@se-studio/contentful-cms 3.5.2 → 3.5.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @se-studio/contentful-cms Changelog
 
+## 3.5.3
+
+### Patch Changes
+
+- Treat a present-but-invalid Contentful CMA cache like a missing cache on hosted MCP: delete the Redis token, refuse refresh and authorization-code grants, and return `WWW-Authenticate: error="invalid_token"` so Grok re-runs Contentful sign-in instead of looping on `auth required`. Contentful 5xx on token/MCP validation returns 503 (does not burn the auth code); authorization-code telemetry logs the typed CMA reason.
+
 ## 3.5.2
 
 ### Patch Changes

package/HOSTED.md

@@ -124,7 +124,7 @@ If you connect more than one hosted cms-edit site (Brightline, SE Studio, Pedest
 
 | Problem | What to do |
 |---------|------------|
-| **Connection stopped working** | Open Settings → Integrations and click **Connect** again — complete Contentful sign-in, not only the MCP token refresh. In Grok, `/mcps` → `i`. If the browser flashes and tools still fail, delete that connector from `~/.grok/mcp_credentials.json` and press `i` again. |
+| **Connection stopped working** | Open Settings → Integrations and click **Connect** again — complete Contentful sign-in, not only the MCP token refresh. In Grok, `/mcps` → `i`. Hosts on cms-edit **3.5.3+** drop a cached CMA token that Contentful rejects (`invalid_token`) so Grok should re-run Contentful sign-in without a manual wipe. If the browser flashes and tools still fail, delete that connector from `~/.grok/mcp_credentials.json` and press `i` again. |
 | **Wrong site / agent probes all connectors** | Use site name in your request; check `cms_edit_version` → `projectKey`. Disable unused cms-edit connectors. Start a new conversation after connector updates. |
 | **No cms_edit tool in Claude** | Confirm the integration is connected under Settings → Integrations. |
 | **No active session** (after `open` worked) | Do not pass `--space`. MCP uses session `_mcp` automatically. Run `["diagnose"]` to inspect state. |

package/dist/contentful/cma-user-agent.d.ts

@@ -1,5 +1,5 @@
 /** SDK `application` value. Becomes `app cms-edit/<version>` in X-Contentful-User-Agent. */
-export declare const CMA_APPLICATION = "cms-edit/3.5.2";
+export declare const CMA_APPLICATION = "cms-edit/3.5.3";
 export declare function cmaClientOptions(accessToken: string): {
     accessToken: string;
     application: string;

