingURL=cached-cma.js.map

package/dist/hosted/oauth/cached-cma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGvF,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAE/D,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,MAAM,CAA0D;IAEzE,YAAY,MAA+D,EAAE,OAAe;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,KAAK,YAAY,0BAA0B,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,GAAW,EACX,OAA2B,EAC3B,uBAA0D;IAE1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,uBAAuB,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hosted/oauth/complete.d.ts

@@ -6,6 +6,7 @@ export declare function completeAuthorizationCodeGrant(store: OAuthStore, input:
     clientId: string;
     codeVerifier: string;
     spaceId?: string;
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/complete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA4CD"}
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAmDD"}

package/dist/hosted/oauth/complete.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 import { generateAuthCode } from './pkce.js';
 import { redirectUrisEquivalent } from './redirect-uri.js';
@@ -13,7 +14,7 @@ export async function issueAuthorizationRedirect(store, authRequestId, sub, requ
     return redirect.toString();
 }
 export async function completeAuthorizationCodeGrant(store, input) {
-    const codeRecord = await store.consumeAuthCode(input.code);
+    const codeRecord = await store.peekAuthCode(input.code);
     if (!codeRecord) {
         throw new Error('Invalid or expired authorization code.');
     }
@@ -32,9 +33,10 @@ export async function completeAuthorizationCodeGrant(store, input) {
     if (digest !== authRequest.codeChallenge) {
         throw new Error('Invalid code_verifier.');
     }
-    const contentfulToken = await store.getContentfulToken(codeRecord.sub, input.spaceId);
-    if (!contentfulToken) {
-        throw new Error('Contentful session expired. Sign in with Contentful again.');
+    await loadAndValidateContentfulToken(store, codeRecord.sub, input.spaceId, input.validateContentfulToken);
+    const consumed = await store.consumeAuthCode(input.code);
+    if (!consumed) {
+        throw new Error('Invalid or expired authorization code.');
     }
     const { accessToken, expiresIn } = await signMcpAccessToken(codeRecord.sub, authRequest.resource);
     const refreshToken = randomUUID();

package/dist/hosted/oauth/complete.js.map

@@ -1 +1 @@
-{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAMC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAgB/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAW/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}

package/dist/hosted/oauth/handlers.js

@@ -2,9 +2,10 @@ import { validatePatForDeployment } from '../../config/hosted.js';
 import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
 import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
 import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
-import { authorizationCodeGrantFailureReason, oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason, } from './log.js';
+import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
 import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
-import { completeRefreshTokenGrant, isRefreshTokenGrantError } from './refresh.js';
+import { completeRefreshTokenGrant } from './refresh.js';
+import { oauthTokenGrantFailureResponse } from './token-grant-response.js';
 function errorRedirect(redirectUri, message, state) {
     if (!redirectUri) {
         return new Response(message, { status: 400 });
@@ -115,6 +116,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 codeVerifier,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             recordOAuthTelemetrySuccess('authorization-code');
             await flushTelemetry();
@@ -126,12 +130,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const reason = authorizationCodeGrantFailureReason(message);
-            oauthLogAuthFailure('authorization-code', reason);
-            recordOAuthTelemetryFailure('authorization-code', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'authorization-code');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     if (grantType === 'refresh_token') {
@@ -149,6 +150,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 resource,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             oauthLogVerbose('refresh-token ok');
             recordOAuthTelemetrySuccess('refresh-token');
@@ -161,12 +165,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const reason = isRefreshTokenGrantError(error) ? error.reason : 'refresh_token_grant_failed';
-            const message = error instanceof Error ? error.message : String(error);
-            oauthLogAuthFailure('refresh-token', reason);
-            recordOAuthTelemetryFailure('refresh-token', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'refresh-token');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     recordOAuthTelemetryFailure('token', 'unsupported_grant_type');

package/dist/hosted/oauth/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,eAAe,EACf,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AASnF,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC5D,mBAAmB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAClD,2BAA2B,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAC7F,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,mBAAmB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC7C,2BAA2B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtF,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAQ3E,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAC7E,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtF,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/log.d.ts