package/dist/generated/hosted-guide.d.ts

@@ -1,2 +1,2 @@
-export declare const HOSTED_GUIDE_TEMPLATE = "# cms-edit MCP guide\n\nUse this guide when editing Contentful draft content through a hosted MCP connector (Claude Desktop Integrations + OAuth, or Grok Build).\n\n{{SITE_INTRO}}\n\n## Safety rules\n\ncms-edit **cannot and will not**:\n\n- Publish or unpublish entries\n- Archive or delete published entries\n\nAll `save` operations create **drafts only**. A human must review and publish in Contentful.\n\n**Assets:** cms-edit **can upload** draft assets via **staged upload** (hosted) or `--url` (public HTTPS last resort). **`--base64` is not supported on hosted MCP.** Always **search and reuse existing assets first** (`index sync`, then `asset search` or `list --type media`). Use `--if-exists-by-filename` when uploading to avoid duplicates.\n\n## MCP tools\n\n| Tool | Purpose |\n|------|---------|\n| `cms_edit` | Run any cms-edit command via an `args` array |\n| `cms_edit_request_staged_upload` | Get a presigned upload URL for binary files (then `curl` + `asset upload --staged`) |\n| `cms_edit_version` | Check the installed cms-edit version (no session required) |\n| `cms_edit_help` | Read this guide by topic (`overview`, `workflow`, `commands`, `troubleshooting`, `hosted`) |\n\n## Customer editor pack (read first)\n\nWhen a site editor pack is deployed, these MCP resources provide **site-specific** context. Read them before creating or editing content:\n\n| Resource | Purpose |\n|----------|---------|\n| `cms-edit://customer/index` | List of all customer resources |\n| `cms-edit://customer/tasks-index` | Intent \u2192 task playbook map (filtered for this site) |\n| `cms-edit://customer/capabilities` | Machine-readable list of what this site supports |\n| `cms-edit://customer/checklist` | First-session onboarding steps |\n| `cms-edit://customer/overview` | Site name, space, staging URL, handoff rules |\n| `cms-edit://customer/routing` | Article/tag URL rules for this site |\n| `cms-edit://customer/production-site` | Production URL and how to fetch page markdown (do not guess `.md` URLs) |\n| `cms-edit://customer/components-index` | Component types and when to use each |\n| `cms-edit://customer/collections-index` | Collection types |\n| `cms-edit://customer/brand` | Brand voice and terminology (if configured) |\n| `cms-edit://customer/articles` | Article/publication playbook (if configured) |\n| `cms-edit://customer/defaults` | Featured image rules and article types (if configured) |\n| `cms-edit://customer/site-facts` | Optional canonical business facts (if configured) |\n| `cms-edit://customer/task-*` | Capability playbooks (e.g. `task-media-reuse-and-upload`) |\n\n**Workflow:** read `tasks-index` \u2192 `capabilities` \u2192 `checklist` \u2192 `overview` \u2192 `routing` \u2192 `production-site` \u2192 pick a `task-*` playbook for your goal \u2192 `components-index` \u2192 then use `cms_edit` commands.\n\n## MCP prompts\n\n| Prompt | Purpose |\n|--------|---------|\n| `cms_edit_verify` | Check version and connectivity |\n| `cms_edit_explore` | List site content and open a page |\n| `cms_edit_edit_page` | Edit a page through diff \u2192 save |\n| `cms_edit_edit_article` | Edit an article through diff \u2192 save |\n| `cms_edit_index_sync` | Build/refresh local index (assets, media, templates, taxonomy) |\n| `cms_edit_create_page` | Create a page with template selection |\n| `cms_edit_create_article` | Create an article (requires article type; featured image rules) |\n| `cms_edit_create_from_doc` | Create a page from a freeform document (infer \u2192 confirm \u2192 dry-run) |\n| `cms_edit_create_article_from_doc` | Create an article from a freeform document |\n| `cms_edit_taxonomy` | Import taxonomy entries (`create \u2026 --if-not-exists`) |\n| `cms_edit_bulk_seo` | Update SEO meta descriptions (read `task-seo-descriptions`) |\n| `cms_edit_bulk_find_replace` | Bulk find-replace in rich text across entries |\n| `cms_edit_bulk_article_tags` | Update tags on one or more articles |\n| `cms_edit_import_authors` | Create person/author entries from a list or sheet |\n| `cms_edit_media` | Find existing assets or upload new ones (reuse-first) |\n\nRead the full guide anytime via the `cms-edit://guide` resource or `cms_edit_help`.\n\n## End-to-end QA prompt\n\nFor release QA after cms-edit or editor-pack upgrades, use a **copy-paste Claude Desktop test script** (phases: connector \u2192 customer resources \u2192 discovery \u2192 session \u2192 schema \u2192 media \u2192 dry-run writes \u2192 negatives). See [e2e-test-prompt.md](./e2e-test-prompt.md) to author one per customer site. Example: Brightline `docs/cms-edit/MCP-E2E-TEST.md`.\n\n## Core workflow\n\nStandard editing flow: **open \u2192 snapshot \u2192 read \u2192 set/rtf \u2192 diff \u2192 save**\n\nEach step is a separate `cms_edit` call. Sessions persist in Redis between calls (hosted) or on disk (local). MCP auto-uses session `_mcp`.\n\n### 1. Open a page\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"open\", \"--page-slug\", \"/pricing\"]\n[\"open\", \"--id\", \"<entry-id>\"]\n```\n\n**Homepage (all SE Studio sites):** Contentful stores the marketing homepage slug as `index`. The live site URL is `/`. In cms-edit, `--page-slug /` and `--page-slug /index` are equivalent (both resolve to `index`). Read `cms-edit://customer/routing` for site-specific exceptions (e.g. Pedestal uses `home`).\n\n### 2. Snapshot \u2014 see the content tree\n\n```\n[\"snapshot\"]\n```\n\nOutput shows `@c0`, `@c1`, \u2026 refs for each component. Use these refs in `read`, `set`, and `rtf`.\n\n### 3. Read fields\n\n```\n[\"read\", \"@c1\"]\n[\"read\", \"@c1\", \"heading\"]\n```\n\n### 4. Edit fields\n\n```\n[\"set\", \"@c1\", \"heading\", \"New heading text\"]\n[\"rtf\", \"@c1\", \"body\", \"--content\", \"# Title\\n\\nParagraph text.\"]\n```\n\nFor rich text, prefer `--content` with inline markdown. Use `--base64` when special characters cause issues.\n\n### 5. Review and save\n\n```\n[\"diff\"]\n[\"save\"]\n```\n\nAlways run `diff` before `save`. To abandon changes: `[\"discard\"]`.\n\n## When to use Contentful UI\n\n| Task | Where |\n|------|-------|\n| Edit copy, add sections, create pages/articles | **Agent + cms-edit** (drafts) |\n| Upload new images and files | **Agent + cms-edit** (`asset upload`) \u2014 search/reuse first |\n| Publish approved drafts | **Contentful UI** |\n| Edit copy directly in Contentful | **Avoid** \u2014 use cms-edit instead |\n\ncms-edit saves **drafts only**. A colleague must **publish in Contentful** for changes to go live.\n\n## Asset upload (hosted MCP)\n\nHosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Use staged upload for all images and binary files.\n\n| Source | When | Example |\n|--------|------|---------|\n| **Staged upload** (required for binary) | All images and files on hosted MCP | See **Staged upload** below |\n| **`--url`** (last resort) | File already on public HTTPS fetchable by the host | `[\"asset\", \"upload\", \"--url\", \"https://\u2026/photo.png\", \"--mime\", \"image/png\", \"--file-name\", \"photo.png\"]` |\n\n**After upload:** note the returned asset `id`, attach to the entry (`asset set @root media <id>` for person portraits), then `diff` \u2192 `save`. Upload alone does not update entries.\n\n**PNG** when transparency matters.\n\nFull workflow: `cms-edit://customer/task-media-reuse-and-upload`.\n\n### Common pitfalls (agents)\n\n| Issue | Do this |\n|-------|---------|\n| Singular Media on a component (`visual`) | `set @cN visual <mediaId> --link` \u2014 **not** `add \u2026 --target visual` |\n| Shared Drive folder has extra files | Import with `sourceNames` or `onlyWithOverrides` after catalog |\n| Prepare says no media / empty folder | Share folder **Viewer** with `media-pipeline-reader@se-media-pipeline.iam.gserviceaccount.com`, then re-prepare once |\n| MCP tool times out ~180s | `read` / `diff` / re-`catalog` before retrying the same write \u2014 server may already have saved |\n| `preview urls` has no Live Preview URL | Use staging + classic entry editor; row includes `unavailableReason` when CMA preview fails |\n| Reuse-first import matches old fileNames | dry-run first; set `overrides[].fileName` for unique names when duplication is required |\n\n### Staged upload\n\nKeeps binary **out of MCP tool args**. The agent uploads via `curl`, then passes only a short `uploadId`.\n\n1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `byteLength`, optional `title`\n2. Run the returned `curlCommand` in a shell (POST multipart to `uploadUrl`)\n3. `cms_edit` with the returned `consumeArgs` (includes `asset upload --staged <uploadId>`)\n4. Link and save as usual\n\nHosted limit: **4 MB** per staged file (Vercel body limit). Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**, single-use.\n\n## Featured images (articles)\n\nRead `cms-edit://customer/defaults` when present. Otherwise:\n\n1. **Custom** \u2014 set `featuredImage` or `featuredImageAssetFilename` on the article when the editor provides a specific image\n2. **Article type** \u2014 if omitted, cms-edit inherits the linked **articleType** `featuredImage`\n3. **Site default** \u2014 from `editor.defaults` in the site config (also in `defaults.json` in the editor pack)\n\nRun `[\"index\", \"sync\"]` before resolving assets by filename.\n\n## Create content\n\n### Create a page\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"template\"]\n[\"create\", \"page\", \"--slug\", \"/about-us\", \"--title\", \"About Us\", \"--template-id\", \"<id>\"]\n[\"snapshot\"]\n```\n\nOr use `create from-json` with `--dry-run --strict` for multi-section pages.\n\n### Create an article\n\nEvery article requires an **articleType**:\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"articleType\"]\n[\"create\", \"article\", \"--slug\", \"resources/blog/my-post\", \"--title\", \"My Post\", \"--article-type-slug\", \"resources/blog\"]\n```\n\nOr `create from-json` with `\"type\": \"article\"` and `articleTypeSlug` / `articleTypeId`.\n\nUse MCP prompt `cms_edit_create_article` for guided creation.\n\n## Common sequences\n\n### List all pages\n\n```\n[\"list\", \"--type\", \"page\"]\n```\n\n### Refresh local index (assets, media, templates, taxonomy)\n\nRun before asset filename search, media-by-filename list, or fast template/taxonomy lookup:\n\n```\n[\"index\", \"sync\"]\n[\"index\", \"status\"]\n[\"list\", \"--type\", \"template\"]\n```\n\nAsset search and media-by-filename list **require** the index. Template/taxonomy list prefers the index when built.\n\n### Explore the homepage\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"snapshot\"]\n[\"read\", \"@c1\"]\n```\n\n### Edit copy on a page\n\n```\n[\"open\", \"--page-slug\", \"{{EXAMPLE_SLUG}}\"]\n[\"snapshot\"]\n[\"read\", \"@c1\", \"heading\"]\n[\"set\", \"@c1\", \"heading\", \"Updated heading\"]\n[\"diff\"]\n[\"save\"]\n```\n\n## Field discovery\n\n```\n[\"schema\", \"component\"]\n[\"list\", \"--type\", \"page\"]\n[\"search\", \"pricing\"]\n```\n\n## Grok Build setup\n\nGrok connects to the same hosted MCP URL as Claude. Add to `~/.grok/config.toml`:\n\n```toml\n[mcp_servers.cms-edit-brightline]\nurl = \"https://brightline.content.se.studio/api/mcp\"\nenabled = true\n```\n\nReplace the server name and host with your site's deployment. The URL **must** end with `/api/mcp` (not the site root).\n\n**Connect:**\n\n1. In Grok, run `/mcps` and select your cms-edit server\n2. Press **`i`** to initiate OAuth (not just enable the toggle)\n3. Sign in with Contentful when the browser opens\n4. Verify with `grok mcp doctor <server-name>` or call `cms_edit_version`\n\nOAuth is two steps: Grok obtains an MCP token, then you sign in with Contentful to link your account. If the browser flashes and closes immediately, reconnect after upgrading cms-edit (loopback redirect handling).\n\n## Hosted connector rules\n\n{{HOSTED_RULES}}\n\n## Session tips\n\n- After `open`, subsequent MCP commands share session `_mcp` automatically (stored in Redis on hosted).\n- Use `--session <name>` only when juggling multiple pages \u2014 pass it **before** the subcommand on every call: `[\"--session\", \"my-work\", \"open\", \"--page-slug\", \"/\"]`.\n- Snapshot JSON includes `sessionName` and `sessionKey` for debugging.\n- If you see \"No active session\", check `/api/health` (Redis must be ok), then run `open` again. Set `LOG_CMS_SESSION=1` on Vercel and search runtime logs for `[cms-edit:session]` (`redis save ok` / `redis load hit` / `requireSession miss`).\n\n### peek vs open vs read\n\n| Goal | MCP args |\n|------|----------|\n| Edit workflow (session) | `[\"open\", \"--page-slug\", \"/\"]` then `[\"read\", \"@c0\"]` |\n| Preview tree + fields, no session | `[\"peek\", \"--page-slug\", \"/pricing\"]` or `[\"peek\", \"--id\", \"<entry-id>\"]` (JSON includes `rootFields`) |\n| Read fields by entry ID, no session | `[\"read\", \"<entry-id>\", \"--id\"]` or `[\"read\", \"<entry-id>\", \"--id\", \"heading\"]` |\n| Debug session persistence | `[\"diagnose\"]` \u2014 reports store, userId, active session key |\n\n- **`peek` is one-shot** \u2014 prints tree and **root field values** (`rootFields` in JSON). No session is created; do not chain `read @ref` afterward.\n- **Use flat lookup flags** for `open` and `peek` \u2014 same as CLI (`--page-slug`, `--id`, etc.). See `help lookup`.\n- **`read @root`** only works after `open` (uses the active session). The hint in peek output is for terminal users who already ran `open`.\n- **Do not invent flags** \u2014 there is no `--read`, `--then`, or chained peek+read syntax. One command per `cms_edit` call.\n\n## Troubleshooting\n\n| Problem | What to do |\n|---------|------------|\n| **401 / connection failed** | Reconnect: Claude \u2192 Settings \u2192 Integrations, or Grok `/mcps` \u2192 press `i`. Complete Contentful sign-in. If Grok says \u201CFailed to get tools after auth\u201D, the MCP JWT refreshed but the Contentful cache was gone \u2014 delete that server\u2019s entry from `~/.grok/mcp_credentials.json` and press `i` again so the browser opens Contentful. On Vercel, search `[cms-edit:oauth] auth_failure` (`reason=missing_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |\n| **No cms_edit tool** | Confirm the integration is connected under Settings \u2192 Integrations |\n| **No active session** | Do not pass `--space` on hosted. Check `/api/health` \u2014 `redis` must be ok. MCP uses `_mcp` session automatically. Manual session: `[\"--session\", \"name\", \"open\", \"--page-slug\", \"/\"]`. Fallback: `[\"read\", \"<entry-id>\", \"--id\"]` |\n| **Wrong space** | Your Contentful account must have access to this deployment's space |\n| **Check version** | Call `cms_edit_version` or `curl /api/health` and read `cmsEdit` |\n\n## Articles\n\n**Recent articles** (by publication `date`, not last-updated):\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\", \"-n\", \"10\"]\n```\n\nAlternative: `[\"search\", \"<keyword>\", \"--type\", \"article\"]` (also sorts by date).\n\n**Draft articles** \u2014 `peek` and `open` load drafts via CMA (not published-only). To discover drafts:\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\"]\n[\"search\", \"<title>\", \"--type\", \"article\"]\n[\"list\", \"--type\", \"article\", \"--slug\", \"<slug>\"]\n```\n\nThen open: `[\"peek\", \"--article-slug\", \"<slug>\"]` or `[\"open\", \"--id\", \"<entry-id>\"]`. Use `--article-slug`, not `--page-slug`.\n\n**Published-only** is opt-in: `list --published` and `resolve --published` use the Delivery API index and omit never-published drafts.\n\nAfter upgrading cms-edit, run `[\"index\", \"sync\"]` once so the local index includes article `date` values (schema v4).\n\n**Index freshness on hosted MCP:** The catalog index is shared via Redis (gzipped SQLite blob). `index status` on a cold instance may show **not built** until `list`, `open`, or another index command runs \u2014 that is normal. Committed writes (`save`, `create page`, `asset upload`, \u2026) mark the index dirty; the next discovery command refreshes it. In-session `set` edits do not trigger a sync.\n\n## Command reference (cms_edit args)\n\n**Discovery:** `list --type <type>`, `search <query>`, `schema <contentType>`, `index sync`, `index status`\n\n**Reading:** `open --page-slug <slug>`, `open --id <id>`, `peek --page-slug <slug>`, `peek --id <id>`, `snapshot`, `read <ref>`, `read <ref> <field>`, `read <id> --id [field]`\n\n**Diagnostics:** `diagnose` \u2014 session store, userId, active session (after open/read issues)\n\n**Editing:** `set <ref> <field> <value>`, `rtf <ref> <field> --content \"<md>\"`, `diff`, `save`, `discard`\n\n**Creating:** `create page --slug \u2026 --title \u2026`, `create article --slug \u2026 --title \u2026 --article-type-slug \u2026`, `create from-json --file \u2026`, `add <type> --content-type \u2026 --parent @c0 --target content`\n\n**Other:** `health`, `version`, `guide [topic]`\n";
+export declare const HOSTED_GUIDE_TEMPLATE = "# cms-edit MCP guide\n\nUse this guide when editing Contentful draft content through a hosted MCP connector (Claude Desktop Integrations + OAuth, or Grok Build).\n\n{{SITE_INTRO}}\n\n## Safety rules\n\ncms-edit **cannot and will not**:\n\n- Publish or unpublish entries\n- Archive or delete published entries\n\nAll `save` operations create **drafts only**. A human must review and publish in Contentful.\n\n**Assets:** cms-edit **can upload** draft assets via **staged upload** (hosted) or `--url` (public HTTPS last resort). **`--base64` is not supported on hosted MCP.** Always **search and reuse existing assets first** (`index sync`, then `asset search` or `list --type media`). Use `--if-exists-by-filename` when uploading to avoid duplicates.\n\n## MCP tools\n\n| Tool | Purpose |\n|------|---------|\n| `cms_edit` | Run any cms-edit command via an `args` array |\n| `cms_edit_request_staged_upload` | Get a presigned upload URL for binary files (then `curl` + `asset upload --staged`) |\n| `cms_edit_version` | Check the installed cms-edit version (no session required) |\n| `cms_edit_help` | Read this guide by topic (`overview`, `workflow`, `commands`, `troubleshooting`, `hosted`) |\n\n## Customer editor pack (read first)\n\nWhen a site editor pack is deployed, these MCP resources provide **site-specific** context. Read them before creating or editing content:\n\n| Resource | Purpose |\n|----------|---------|\n| `cms-edit://customer/index` | List of all customer resources |\n| `cms-edit://customer/tasks-index` | Intent \u2192 task playbook map (filtered for this site) |\n| `cms-edit://customer/capabilities` | Machine-readable list of what this site supports |\n| `cms-edit://customer/checklist` | First-session onboarding steps |\n| `cms-edit://customer/overview` | Site name, space, staging URL, handoff rules |\n| `cms-edit://customer/routing` | Article/tag URL rules for this site |\n| `cms-edit://customer/production-site` | Production URL and how to fetch page markdown (do not guess `.md` URLs) |\n| `cms-edit://customer/components-index` | Component types and when to use each |\n| `cms-edit://customer/collections-index` | Collection types |\n| `cms-edit://customer/brand` | Brand voice and terminology (if configured) |\n| `cms-edit://customer/articles` | Article/publication playbook (if configured) |\n| `cms-edit://customer/defaults` | Featured image rules and article types (if configured) |\n| `cms-edit://customer/site-facts` | Optional canonical business facts (if configured) |\n| `cms-edit://customer/task-*` | Capability playbooks (e.g. `task-media-reuse-and-upload`) |\n\n**Workflow:** read `tasks-index` \u2192 `capabilities` \u2192 `checklist` \u2192 `overview` \u2192 `routing` \u2192 `production-site` \u2192 pick a `task-*` playbook for your goal \u2192 `components-index` \u2192 then use `cms_edit` commands.\n\n## MCP prompts\n\n| Prompt | Purpose |\n|--------|---------|\n| `cms_edit_verify` | Check version and connectivity |\n| `cms_edit_explore` | List site content and open a page |\n| `cms_edit_edit_page` | Edit a page through diff \u2192 save |\n| `cms_edit_edit_article` | Edit an article through diff \u2192 save |\n| `cms_edit_index_sync` | Build/refresh local index (assets, media, templates, taxonomy) |\n| `cms_edit_create_page` | Create a page with template selection |\n| `cms_edit_create_article` | Create an article (requires article type; featured image rules) |\n| `cms_edit_create_from_doc` | Create a page from a freeform document (infer \u2192 confirm \u2192 dry-run) |\n| `cms_edit_create_article_from_doc` | Create an article from a freeform document |\n| `cms_edit_taxonomy` | Import taxonomy entries (`create \u2026 --if-not-exists`) |\n| `cms_edit_bulk_seo` | Update SEO meta descriptions (read `task-seo-descriptions`) |\n| `cms_edit_bulk_find_replace` | Bulk find-replace in rich text across entries |\n| `cms_edit_bulk_article_tags` | Update tags on one or more articles |\n| `cms_edit_import_authors` | Create person/author entries from a list or sheet |\n| `cms_edit_media` | Find existing assets or upload new ones (reuse-first) |\n\nRead the full guide anytime via the `cms-edit://guide` resource or `cms_edit_help`.\n\n## End-to-end QA prompt\n\nFor release QA after cms-edit or editor-pack upgrades, use a **copy-paste Claude Desktop test script** (phases: connector \u2192 customer resources \u2192 discovery \u2192 session \u2192 schema \u2192 media \u2192 dry-run writes \u2192 negatives). See [e2e-test-prompt.md](./e2e-test-prompt.md) to author one per customer site. Example: Brightline `docs/cms-edit/MCP-E2E-TEST.md`.\n\n## Core workflow\n\nStandard editing flow: **open \u2192 snapshot \u2192 read \u2192 set/rtf \u2192 diff \u2192 save**\n\nEach step is a separate `cms_edit` call. Sessions persist in Redis between calls (hosted) or on disk (local). MCP auto-uses session `_mcp`.\n\n### 1. Open a page\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"open\", \"--page-slug\", \"/pricing\"]\n[\"open\", \"--id\", \"<entry-id>\"]\n```\n\n**Homepage (all SE Studio sites):** Contentful stores the marketing homepage slug as `index`. The live site URL is `/`. In cms-edit, `--page-slug /` and `--page-slug /index` are equivalent (both resolve to `index`). Read `cms-edit://customer/routing` for site-specific exceptions (e.g. Pedestal uses `home`).\n\n### 2. Snapshot \u2014 see the content tree\n\n```\n[\"snapshot\"]\n```\n\nOutput shows `@c0`, `@c1`, \u2026 refs for each component. Use these refs in `read`, `set`, and `rtf`.\n\n### 3. Read fields\n\n```\n[\"read\", \"@c1\"]\n[\"read\", \"@c1\", \"heading\"]\n```\n\n### 4. Edit fields\n\n```\n[\"set\", \"@c1\", \"heading\", \"New heading text\"]\n[\"rtf\", \"@c1\", \"body\", \"--content\", \"# Title\\n\\nParagraph text.