@@ -6,5 +6,7 @@ export declare function oauthLogMcpHandlerError(message: string, details?: Recor
 /** Always emitted for auth failures — visible in Vercel runtime logs. */
 export declare function oauthLogAuthFailure(route: string, reason: string, details?: Record<string, unknown>): void;
 export declare function authorizationCodeGrantFailureReason(message: string): string;
+export declare function isUnusableContentfulCacheReason(reason: string): boolean;
+export declare function isTransientContentfulFailure(reason: string): boolean;
 export declare function patValidationFailureReason(message: string): string;
 //# sourceMappingURL=log.d.ts.map

package/dist/hosted/oauth/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}

package/dist/hosted/oauth/log.js

@@ -40,6 +40,16 @@ export function authorizationCodeGrantFailureReason(message) {
     }
     return 'invalid_grant';
 }
+export function isUnusableContentfulCacheReason(reason) {
+    return (reason === 'invalid_contentful_token' ||
+        reason === 'space_access_denied' ||
+        reason === 'missing_contentful_token');
+}
+export function isTransientContentfulFailure(reason) {
+    return (reason === 'contentful_api_error' ||
+        reason === 'space_check_failed' ||
+        reason === 'pat_validation_failed');
+}
 export function patValidationFailureReason(message) {
     if (message.includes('does not have access to the configured Contentful space')) {
         return 'space_access_denied';

package/dist/hosted/oauth/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,OAAO,CACL,MAAM,KAAK,0BAA0B;QACrC,MAAM,KAAK,qBAAqB;QAChC,MAAM,KAAK,0BAA0B,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CACL,MAAM,KAAK,sBAAsB;QACjC,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/hosted/oauth/refresh.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthStore } from './store.js';
-export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token';
+export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token' | 'invalid_contentful_token';
 export declare class RefreshTokenGrantError extends Error {
     readonly reason: RefreshTokenGrantFailureReason;
     constructor(reason: RefreshTokenGrantFailureReason, message?: string);
@@ -11,6 +11,8 @@ export declare function completeRefreshTokenGrant(store: OAuthStore, input: {
     resource?: string;
     /** Host Contentful space — refresh must not mint a JWT if the CMA cache is gone. */
     spaceId?: string;
+    /** When set, refuse refresh if Contentful rejects the cached CMA token. */
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAoCD"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA0CD"}

package/dist/hosted/oauth/refresh.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { isCachedContentfulTokenError, loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 export class RefreshTokenGrantError extends Error {
     reason;
@@ -22,10 +23,15 @@ export async function completeRefreshTokenGrant(store, input) {
     if (input.resource && input.resource !== record.resource) {
         throw new RefreshTokenGrantError('refresh_resource_mismatch', 'Invalid resource.');
     }
-    const contentfulToken = await store.getContentfulToken(record.sub, input.spaceId);
-    if (!contentfulToken) {
-        await store.revokeRefreshToken(input.refreshToken);
-        throw new RefreshTokenGrantError('missing_contentful_token', 'Contentful session expired. Sign in with Contentful again.');
+    try {
+        await loadAndValidateContentfulToken(store, record.sub, input.spaceId, input.validateContentfulToken);
+    }
+    catch (error) {
+        if (isCachedContentfulTokenError(error)) {
+            await store.revokeRefreshToken(input.refreshToken);
+            throw new RefreshTokenGrantError(error.reason, error.message);
+        }
+        throw error;
     }
     await store.revokeRefreshToken(input.refreshToken);
     const newRefreshToken = randomUUID();

package/dist/hosted/oauth/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAS9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAMC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,EAC1B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAU9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAQC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,8BAA8B,CAClC,KAAK,EACL,MAAM,CAAC,GAAG,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/store.d.ts

@@ -48,9 +48,13 @@ export interface OAuthStore {
     }>;
     getPendingAuthRequest(authRequestId: string): Promise<PendingAuthRequest | null>;
     saveAuthCode(code: string, record: AuthCodeRecord): Promise<void>;
+    peekAuthCode(code: string): Promise<AuthCodeRecord | null>;
     consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
     storeContentfulToken(sub: string, token: string, spaceId?: string): Promise<void>;
     getContentfulToken(sub: string, spaceId?: string): Promise<string | null>;
+    /** Slide CMA TTL only after Contentful accepted the token. */
+    touchContentfulToken(sub: string, spaceId?: string): Promise<void>;
+    deleteContentfulToken(sub: string, spaceId?: string): Promise<void>;
     saveRefreshToken(token: string, record: RefreshTokenRecord): Promise<void>;
     getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
     revokeRefreshToken(token: string): Promise<void>;