\"]\n```\n\nFor rich text, prefer `--content` with inline markdown. Use `--base64` when special characters cause issues.\n\n### 5. Review and save\n\n```\n[\"diff\"]\n[\"save\"]\n```\n\nAlways run `diff` before `save`. To abandon changes: `[\"discard\"]`.\n\n## When to use Contentful UI\n\n| Task | Where |\n|------|-------|\n| Edit copy, add sections, create pages/articles | **Agent + cms-edit** (drafts) |\n| Upload new images and files | **Agent + cms-edit** (`asset upload`) \u2014 search/reuse first |\n| Publish approved drafts | **Contentful UI** |\n| Edit copy directly in Contentful | **Avoid** \u2014 use cms-edit instead |\n\ncms-edit saves **drafts only**. A colleague must **publish in Contentful** for changes to go live.\n\n## Asset upload (hosted MCP)\n\nHosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Use staged upload for all images and binary files.\n\n| Source | When | Example |\n|--------|------|---------|\n| **Staged upload** (required for binary) | All images and files on hosted MCP | See **Staged upload** below |\n| **`--url`** (last resort) | File already on public HTTPS fetchable by the host | `[\"asset\", \"upload\", \"--url\", \"https://\u2026/photo.png\", \"--mime\", \"image/png\", \"--file-name\", \"photo.png\"]` |\n\n**After upload:** note the returned asset `id`, attach to the entry (`asset set @root media <id>` for person portraits), then `diff` \u2192 `save`. Upload alone does not update entries.\n\n**PNG** when transparency matters.\n\nFull workflow: `cms-edit://customer/task-media-reuse-and-upload`.\n\n### Common pitfalls (agents)\n\n| Issue | Do this |\n|-------|---------|\n| Singular Media on a component (`visual`) | `set @cN visual <mediaId> --link` \u2014 **not** `add \u2026 --target visual` |\n| Shared Drive folder has extra files | Import with `sourceNames` or `onlyWithOverrides` after catalog |\n| Prepare says no media / empty folder | Share folder **Viewer** with `media-pipeline-reader@se-media-pipeline.iam.gserviceaccount.com`, then re-prepare once |\n| MCP tool times out ~180s | `read` / `diff` / re-`catalog` before retrying the same write \u2014 server may already have saved |\n| `preview urls` has no Live Preview URL | Use staging + classic entry editor; row includes `unavailableReason` when CMA preview fails |\n| Reuse-first import matches old fileNames | dry-run first; set `overrides[].fileName` for unique names when duplication is required |\n\n### Staged upload\n\nKeeps binary **out of MCP tool args**. The agent uploads via `curl`, then passes only a short `uploadId`.\n\n1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `byteLength`, optional `title`\n2. Run the returned `curlCommand` in a shell (POST multipart to `uploadUrl`)\n3. `cms_edit` with the returned `consumeArgs` (includes `asset upload --staged <uploadId>`)\n4. Link and save as usual\n\nHosted limit: **4 MB** per staged file (Vercel body limit). Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**, single-use.\n\n## Featured images (articles)\n\nRead `cms-edit://customer/defaults` when present. Otherwise:\n\n1. **Custom** \u2014 set `featuredImage` or `featuredImageAssetFilename` on the article when the editor provides a specific image\n2. **Article type** \u2014 if omitted, cms-edit inherits the linked **articleType** `featuredImage`\n3. **Site default** \u2014 from `editor.defaults` in the site config (also in `defaults.json` in the editor pack)\n\nRun `[\"index\", \"sync\"]` before resolving assets by filename.\n\n## Create content\n\n### Create a page\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"template\"]\n[\"create\", \"page\", \"--slug\", \"/about-us\", \"--title\", \"About Us\", \"--template-id\", \"<id>\"]\n[\"snapshot\"]\n```\n\nOr use `create from-json` with `--dry-run --strict` for multi-section pages.\n\n### Create an article\n\nEvery article requires an **articleType**:\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"articleType\"]\n[\"create\", \"article\", \"--slug\", \"resources/blog/my-post\", \"--title\", \"My Post\", \"--article-type-slug\", \"resources/blog\"]\n```\n\nOr `create from-json` with `\"type\": \"article\"` and `articleTypeSlug` / `articleTypeId`.\n\nUse MCP prompt `cms_edit_create_article` for guided creation.\n\n## Common sequences\n\n### List all pages\n\n```\n[\"list\", \"--type\", \"page\"]\n```\n\n### Refresh local index (assets, media, templates, taxonomy)\n\nRun before asset filename search, media-by-filename list, or fast template/taxonomy lookup:\n\n```\n[\"index\", \"sync\"]\n[\"index\", \"status\"]\n[\"list\", \"--type\", \"template\"]\n```\n\nAsset search and media-by-filename list **require** the index. Template/taxonomy list prefers the index when built.\n\n### Explore the homepage\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"snapshot\"]\n[\"read\", \"@c1\"]\n```\n\n### Edit copy on a page\n\n```\n[\"open\", \"--page-slug\", \"{{EXAMPLE_SLUG}}\"]\n[\"snapshot\"]\n[\"read\", \"@c1\", \"heading\"]\n[\"set\", \"@c1\", \"heading\", \"Updated heading\"]\n[\"diff\"]\n[\"save\"]\n```\n\n## Field discovery\n\n```\n[\"schema\", \"component\"]\n[\"list\", \"--type\", \"page\"]\n[\"search\", \"pricing\"]\n```\n\n## Grok Build setup\n\nGrok connects to the same hosted MCP URL as Claude. Add to `~/.grok/config.toml`:\n\n```toml\n[mcp_servers.cms-edit-brightline]\nurl = \"https://brightline.content.se.studio/api/mcp\"\nenabled = true\n```\n\nReplace the server name and host with your site's deployment. The URL **must** end with `/api/mcp` (not the site root).\n\n**Connect:**\n\n1. In Grok, run `/mcps` and select your cms-edit server\n2. Press **`i`** to initiate OAuth (not just enable the toggle)\n3. Sign in with Contentful when the browser opens\n4. Verify with `grok mcp doctor <server-name>` or call `cms_edit_version`\n\nOAuth is two steps: Grok obtains an MCP token, then you sign in with Contentful to link your account. If the browser flashes and closes immediately, reconnect after upgrading cms-edit (loopback redirect handling).\n\n## Hosted connector rules\n\n{{HOSTED_RULES}}\n\n## Session tips\n\n- After `open`, subsequent MCP commands share session `_mcp` automatically (stored in Redis on hosted).\n- Use `--session <name>` only when juggling multiple pages \u2014 pass it **before** the subcommand on every call: `[\"--session\", \"my-work\", \"open\", \"--page-slug\", \"/\"]`.\n- Snapshot JSON includes `sessionName` and `sessionKey` for debugging.\n- If you see \"No active session\", check `/api/health` (Redis must be ok), then run `open` again. Set `LOG_CMS_SESSION=1` on Vercel and search runtime logs for `[cms-edit:session]` (`redis save ok` / `redis load hit` / `requireSession miss`).\n\n### peek vs open vs read\n\n| Goal | MCP args |\n|------|----------|\n| Edit workflow (session) | `[\"open\", \"--page-slug\", \"/\"]` then `[\"read\", \"@c0\"]` |\n| Preview tree + fields, no session | `[\"peek\", \"--page-slug\", \"/pricing\"]` or `[\"peek\", \"--id\", \"<entry-id>\"]` (JSON includes `rootFields`) |\n| Read fields by entry ID, no session | `[\"read\", \"<entry-id>\", \"--id\"]` or `[\"read\", \"<entry-id>\", \"--id\", \"heading\"]` |\n| Debug session persistence | `[\"diagnose\"]` \u2014 reports store, userId, active session key |\n\n- **`peek` is one-shot** \u2014 prints tree and **root field values** (`rootFields` in JSON). No session is created; do not chain `read @ref` afterward.\n- **Use flat lookup flags** for `open` and `peek` \u2014 same as CLI (`--page-slug`, `--id`, etc.). See `help lookup`.\n- **`read @root`** only works after `open` (uses the active session). The hint in peek output is for terminal users who already ran `open`.\n- **Do not invent flags** \u2014 there is no `--read`, `--then`, or chained peek+read syntax. One command per `cms_edit` call.\n\n## Troubleshooting\n\n| Problem | What to do |\n|---------|------------|\n| **401 / connection failed** | Reconnect: Claude \u2192 Settings \u2192 Integrations, or Grok `/mcps` \u2192 press `i`. Complete Contentful sign-in. If Grok says \u201CFailed to get tools after auth\u201D or `auth required`, the MCP JWT refreshed but Contentful rejected (or never had) the CMA cache. cms-edit **3.5.3+** returns `invalid_token` and refuses refresh so Grok re-runs Contentful sign-in. If it still loops, delete that server\u2019s entry from `~/.grok/mcp_credentials.json` and press `i` again. On Vercel, search `[cms-edit:oauth] auth_failure` (`missing_contentful_token` or `invalid_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |\n| **No cms_edit tool** | Confirm the integration is connected under Settings \u2192 Integrations |\n| **No active session** | Do not pass `--space` on hosted. Check `/api/health` \u2014 `redis` must be ok. MCP uses `_mcp` session automatically. Manual session: `[\"--session\", \"name\", \"open\", \"--page-slug\", \"/\"]`. Fallback: `[\"read\", \"<entry-id>\", \"--id\"]` |\n| **Wrong space** | Your Contentful account must have access to this deployment's space |\n| **Check version** | Call `cms_edit_version` or `curl /api/health` and read `cmsEdit` |\n\n## Articles\n\n**Recent articles** (by publication `date`, not last-updated):\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\", \"-n\", \"10\"]\n```\n\nAlternative: `[\"search\", \"<keyword>\", \"--type\", \"article\"]` (also sorts by date).\n\n**Draft articles** \u2014 `peek` and `open` load drafts via CMA (not published-only). To discover drafts:\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\"]\n[\"search\", \"<title>\", \"--type\", \"article\"]\n[\"list\", \"--type\", \"article\", \"--slug\", \"<slug>\"]\n```\n\nThen open: `[\"peek\", \"--article-slug\", \"<slug>\"]` or `[\"open\", \"--id\", \"<entry-id>\"]`. Use `--article-slug`, not `--page-slug`.\n\n**Published-only** is opt-in: `list --published` and `resolve --published` use the Delivery API index and omit never-published drafts.\n\nAfter upgrading cms-edit, run `[\"index\", \"sync\"]` once so the local index includes article `date` values (schema v4).\n\n**Index freshness on hosted MCP:** The catalog index is shared via Redis (gzipped SQLite blob). `index status` on a cold instance may show **not built** until `list`, `open`, or another index command runs \u2014 that is normal. Committed writes (`save`, `create page`, `asset upload`, \u2026) mark the index dirty; the next discovery command refreshes it. In-session `set` edits do not trigger a sync.\n\n## Command reference (cms_edit args)\n\n**Discovery:** `list --type <type>`, `search <query>`, `schema <contentType>`, `index sync`, `index status`\n\n**Reading:** `open --page-slug <slug>`, `open --id <id>`, `peek --page-slug <slug>`, `peek --id <id>`, `snapshot`, `read <ref>`, `read <ref> <field>`, `read <id> --id [field]`\n\n**Diagnostics:** `diagnose` \u2014 session store, userId, active session (after open/read issues)\n\n**Editing:** `set <ref> <field> <value>`, `rtf <ref> <field> --content \"<md>\"`, `diff`, `save`, `discard`\n\n**Creating:** `create page --slug \u2026 --title \u2026`, `create article --slug \u2026 --title \u2026 --article-type-slug \u2026`, `create from-json --file \u2026`, `add <type> --content-type \u2026 --parent @c0 --target content`\n\n**Other:** `health`, `version`, `guide [topic]`\n";
 //# sourceMappingURL=hosted-guide.d.ts.map

package/dist/generated/hosted-guide.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-guide.d.ts","sourceRoot":"","sources":["../../src/generated/hosted-guide.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,qBAAqB,ymhBAA8ygB,CAAC"}
+{"version":3,"file":"hosted-guide.d.ts","sourceRoot":"","sources":["../../src/generated/hosted-guide.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,qBAAqB,uvhBAAi8gB,CAAC"}

package/dist/generated/hosted-guide.js

@@ -1,3 +1,3 @@
 // Generated by scripts/generate-embedded-assets.mjs — do not edit manually.
-export const HOSTED_GUIDE_TEMPLATE = "# cms-edit MCP guide\n\nUse this guide when editing Contentful draft content through a hosted MCP connector (Claude Desktop Integrations + OAuth, or Grok Build).\n\n{{SITE_INTRO}}\n\n## Safety rules\n\ncms-edit **cannot and will not**:\n\n- Publish or unpublish entries\n- Archive or delete published entries\n\nAll `save` operations create **drafts only**. A human must review and publish in Contentful.\n\n**Assets:** cms-edit **can upload** draft assets via **staged upload** (hosted) or `--url` (public HTTPS last resort). **`--base64` is not supported on hosted MCP.** Always **search and reuse existing assets first** (`index sync`, then `asset search` or `list --type media`). Use `--if-exists-by-filename` when uploading to avoid duplicates.\n\n## MCP tools\n\n| Tool | Purpose |\n|------|---------|\n| `cms_edit` | Run any cms-edit command via an `args` array |\n| `cms_edit_request_staged_upload` | Get a presigned upload URL for binary files (then `curl` + `asset upload --staged`) |\n| `cms_edit_version` | Check the installed cms-edit version (no session required) |\n| `cms_edit_help` | Read this guide by topic (`overview`, `workflow`, `commands`, `troubleshooting`, `hosted`) |\n\n## Customer editor pack (read first)\n\nWhen a site editor pack is deployed, these MCP resources provide **site-specific** context. Read them before creating or editing content:\n\n| Resource | Purpose |\n|----------|---------|\n| `cms-edit://customer/index` | List of all customer resources |\n| `cms-edit://customer/tasks-index` | Intent → task playbook map (filtered for this site) |\n| `cms-edit://customer/capabilities` | Machine-readable list of what this site supports |\n| `cms-edit://customer/checklist` | First-session onboarding steps |\n| `cms-edit://customer/overview` | Site name, space, staging URL, handoff rules |\n| `cms-edit://customer/routing` | Article/tag URL rules for this site |\n| `cms-edit://customer/production-site` | Production URL and how to fetch page markdown (do not guess `.md` URLs) |\n| `cms-edit://customer/components-index` | Component types and when to use each |\n| `cms-edit://customer/collections-index` | Collection types |\n| `cms-edit://customer/brand` | Brand voice and terminology (if configured) |\n| `cms-edit://customer/articles` | Article/publication playbook (if configured) |\n| `cms-edit://customer/defaults` | Featured image rules and article types (if configured) |\n| `cms-edit://customer/site-facts` | Optional canonical business facts (if configured) |\n| `cms-edit://customer/task-*` | Capability playbooks (e.g. `task-media-reuse-and-upload`) |\n\n**Workflow:** read `tasks-index` → `capabilities` → `checklist` → `overview` → `routing` → `production-site` → pick a `task-*` playbook for your goal → `components-index` → then use `cms_edit` commands.\n\n## MCP prompts\n\n| Prompt | Purpose |\n|--------|---------|\n| `cms_edit_verify` | Check version and connectivity |\n| `cms_edit_explore` | List site content and open a page |\n| `cms_edit_edit_page` | Edit a page through diff → save |\n| `cms_edit_edit_article` | Edit an article through diff → save |\n| `cms_edit_index_sync` | Build/refresh local index (assets, media, templates, taxonomy) |\n| `cms_edit_create_page` | Create a page with template selection |\n| `cms_edit_create_article` | Create an article (requires article type; featured image rules) |\n| `cms_edit_create_from_doc` | Create a page from a freeform document (infer → confirm → dry-run) |\n| `cms_edit_create_article_from_doc` | Create an article from a freeform document |\n| `cms_edit_taxonomy` | Import taxonomy entries (`create … --if-not-exists`) |\n| `cms_edit_bulk_seo` | Update SEO meta descriptions (read `task-seo-descriptions`) |\n| `cms_edit_bulk_find_replace` | Bulk find-replace in rich text across entries |\n| `cms_edit_bulk_article_tags` | Update tags on one or more articles |\n| `cms_edit_import_authors` | Create person/author entries from a list or sheet |\n| `cms_edit_media` | Find existing assets or upload new ones (reuse-first) |\n\nRead the full guide anytime via the `cms-edit://guide` resource or `cms_edit_help`.\n\n## End-to-end QA prompt\n\nFor release QA after cms-edit or editor-pack upgrades, use a **copy-paste Claude Desktop test script** (phases: connector → customer resources → discovery → session → schema → media → dry-run writes → negatives). See [e2e-test-prompt.md](./e2e-test-prompt.md) to author one per customer site. Example: Brightline `docs/cms-edit/MCP-E2E-TEST.md`.\n\n## Core workflow\n\nStandard editing flow: **open → snapshot → read → set/rtf → diff → save**\n\nEach step is a separate `cms_edit` call. Sessions persist in Redis between calls (hosted) or on disk (local). MCP auto-uses session `_mcp`.\n\n### 1. Open a page\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"open\", \"--page-slug\", \"/pricing\"]\n[\"open\", \"--id\", \"<entry-id>\"]\n```\n\n**Homepage (all SE Studio sites):** Contentful stores the marketing homepage slug as `index`. The live site URL is `/`. In cms-edit, `--page-slug /` and `--page-slug /index` are equivalent (both resolve to `index`). Read `cms-edit://customer/routing` for site-specific exceptions (e.g. Pedestal uses `home`).\n\n### 2. Snapshot — see the content tree\n\n```\n[\"snapshot\"]\n```\n\nOutput shows `@c0`, `@c1`, … refs for each component. Use these refs in `read`, `set`, and `rtf`.\n\n### 3. Read fields\n\n```\n[\"read\", \"@c1\"]\n[\"read\", \"@c1\", \"heading\"]\n```\n\n### 4. Edit fields\n\n```\n[\"set\", \"@c1\", \"heading\", \"New heading text\"]\n[\"rtf\", \"@c1\", \"body\", \"--content\", \"# Title\\n\\nParagraph text.\"]\n```\n\nFor rich text, prefer `--content` with inline markdown. Use `--base64` when special characters cause issues.\n\n### 5. Review and save\n\n```\n[\"diff\"]\n[\"save\"]\n```\n\nAlways run `diff` before `save`. To abandon changes: `[\"discard\"]`.\n\n## When to use Contentful UI\n\n| Task | Where |\n|------|-------|\n| Edit copy, add sections, create pages/articles | **Agent + cms-edit** (drafts) |\n| Upload new images and files | **Agent + cms-edit** (`asset upload`) — search/reuse first |\n| Publish approved drafts | **Contentful UI** |\n| Edit copy directly in Contentful | **Avoid** — use cms-edit instead |\n\ncms-edit saves **drafts only**. A colleague must **publish in Contentful** for changes to go live.\n\n## Asset upload (hosted MCP)\n\nHosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Use staged upload for all images and binary files.\n\n| Source | When | Example |\n|--------|------|---------|\n| **Staged upload** (required for binary) | All images and files on hosted MCP | See **Staged upload** below |\n| **`--url`** (last resort) | File already on public HTTPS fetchable by the host | `[\"asset\", \"upload\", \"--url\", \"https://…/photo.png\", \"--mime\", \"image/png\", \"--file-name\", \"photo.png\"]` |\n\n**After upload:** note the returned asset `id`, attach to the entry (`asset set @root media <id>` for person portraits), then `diff` → `save`. Upload alone does not update entries.\n\n**PNG** when transparency matters.\n\nFull workflow: `cms-edit://customer/task-media-reuse-and-upload`.\n\n### Common pitfalls (agents)\n\n| Issue | Do this |\n|-------|---------|\n| Singular Media on a component (`visual`) | `set @cN visual <mediaId> --link` — **not** `add … --target visual` |\n| Shared Drive folder has extra files | Import with `sourceNames` or `onlyWithOverrides` after catalog |\n| Prepare says no media / empty folder | Share folder **Viewer** with `media-pipeline-reader@se-media-pipeline.iam.gserviceaccount.com`, then re-prepare once |\n| MCP tool times out ~180s | `read` / `diff` / re-`catalog` before retrying the same write — server may already have saved |\n| `preview urls` has no Live Preview URL | Use staging + classic entry editor; row includes `unavailableReason` when CMA preview fails |\n| Reuse-first import matches old fileNames | dry-run first; set `overrides[].fileName` for unique names when duplication is required |\n\n### Staged upload\n\nKeeps binary **out of MCP tool args**. The agent uploads via `curl`, then passes only a short `uploadId`.\n\n1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `byteLength`, optional `title`\n2. Run the returned `curlCommand` in a shell (POST multipart to `uploadUrl`)\n3. `cms_edit` with the returned `consumeArgs` (includes `asset upload --staged <uploadId>`)\n4. Link and save as usual\n\nHosted limit: **4 MB** per staged file (Vercel body limit). Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**, single-use.\n\n## Featured images (articles)\n\nRead `cms-edit://customer/defaults` when present. Otherwise:\n\n1. **Custom** — set `featuredImage` or `featuredImageAssetFilename` on the article when the editor provides a specific image\n2. **Article type** — if omitted, cms-edit inherits the linked **articleType** `featuredImage`\n3. **Site default** — from `editor.defaults` in the site config (also in `defaults.json` in the editor pack)\n\nRun `[\"index\", \"sync\"]` before resolving assets by filename.\n\n## Create content\n\n### Create a page\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"template\"]\n[\"create\", \"page\", \"--slug\", \"/about-us\", \"--title\", \"About Us\", \"--template-id\", \"<id>\"]\n[\"snapshot\"]\n```\n\nOr use `create from-json` with `--dry-run --strict` for multi-section pages.\n\n### Create an article\n\nEvery article requires an **articleType**:\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"articleType\"]\n[\"create\", \"article\", \"--slug\", \"resources/blog/my-post\", \"--title\", \"My Post\", \"--article-type-slug\", \"resources/blog\"]\n```\n\nOr `create from-json` with `\"type\": \"article\"` and `articleTypeSlug` / `articleTypeId`.\n\nUse MCP prompt `cms_edit_create_article` for guided creation.\n\n## Common sequences\n\n### List all pages\n\n```\n[\"list\", \"--type\", \"page\"]\n```\n\n### Refresh local index (assets, media, templates, taxonomy)\n\nRun before asset filename search, media-by-filename list, or fast template/taxonomy lookup:\n\n```\n[\"index\", \"sync\"]\n[\"index\", \"status\"]\n[\"list\", \"--type\", \"template\"]\n```\n\nAsset search and media-by-filename list **require** the index. Template/taxonomy list prefers the index when built.\n\n### Explore the homepage\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"snapshot\"]\n[\"read\", \"@c1\"]\n```\n\n### Edit copy on a page\n\n```\n[\"open\", \"--page-slug\", \"{{EXAMPLE_SLUG}}\"]\n[\"snapshot\"]\n[\"read\", \"@c1\", \"heading\"]\n[\"set\", \"@c1\", \"heading\", \"Updated heading\"]\n[\"diff\"]\n[\"save\"]\n```\n\n## Field discovery\n\n```\n[\"schema\", \"component\"]\n[\"list\", \"--type\", \"page\"]\n[\"search\", \"pricing\"]\n```\n\n## Grok Build setup\n\nGrok connects to the same hosted MCP URL as Claude. Add to `~/.grok/config.toml`:\n\n```toml\n[mcp_servers.cms-edit-brightline]\nurl = \"https://brightline.content.se.studio/api/mcp\"\nenabled = true\n```\n\nReplace the server name and host with your site's deployment. The URL **must** end with `/api/mcp` (not the site root).