package/dist/hosted/oauth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CA6G/D"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAcD,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,8DAA8D;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAiI/D"}

package/dist/hosted/oauth/store.js

@@ -31,6 +31,17 @@ export function resolveOAuthSpaceId(explicit) {
 export function refreshTokenKey(token) {
     return `cms-edit:oauth:refresh:${token}`;
 }
+function authCodeKey(code) {
+    return `cms-edit:oauth:code:${code}`;
+}
+function parseAuthCodeRecord(raw) {
+    if (!raw)
+        return null;
+    if (typeof raw === 'string') {
+        return JSON.parse(raw);
+    }
+    return raw;
+}
 export function createOAuthStore(redis) {
     return {
         async registerOAuthClient(input) {
@@ -69,20 +80,20 @@ export function createOAuthStore(redis) {
             return raw;
         },
         async saveAuthCode(code, record) {
-            await redis.set(`cms-edit:oauth:code:${code}`, JSON.stringify(record), {
+            await redis.set(authCodeKey(code), JSON.stringify(record), {
                 ex: AUTH_CODE_TTL_SECONDS,
             });
         },
+        async peekAuthCode(code) {
+            return parseAuthCodeRecord(await redis.get(authCodeKey(code)));
+        },
         async consumeAuthCode(code) {
-            const key = `cms-edit:oauth:code:${code}`;
+            const key = authCodeKey(code);
             const raw = await redis.get(key);
             if (!raw)
                 return null;
             await redis.del(key);
-            if (typeof raw === 'string') {
-                return JSON.parse(raw);
-            }
-            return raw;
+            return parseAuthCodeRecord(raw);
         },
         async storeContentfulToken(sub, token, spaceId) {
             const resolved = resolveOAuthSpaceId(spaceId);
@@ -100,8 +111,6 @@ export function createOAuthStore(redis) {
             const key = contentfulTokenKey(sub, resolved);
             const token = await redis.get(key);
             if (typeof token === 'string' && token.length > 0) {
-                // Sliding TTL: active MCP use keeps the Contentful link alive across deploys.
-                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
                 return token;
             }
             // Soft cutover: pre-3.4.5 unscoped tokens (same Redis / shared cmsedit-sessions).
@@ -113,6 +122,25 @@ export function createOAuthStore(redis) {
             }
             return null;
         },
+        async touchContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            if (!resolved) {
+                return;
+            }
+            const key = contentfulTokenKey(sub, resolved);
+            const token = await redis.get(key);
+            if (typeof token === 'string' && token.length > 0) {
+                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
+            }
+        },
+        async deleteContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            const keys = [legacyContentfulTokenKey(sub)];
+            if (resolved) {
+                keys.unshift(contentfulTokenKey(sub, resolved));
+            }
+            await Promise.all(keys.map((key) => redis.del(key)));
+        },
         async saveRefreshToken(token, record) {
             await redis.set(refreshTokenKey(token), JSON.stringify(record), {
                 ex: REFRESH_TOKEN_TTL_SECONDS,

package/dist/hosted/oauth/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AA2B/D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAe;IAC7D,OAAO,uBAAuB,GAAG,IAAI,OAAO,mBAAmB,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,uBAAuB,GAAG,mBAAmB,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,0BAA0B,KAAK,EAAE,CAAC;AAC3C,CAAC;AAmBD,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAA4B;gBACtC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YACpD,CAAC;YACD,OAAO,GAA8B,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,OAAO;YAClC,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBAClF,EAAE,EAAE,wBAAwB;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,aAAa;YACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACrE,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,GAAG,GAAG,uBAAuB,IAAI,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;YAC3C,CAAC;YACD,OAAO,GAAqB,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO;YACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,8EAA8E;gBAC9E,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;gBACtD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kFAAkF;YAClF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC9D,EAAE,EAAE,yBAAyB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AA2B/D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAe;IAC7D,OAAO,uBAAuB,GAAG,IAAI,OAAO,mBAAmB,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,uBAAuB,GAAG,mBAAmB,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,0BAA0B,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,uBAAuB,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IACD,OAAO,GAAqB,CAAC;AAC/B,CAAC;AAuBD,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAA4B;gBACtC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YACpD,CAAC;YACD,OAAO,GAA8B,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,OAAO;YAClC,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBAClF,EAAE,EAAE,wBAAwB;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,aAAa;YACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACzD,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,OAAO,mBAAmB,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO;YACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kFAAkF;YAClF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO;YACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO;YACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC9D,EAAE,EAAE,yBAAyB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/token-grant-response.d.ts