\n\n**Connect:**\n\n1. In Grok, run `/mcps` and select your cms-edit server\n2. Press **`i`** to initiate OAuth (not just enable the toggle)\n3. Sign in with Contentful when the browser opens\n4. Verify with `grok mcp doctor <server-name>` or call `cms_edit_version`\n\nOAuth is two steps: Grok obtains an MCP token, then you sign in with Contentful to link your account. If the browser flashes and closes immediately, reconnect after upgrading cms-edit (loopback redirect handling).\n\n## Hosted connector rules\n\n{{HOSTED_RULES}}\n\n## Session tips\n\n- After `open`, subsequent MCP commands share session `_mcp` automatically (stored in Redis on hosted).\n- Use `--session <name>` only when juggling multiple pages — pass it **before** the subcommand on every call: `[\"--session\", \"my-work\", \"open\", \"--page-slug\", \"/\"]`.\n- Snapshot JSON includes `sessionName` and `sessionKey` for debugging.\n- If you see \"No active session\", check `/api/health` (Redis must be ok), then run `open` again. Set `LOG_CMS_SESSION=1` on Vercel and search runtime logs for `[cms-edit:session]` (`redis save ok` / `redis load hit` / `requireSession miss`).\n\n### peek vs open vs read\n\n| Goal | MCP args |\n|------|----------|\n| Edit workflow (session) | `[\"open\", \"--page-slug\", \"/\"]` then `[\"read\", \"@c0\"]` |\n| Preview tree + fields, no session | `[\"peek\", \"--page-slug\", \"/pricing\"]` or `[\"peek\", \"--id\", \"<entry-id>\"]` (JSON includes `rootFields`) |\n| Read fields by entry ID, no session | `[\"read\", \"<entry-id>\", \"--id\"]` or `[\"read\", \"<entry-id>\", \"--id\", \"heading\"]` |\n| Debug session persistence | `[\"diagnose\"]` — reports store, userId, active session key |\n\n- **`peek` is one-shot** — prints tree and **root field values** (`rootFields` in JSON). No session is created; do not chain `read @ref` afterward.\n- **Use flat lookup flags** for `open` and `peek` — same as CLI (`--page-slug`, `--id`, etc.). See `help lookup`.\n- **`read @root`** only works after `open` (uses the active session). The hint in peek output is for terminal users who already ran `open`.\n- **Do not invent flags** — there is no `--read`, `--then`, or chained peek+read syntax. One command per `cms_edit` call.\n\n## Troubleshooting\n\n| Problem | What to do |\n|---------|------------|\n| **401 / connection failed** | Reconnect: Claude → Settings → Integrations, or Grok `/mcps` → press `i`. Complete Contentful sign-in. If Grok says “Failed to get tools after auth”, the MCP JWT refreshed but the Contentful cache was gone — delete that server’s entry from `~/.grok/mcp_credentials.json` and press `i` again so the browser opens Contentful. On Vercel, search `[cms-edit:oauth] auth_failure` (`reason=missing_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |\n| **No cms_edit tool** | Confirm the integration is connected under Settings → Integrations |\n| **No active session** | Do not pass `--space` on hosted. Check `/api/health` — `redis` must be ok. MCP uses `_mcp` session automatically. Manual session: `[\"--session\", \"name\", \"open\", \"--page-slug\", \"/\"]`. Fallback: `[\"read\", \"<entry-id>\", \"--id\"]` |\n| **Wrong space** | Your Contentful account must have access to this deployment's space |\n| **Check version** | Call `cms_edit_version` or `curl /api/health` and read `cmsEdit` |\n\n## Articles\n\n**Recent articles** (by publication `date`, not last-updated):\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\", \"-n\", \"10\"]\n```\n\nAlternative: `[\"search\", \"<keyword>\", \"--type\", \"article\"]` (also sorts by date).\n\n**Draft articles** — `peek` and `open` load drafts via CMA (not published-only). To discover drafts:\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\"]\n[\"search\", \"<title>\", \"--type\", \"article\"]\n[\"list\", \"--type\", \"article\", \"--slug\", \"<slug>\"]\n```\n\nThen open: `[\"peek\", \"--article-slug\", \"<slug>\"]` or `[\"open\", \"--id\", \"<entry-id>\"]`. Use `--article-slug`, not `--page-slug`.\n\n**Published-only** is opt-in: `list --published` and `resolve --published` use the Delivery API index and omit never-published drafts.\n\nAfter upgrading cms-edit, run `[\"index\", \"sync\"]` once so the local index includes article `date` values (schema v4).\n\n**Index freshness on hosted MCP:** The catalog index is shared via Redis (gzipped SQLite blob). `index status` on a cold instance may show **not built** until `list`, `open`, or another index command runs — that is normal. Committed writes (`save`, `create page`, `asset upload`, …) mark the index dirty; the next discovery command refreshes it. In-session `set` edits do not trigger a sync.\n\n## Command reference (cms_edit args)\n\n**Discovery:** `list --type <type>`, `search <query>`, `schema <contentType>`, `index sync`, `index status`\n\n**Reading:** `open --page-slug <slug>`, `open --id <id>`, `peek --page-slug <slug>`, `peek --id <id>`, `snapshot`, `read <ref>`, `read <ref> <field>`, `read <id> --id [field]`\n\n**Diagnostics:** `diagnose` — session store, userId, active session (after open/read issues)\n\n**Editing:** `set <ref> <field> <value>`, `rtf <ref> <field> --content \"<md>\"`, `diff`, `save`, `discard`\n\n**Creating:** `create page --slug … --title …`, `create article --slug … --title … --article-type-slug …`, `create from-json --file …`, `add <type> --content-type … --parent @c0 --target content`\n\n**Other:** `health`, `version`, `guide [topic]`\n";
+export const HOSTED_GUIDE_TEMPLATE = "# cms-edit MCP guide\n\nUse this guide when editing Contentful draft content through a hosted MCP connector (Claude Desktop Integrations + OAuth, or Grok Build).\n\n{{SITE_INTRO}}\n\n## Safety rules\n\ncms-edit **cannot and will not**:\n\n- Publish or unpublish entries\n- Archive or delete published entries\n\nAll `save` operations create **drafts only**. A human must review and publish in Contentful.\n\n**Assets:** cms-edit **can upload** draft assets via **staged upload** (hosted) or `--url` (public HTTPS last resort). **`--base64` is not supported on hosted MCP.** Always **search and reuse existing assets first** (`index sync`, then `asset search` or `list --type media`). Use `--if-exists-by-filename` when uploading to avoid duplicates.\n\n## MCP tools\n\n| Tool | Purpose |\n|------|---------|\n| `cms_edit` | Run any cms-edit command via an `args` array |\n| `cms_edit_request_staged_upload` | Get a presigned upload URL for binary files (then `curl` + `asset upload --staged`) |\n| `cms_edit_version` | Check the installed cms-edit version (no session required) |\n| `cms_edit_help` | Read this guide by topic (`overview`, `workflow`, `commands`, `troubleshooting`, `hosted`) |\n\n## Customer editor pack (read first)\n\nWhen a site editor pack is deployed, these MCP resources provide **site-specific** context. Read them before creating or editing content:\n\n| Resource | Purpose |\n|----------|---------|\n| `cms-edit://customer/index` | List of all customer resources |\n| `cms-edit://customer/tasks-index` | Intent → task playbook map (filtered for this site) |\n| `cms-edit://customer/capabilities` | Machine-readable list of what this site supports |\n| `cms-edit://customer/checklist` | First-session onboarding steps |\n| `cms-edit://customer/overview` | Site name, space, staging URL, handoff rules |\n| `cms-edit://customer/routing` | Article/tag URL rules for this site |\n| `cms-edit://customer/production-site` | Production URL and how to fetch page markdown (do not guess `.md` URLs) |\n| `cms-edit://customer/components-index` | Component types and when to use each |\n| `cms-edit://customer/collections-index` | Collection types |\n| `cms-edit://customer/brand` | Brand voice and terminology (if configured) |\n| `cms-edit://customer/articles` | Article/publication playbook (if configured) |\n| `cms-edit://customer/defaults` | Featured image rules and article types (if configured) |\n| `cms-edit://customer/site-facts` | Optional canonical business facts (if configured) |\n| `cms-edit://customer/task-*` | Capability playbooks (e.g. `task-media-reuse-and-upload`) |\n\n**Workflow:** read `tasks-index` → `capabilities` → `checklist` → `overview` → `routing` → `production-site` → pick a `task-*` playbook for your goal → `components-index` → then use `cms_edit` commands.\n\n## MCP prompts\n\n| Prompt | Purpose |\n|--------|---------|\n| `cms_edit_verify` | Check version and connectivity |\n| `cms_edit_explore` | List site content and open a page |\n| `cms_edit_edit_page` | Edit a page through diff → save |\n| `cms_edit_edit_article` | Edit an article through diff → save |\n| `cms_edit_index_sync` | Build/refresh local index (assets, media, templates, taxonomy) |\n| `cms_edit_create_page` | Create a page with template selection |\n| `cms_edit_create_article` | Create an article (requires article type; featured image rules) |\n| `cms_edit_create_from_doc` | Create a page from a freeform document (infer → confirm → dry-run) |\n| `cms_edit_create_article_from_doc` | Create an article from a freeform document |\n| `cms_edit_taxonomy` | Import taxonomy entries (`create … --if-not-exists`) |\n| `cms_edit_bulk_seo` | Update SEO meta descriptions (read `task-seo-descriptions`) |\n| `cms_edit_bulk_find_replace` | Bulk find-replace in rich text across entries |\n| `cms_edit_bulk_article_tags` | Update tags on one or more articles |\n| `cms_edit_import_authors` | Create person/author entries from a list or sheet |\n| `cms_edit_media` | Find existing assets or upload new ones (reuse-first) |\n\nRead the full guide anytime via the `cms-edit://guide` resource or `cms_edit_help`.\n\n## End-to-end QA prompt\n\nFor release QA after cms-edit or editor-pack upgrades, use a **copy-paste Claude Desktop test script** (phases: connector → customer resources → discovery → session → schema → media → dry-run writes → negatives). See [e2e-test-prompt.md](./e2e-test-prompt.md) to author one per customer site. Example: Brightline `docs/cms-edit/MCP-E2E-TEST.md`.\n\n## Core workflow\n\nStandard editing flow: **open → snapshot → read → set/rtf → diff → save**\n\nEach step is a separate `cms_edit` call. Sessions persist in Redis between calls (hosted) or on disk (local). MCP auto-uses session `_mcp`.\n\n### 1. Open a page\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"open\", \"--page-slug\", \"/pricing\"]\n[\"open\", \"--id\", \"<entry-id>\"]\n```\n\n**Homepage (all SE Studio sites):** Contentful stores the marketing homepage slug as `index`. The live site URL is `/`. In cms-edit, `--page-slug /` and `--page-slug /index` are equivalent (both resolve to `index`). Read `cms-edit://customer/routing` for site-specific exceptions (e.g. Pedestal uses `home`).\n\n### 2. Snapshot — see the content tree\n\n```\n[\"snapshot\"]\n```\n\nOutput shows `@c0`, `@c1`, … refs for each component. Use these refs in `read`, `set`, and `rtf`.\n\n### 3. Read fields\n\n```\n[\"read\", \"@c1\"]\n[\"read\", \"@c1\", \"heading\"]\n```\n\n### 4. Edit fields\n\n```\n[\"set\", \"@c1\", \"heading\", \"New heading text\"]\n[\"rtf\", \"@c1\", \"body\", \"--content\", \"# Title\\n\\nParagraph text.\"]\n```\n\nFor rich text, prefer `--content` with inline markdown. Use `--base64` when special characters cause issues.\n\n### 5. Review and save\n\n```\n[\"diff\"]\n[\"save\"]\n```\n\nAlways run `diff` before `save`. To abandon changes: `[\"discard\"]`.\n\n## When to use Contentful UI\n\n| Task | Where |\n|------|-------|\n| Edit copy, add sections, create pages/articles | **Agent + cms-edit** (drafts) |\n| Upload new images and files | **Agent + cms-edit** (`asset upload`) — search/reuse first |\n| Publish approved drafts | **Contentful UI** |\n| Edit copy directly in Contentful | **Avoid** — use cms-edit instead |\n\ncms-edit saves **drafts only**. A colleague must **publish in Contentful** for changes to go live.\n\n## Asset upload (hosted MCP)\n\nHosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Use staged upload for all images and binary files.\n\n| Source | When | Example |\n|--------|------|---------|\n| **Staged upload** (required for binary) | All images and files on hosted MCP | See **Staged upload** below |\n| **`--url`** (last resort) | File already on public HTTPS fetchable by the host | `[\"asset\", \"upload\", \"--url\", \"https://…/photo.png\", \"--mime\", \"image/png\", \"--file-name\", \"photo.png\"]` |\n\n**After upload:** note the returned asset `id`, attach to the entry (`asset set @root media <id>` for person portraits), then `diff` → `save`. Upload alone does not update entries.\n\n**PNG** when transparency matters.\n\nFull workflow: `cms-edit://customer/task-media-reuse-and-upload`.\n\n### Common pitfalls (agents)\n\n| Issue | Do this |\n|-------|---------|\n| Singular Media on a component (`visual`) | `set @cN visual <mediaId> --link` — **not** `add … --target visual` |\n| Shared Drive folder has extra files | Import with `sourceNames` or `onlyWithOverrides` after catalog |\n| Prepare says no media / empty folder | Share folder **Viewer** with `media-pipeline-reader@se-media-pipeline.iam.gserviceaccount.com`, then re-prepare once |\n| MCP tool times out ~180s | `read` / `diff` / re-`catalog` before retrying the same write — server may already have saved |\n| `preview urls` has no Live Preview URL | Use staging + classic entry editor; row includes `unavailableReason` when CMA preview fails |\n| Reuse-first import matches old fileNames | dry-run first; set `overrides[].fileName` for unique names when duplication is required |\n\n### Staged upload\n\nKeeps binary **out of MCP tool args**. The agent uploads via `curl`, then passes only a short `uploadId`.\n\n1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `byteLength`, optional `title`\n2. Run the returned `curlCommand` in a shell (POST multipart to `uploadUrl`)\n3. `cms_edit` with the returned `consumeArgs` (includes `asset upload --staged <uploadId>`)\n4. Link and save as usual\n\nHosted limit: **4 MB** per staged file (Vercel body limit). Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**, single-use.\n\n## Featured images (articles)\n\nRead `cms-edit://customer/defaults` when present. Otherwise:\n\n1. **Custom** — set `featuredImage` or `featuredImageAssetFilename` on the article when the editor provides a specific image\n2. **Article type** — if omitted, cms-edit inherits the linked **articleType** `featuredImage`\n3. **Site default** — from `editor.defaults` in the site config (also in `defaults.json` in the editor pack)\n\nRun `[\"index\", \"sync\"]` before resolving assets by filename.\n\n## Create content\n\n### Create a page\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"template\"]\n[\"create\", \"page\", \"--slug\", \"/about-us\", \"--title\", \"About Us\", \"--template-id\", \"<id>\"]\n[\"snapshot\"]\n```\n\nOr use `create from-json` with `--dry-run --strict` for multi-section pages.\n\n### Create an article\n\nEvery article requires an **articleType**:\n\n```\n[\"index\", \"sync\"]\n[\"list\", \"--type\", \"articleType\"]\n[\"create\", \"article\", \"--slug\", \"resources/blog/my-post\", \"--title\", \"My Post\", \"--article-type-slug\", \"resources/blog\"]\n```\n\nOr `create from-json` with `\"type\": \"article\"` and `articleTypeSlug` / `articleTypeId`.\n\nUse MCP prompt `cms_edit_create_article` for guided creation.\n\n## Common sequences\n\n### List all pages\n\n```\n[\"list\", \"--type\", \"page\"]\n```\n\n### Refresh local index (assets, media, templates, taxonomy)\n\nRun before asset filename search, media-by-filename list, or fast template/taxonomy lookup:\n\n```\n[\"index\", \"sync\"]\n[\"index\", \"status\"]\n[\"list\", \"--type\", \"template\"]\n```\n\nAsset search and media-by-filename list **require** the index. Template/taxonomy list prefers the index when built.\n\n### Explore the homepage\n\n```\n[\"open\", \"--page-slug\", \"/\"]\n[\"snapshot\"]\n[\"read\", \"@c1\"]\n```\n\n### Edit copy on a page\n\n```\n[\"open\", \"--page-slug\", \"{{EXAMPLE_SLUG}}\"]\n[\"snapshot\"]\n[\"read\", \"@c1\", \"heading\"]\n[\"set\", \"@c1\", \"heading\", \"Updated heading\"]\n[\"diff\"]\n[\"save\"]\n```\n\n## Field discovery\n\n```\n[\"schema\", \"component\"]\n[\"list\", \"--type\", \"page\"]\n[\"search\", \"pricing\"]\n```\n\n## Grok Build setup\n\nGrok connects to the same hosted MCP URL as Claude. Add to `~/.grok/config.toml`:\n\n```toml\n[mcp_servers.cms-edit-brightline]\nurl = \"https://brightline.content.se.studio/api/mcp\"\nenabled = true\n```\n\nReplace the server name and host with your site's deployment. The URL **must** end with `/api/mcp` (not the site root).\n\n**Connect:**\n\n1. In Grok, run `/mcps` and select your cms-edit server\n2. Press **`i`** to initiate OAuth (not just enable the toggle)\n3. Sign in with Contentful when the browser opens\n4. Verify with `grok mcp doctor <server-name>` or call `cms_edit_version`\n\nOAuth is two steps: Grok obtains an MCP token, then you sign in with Contentful to link your account. If the browser flashes and closes immediately, reconnect after upgrading cms-edit (loopback redirect handling).\n\n## Hosted connector rules\n\n{{HOSTED_RULES}}\n\n## Session tips\n\n- After `open`, subsequent MCP commands share session `_mcp` automatically (stored in Redis on hosted).\n- Use `--session <name>` only when juggling multiple pages — pass it **before** the subcommand on every call: `[\"--session\", \"my-work\", \"open\", \"--page-slug\", \"/\"]`.\n- Snapshot JSON includes `sessionName` and `sessionKey` for debugging.\n- If you see \"No active session\", check `/api/health` (Redis must be ok), then run `open` again. Set `LOG_CMS_SESSION=1` on Vercel and search runtime logs for `[cms-edit:session]` (`redis save ok` / `redis load hit` / `requireSession miss`).\n\n### peek vs open vs read\n\n| Goal | MCP args |\n|------|----------|\n| Edit workflow (session) | `[\"open\", \"--page-slug\", \"/\"]` then `[\"read\", \"@c0\"]` |\n| Preview tree + fields, no session | `[\"peek\", \"--page-slug\", \"/pricing\"]` or `[\"peek\", \"--id\", \"<entry-id>\"]` (JSON includes `rootFields`) |\n| Read fields by entry ID, no session | `[\"read\", \"<entry-id>\", \"--id\"]` or `[\"read\", \"<entry-id>\", \"--id\", \"heading\"]` |\n| Debug session persistence | `[\"diagnose\"]` — reports store, userId, active session key |\n\n- **`peek` is one-shot** — prints tree and **root field values** (`rootFields` in JSON). No session is created; do not chain `read @ref` afterward.\n- **Use flat lookup flags** for `open` and `peek` — same as CLI (`--page-slug`, `--id`, etc.). See `help lookup`.\n- **`read @root`** only works after `open` (uses the active session). The hint in peek output is for terminal users who already ran `open`.\n- **Do not invent flags** — there is no `--read`, `--then`, or chained peek+read syntax. One command per `cms_edit` call.\n\n## Troubleshooting\n\n| Problem | What to do |\n|---------|------------|\n| **401 / connection failed** | Reconnect: Claude → Settings → Integrations, or Grok `/mcps` → press `i`. Complete Contentful sign-in. If Grok says “Failed to get tools after auth” or `auth required`, the MCP JWT refreshed but Contentful rejected (or never had) the CMA cache. cms-edit **3.5.3+** returns `invalid_token` and refuses refresh so Grok re-runs Contentful sign-in. If it still loops, delete that server’s entry from `~/.grok/mcp_credentials.json` and press `i` again. On Vercel, search `[cms-edit:oauth] auth_failure` (`missing_contentful_token` or `invalid_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |\n| **No cms_edit tool** | Confirm the integration is connected under Settings → Integrations |\n| **No active session** | Do not pass `--space` on hosted. Check `/api/health` — `redis` must be ok. MCP uses `_mcp` session automatically. Manual session: `[\"--session\", \"name\", \"open\", \"--page-slug\", \"/\"]`. Fallback: `[\"read\", \"<entry-id>\", \"--id\"]` |\n| **Wrong space** | Your Contentful account must have access to this deployment's space |\n| **Check version** | Call `cms_edit_version` or `curl /api/health` and read `cmsEdit` |\n\n## Articles\n\n**Recent articles** (by publication `date`, not last-updated):\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\", \"-n\", \"10\"]\n```\n\nAlternative: `[\"search\", \"<keyword>\", \"--type\", \"article\"]` (also sorts by date).\n\n**Draft articles** — `peek` and `open` load drafts via CMA (not published-only). To discover drafts:\n\n```json\n[\"list\", \"--type\", \"article\", \"--sort\", \"date\"]\n[\"search\", \"<title>\", \"--type\", \"article\"]\n[\"list\", \"--type\", \"article\", \"--slug\", \"<slug>\"]\n```\n\nThen open: `[\"peek\", \"--article-slug\", \"<slug>\"]` or `[\"open\", \"--id\", \"<entry-id>\"]`. Use `--article-slug`, not `--page-slug`.\n\n**Published-only** is opt-in: `list --published` and `resolve --published` use the Delivery API index and omit never-published drafts.\n\nAfter upgrading cms-edit, run `[\"index\", \"sync\"]` once so the local index includes article `date` values (schema v4).\n\n**Index freshness on hosted MCP:** The catalog index is shared via Redis (gzipped SQLite blob). `index status` on a cold instance may show **not built** until `list`, `open`, or another index command runs — that is normal. Committed writes (`save`, `create page`, `asset upload`, …) mark the index dirty; the next discovery command refreshes it. In-session `set` edits do not trigger a sync.\n\n## Command reference (cms_edit args)\n\n**Discovery:** `list --type <type>`, `search <query>`, `schema <contentType>`, `index sync`, `index status`\n\n**Reading:** `open --page-slug <slug>`, `open --id <id>`, `peek --page-slug <slug>`, `peek --id <id>`, `snapshot`, `read <ref>`, `read <ref> <field>`, `read <id> --id [field]`\n\n**Diagnostics:** `diagnose` — session store, userId, active session (after open/read issues)\n\n**Editing:** `set <ref> <field> <value>`, `rtf <ref> <field> --content \"<md>\"`, `diff`, `save`, `discard`\n\n**Creating:** `create page --slug … --title …`, `create article --slug … --title … --article-type-slug …`, `create from-json --file …`, `add <type> --content-type … --parent @c0 --target content`\n\n**Other:** `health`, `version`, `guide [topic]`\n";
 //# sourceMappingURL=hosted-guide.js.map