@@ -0,0 +1,7 @@
+export type TokenGrantRoute = 'authorization-code' | 'refresh-token';
+/**
+ * Map token-endpoint failures: invalid CMA / grant errors → 400 invalid_grant;
+ * Contentful 5xx / unclassified PAT errors → 503 so clients retry.
+ */
+export declare function oauthTokenGrantFailureResponse(error: unknown, route: TokenGrantRoute): Response;
+//# sourceMappingURL=token-grant-response.d.ts.map

package/dist/hosted/oauth/token-grant-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-grant-response.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/token-grant-response.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAErE;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,QAAQ,CAgC/F"}

package/dist/hosted/oauth/token-grant-response.js

@@ -0,0 +1,34 @@
+import { recordOAuthTelemetryFailure } from '../../telemetry/index.js';
+import { isCachedContentfulTokenError } from './cached-cma.js';
+import { authorizationCodeGrantFailureReason, isTransientContentfulFailure, oauthLogAuthFailure, patValidationFailureReason, } from './log.js';
+import { isRefreshTokenGrantError } from './refresh.js';
+/**
+ * Map token-endpoint failures: invalid CMA / grant errors → 400 invalid_grant;
+ * Contentful 5xx / unclassified PAT errors → 503 so clients retry.
+ */
+export function oauthTokenGrantFailureResponse(error, route) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (isCachedContentfulTokenError(error)) {
+        oauthLogAuthFailure(route, error.reason);
+        recordOAuthTelemetryFailure(route, error.reason);
+        return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+    }
+    if (isRefreshTokenGrantError(error)) {
+        oauthLogAuthFailure(route, error.reason);
+        recordOAuthTelemetryFailure(route, error.reason);
+        return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+    }
+    const patReason = patValidationFailureReason(message);
+    if (isTransientContentfulFailure(patReason)) {
+        oauthLogAuthFailure(route, patReason);
+        recordOAuthTelemetryFailure(route, patReason);
+        return Response.json({ error: 'temporarily_unavailable', error_description: message }, { status: 503 });
+    }
+    const reason = route === 'authorization-code'
+        ? authorizationCodeGrantFailureReason(message)
+        : 'refresh_token_grant_failed';
+    oauthLogAuthFailure(route, reason);
+    recordOAuthTelemetryFailure(route, reason);
+    return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+}
+//# sourceMappingURL=token-grant-response.js.map

package/dist/hosted/oauth/token-grant-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-grant-response.js","sourceRoot":"","sources":["../../../src/hosted/oauth/token-grant-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIxD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc,EAAE,KAAsB;IACnF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtC,2BAA2B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,KAAK,KAAK,oBAAoB;QAC5B,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,4BAA4B,CAAC;IACnC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAChG,CAAC"}

package/dist/preview/entry-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entry-urls.d.ts","sourceRoot":"","sources":["../../src/preview/entry-urls.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWlE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAIrF;AAWD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAyCjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,EAAE,CA4DjF;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,qBAAqB,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmC7B"}
+{"version":3,"file":"entry-urls.d.ts","sourceRoot":"","sources":["../../src/preview/entry-urls.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,YAAY,GACZ,iBAAiB,GACjB,iBAAiB,GACjB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAWlE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAIrF;AAWD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,sBAAsB,CAAC,CAyCjC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,EAAE,CA4DjF;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,qBAAqB,GAAG;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmC7B"}

package/dist/preview/entry-urls.js

@@ -1,3 +1,4 @@
+import { cmaFetchHeaders } from '../contentful/cma-user-agent.js';
 import { appendRequestParams } from './capture-urls.js';
 /** Preferred order when presenting URLs to editors (publish-first). */
 const PREVIEW_URL_ORDER = [
@@ -33,7 +34,7 @@ export async function fetchContentfulLivePreviewUrl(spaceId, environment, entryI
     const endpoint = `https://api.contentful.com/spaces/${spaceId}/environments/${environment}/entries/${entryId}/preview`;
     try {
         const res = await fetch(endpoint, {
-            headers: { Authorization: `Bearer ${managementToken}` },
+            headers: cmaFetchHeaders(managementToken),
         });
         if (!res.ok) {
             let bodyHint = '';