package/dist/generated/hosted-guide.js.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-guide.js","sourceRoot":"","sources":["../../src/generated/hosted-guide.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,2ygBAA2ygB,CAAC"}
+{"version":3,"file":"hosted-guide.js","sourceRoot":"","sources":["../../src/generated/hosted-guide.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,87gBAA87gB,CAAC"}

package/dist/generated/version.d.ts

@@ -1,3 +1,3 @@
 export declare const CMS_EDIT_PACKAGE_NAME = "@se-studio/contentful-cms";
-export declare const CMS_EDIT_VERSION = "3.5.2";
+export declare const CMS_EDIT_VERSION = "3.5.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/generated/version.js

@@ -1,4 +1,4 @@
 // Generated by scripts/generate-embedded-assets.mjs — do not edit manually.
 export const CMS_EDIT_PACKAGE_NAME = "@se-studio/contentful-cms";
-export const CMS_EDIT_VERSION = "3.5.2";
+export const CMS_EDIT_VERSION = "3.5.3";
 //# sourceMappingURL=version.js.map

package/dist/hosted/index.d.ts

@@ -21,7 +21,7 @@ export { completeAuthorizationCodeGrant, issueAuthorizationRedirect, } from './o
 export { getContentfulAuthorizeUrl, getContentfulOAuthClientId, getContentfulOAuthRedirectUri, getMcpResourceUrl, getProtectedResourceMetadataUrl, getPublicOrigin, } from './oauth/config.js';
 export { handleLinkContentfulPost, handleOAuthAuthorizationServerMetadataGet, handleOAuthAuthorizeGet, handleOAuthHealthCheck, handleOAuthProtectedResourceMetadataGet, handleOAuthRegisterPost, handleOAuthTokenPost, type OAuthHandlerContext, } from './oauth/handlers.js';
 export { signMcpAccessToken, verifyMcpAccessToken } from './oauth/jwt.js';
-export { authorizationCodeGrantFailureReason, isOauthLoggingVerbose, oauthLogAuthFailure, oauthLogMcpHandlerError, oauthLogVerbose, patValidationFailureReason, } from './oauth/log.js';
+export { authorizationCodeGrantFailureReason, isOauthLoggingVerbose, isTransientContentfulFailure, isUnusableContentfulCacheReason, oauthLogAuthFailure, oauthLogMcpHandlerError, oauthLogVerbose, patValidationFailureReason, } from './oauth/log.js';
 export { generateAuthCode, verifyPkce } from './oauth/pkce.js';
 export { completeRefreshTokenGrant, isRefreshTokenGrantError, RefreshTokenGrantError, type RefreshTokenGrantFailureReason, } from './oauth/refresh.js';
 export { type AuthCodeRecord, contentfulTokenKey, createOAuthStore, type OAuthClientRegistration, type OAuthStore, type PendingAuthRequest, type RefreshTokenRecord, refreshTokenKey, } from './oauth/store.js';

package/dist/hosted/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hosted/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,2BAA2B,EAC3B,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,KAAK,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,cAAc,EACd,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hosted/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,sBAAsB,EAC3B,2BAA2B,EAC3B,KAAK,iBAAiB,EACtB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,KAAK,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,cAAc,EACd,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,4BAA4B,EAC5B,+BAA+B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,8BAA8B,GACpC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,cAAc,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/hosted/index.js

@@ -20,7 +20,7 @@ export { completeAuthorizationCodeGrant, issueAuthorizationRedirect, } from './o
 export { getContentfulAuthorizeUrl, getContentfulOAuthClientId, getContentfulOAuthRedirectUri, getMcpResourceUrl, getProtectedResourceMetadataUrl, getPublicOrigin, } from './oauth/config.js';
 export { handleLinkContentfulPost, handleOAuthAuthorizationServerMetadataGet, handleOAuthAuthorizeGet, handleOAuthHealthCheck, handleOAuthProtectedResourceMetadataGet, handleOAuthRegisterPost, handleOAuthTokenPost, } from './oauth/handlers.js';
 export { signMcpAccessToken, verifyMcpAccessToken } from './oauth/jwt.js';
-export { authorizationCodeGrantFailureReason, isOauthLoggingVerbose, oauthLogAuthFailure, oauthLogMcpHandlerError, oauthLogVerbose, patValidationFailureReason, } from './oauth/log.js';
+export { authorizationCodeGrantFailureReason, isOauthLoggingVerbose, isTransientContentfulFailure, isUnusableContentfulCacheReason, oauthLogAuthFailure, oauthLogMcpHandlerError, oauthLogVerbose, patValidationFailureReason, } from './oauth/log.js';
 export { generateAuthCode, verifyPkce } from './oauth/pkce.js';
 export { completeRefreshTokenGrant, isRefreshTokenGrantError, RefreshTokenGrantError, } from './oauth/refresh.js';
 export { contentfulTokenKey, createOAuthStore, refreshTokenKey, } from './oauth/store.js';

package/dist/hosted/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosted/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA6B,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAElB,2BAA2B,EAE3B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAsB,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAgC,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAEL,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAEhB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EAEtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,EAKhB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosted/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA6B,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAElB,2BAA2B,EAE3B,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAsB,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAgC,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAEL,eAAe,EACf,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAGL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,eAAe,GAGhB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAEhB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EAEtB,oBAAoB,EACpB,iCAAiC,EACjC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,6BAA6B,EAC7B,iBAAiB,EACjB,+BAA+B,EAC/B,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,yCAAyC,EACzC,uBAAuB,EACvB,sBAAsB,EACtB,uCAAuC,EACvC,uBAAuB,EACvB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,qBAAqB,EACrB,4BAA4B,EAC5B,+BAA+B,EAC/B,mBAAmB,EACnB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,EAKhB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/hosted/next/routes/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAuBA,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE7D;AAED,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE9D;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhE"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAyBA,wBAAsB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE7D;AAED,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAE9D;AAED,wBAAsB,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhE"}

package/dist/hosted/next/routes/mcp.js

@@ -1,6 +1,6 @@
 import { MediaPipelineJobStore } from '../../../media-pipeline/job-store.js';
 import { StagedUploadStore } from '../../../staged-upload/store.js';
-import { buildHostedConfig, handleHostedMcpRequest, isMcpUnauthorizedError, loadHostedDeploymentFromEnv, oauthLogAuthFailure, oauthLogMcpHandlerError, patValidationFailureReason, RedisIndexCacheStore, RedisSessionStore, resolveContentfulTokenFromRequest, unauthorizedMcpResponse, validatePatForDeployment, } from '../../index.js';
+import { buildHostedConfig, handleHostedMcpRequest, isMcpUnauthorizedError, isTransientContentfulFailure, isUnusableContentfulCacheReason, loadHostedDeploymentFromEnv, oauthLogAuthFailure, oauthLogMcpHandlerError, patValidationFailureReason, RedisIndexCacheStore, RedisSessionStore, resolveContentfulTokenFromRequest, unauthorizedMcpResponse, validatePatForDeployment, } from '../../index.js';
 import { createOAuthHandlerContext } from '../context.js';
 import { getHostedEditorPackPath } from '../editor-pack-path.js';
 import { createRedisClient } from '../redis.js';
@@ -20,8 +20,33 @@ async function handleMcp(request) {
     let user;
     try {
         const deployment = loadHostedDeploymentFromEnv();
-        const { contentfulToken } = await resolveContentfulTokenFromRequest(request, oauthCtx.store, deployment.spaceId);
-        user = await validatePatForDeployment(contentfulToken, deployment);
+        const { sub, contentfulToken } = await resolveContentfulTokenFromRequest(request, oauthCtx.store, deployment.spaceId);
+        try {
+            user = await validatePatForDeployment(contentfulToken, deployment);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const reason = patValidationFailureReason(message);
+            if (isUnusableContentfulCacheReason(reason)) {
+                await oauthCtx.store.deleteContentfulToken(sub, deployment.spaceId);
+                oauthLogAuthFailure('mcp', reason, {
+                    spaceId: deployment.spaceId,
+                    projectKey: deployment.projectKey,
+                    message,
+                });
+                return unauthorizedMcpResponse('invalid_contentful_token');
+            }
+            if (isTransientContentfulFailure(reason)) {
+                oauthLogAuthFailure('mcp', reason, {
+                    spaceId: deployment.spaceId,
+                    projectKey: deployment.projectKey,
+                    message,
+                });
+                return Response.json({ error: message }, { status: 503 });
+            }
+            throw err;
+        }
+        await oauthCtx.store.touchContentfulToken(sub, deployment.spaceId);
     }
     catch (err) {
         let deploymentMeta = {};

package/dist/hosted/next/routes/mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;AACxC,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB;IACvC,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAE7C,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,iCAAiC,CACjE,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACvD,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE;YAC9D,GAAG,cAAc;YACjB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACjD,YAAY,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YAChD,eAAe,EAAE,IAAI,oBAAoB,CAAC,WAAW,CAAC;YACtD,iBAAiB,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YACrD,qBAAqB,EAAE,IAAI,qBAAqB,CAAC,WAAW,CAAC;YAC7D,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SACjD,CAAC;QAEF,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE;YAC3C,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc;YAC1C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBACjD,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../../../src/hosted/next/routes/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,uBAAuB,EACvB,0BAA0B,EAC1B,oBAAoB,EACpB,iBAAiB,EACjB,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;AACxC,MAAM,cAAc,GAAG,uBAAuB,EAAE,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,OAAgB;IACxC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAgB;IACzC,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAgB;IACvC,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;IAE7C,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,MAAM,iCAAiC,CACtE,OAAO,EACP,QAAQ,CAAC,KAAK,EACd,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,QAAQ,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;gBACpE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,uBAAuB,CAAC,0BAA0B,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE;oBACjC,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACvD,OAAO,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,mBAAmB,CAAC,KAAK,EAAE,0BAA0B,CAAC,OAAO,CAAC,EAAE;YAC9D,GAAG,cAAc;YACjB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC;YACjD,YAAY,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YAChD,eAAe,EAAE,IAAI,oBAAoB,CAAC,WAAW,CAAC;YACtD,iBAAiB,EAAE,IAAI,iBAAiB,CAAC,WAAW,CAAC;YACrD,qBAAqB,EAAE,IAAI,qBAAqB,CAAC,WAAW,CAAC;YAC7D,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SACjD,CAAC;QAEF,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE;YAC3C,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc;YAC1C,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;gBACjD,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CAAC;YACF,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,cAAc,GAA8C,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;YACjD,cAAc,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;QACtF,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;QACD,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/auth.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthStore } from './store.js';
-export type McpAuthFailureReason = 'missing_bearer' | 'invalid_mcp_jwt' | 'missing_contentful_token';
+export type McpAuthFailureReason = 'missing_bearer' | 'invalid_mcp_jwt' | 'missing_contentful_token' | 'invalid_contentful_token';
 export declare class McpUnauthorizedError extends Error {
     readonly reason: McpAuthFailureReason;
     constructor(reason: McpAuthFailureReason);

package/dist/hosted/oauth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,iBAAiB,GACjB,0BAA0B,CAAC;AAE/B,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBAE1B,MAAM,EAAE,oBAAoB;CAKzC;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAOD,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,oBAAuC,GAAG,QAAQ,CAajG;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU;AACjB,mFAAmF;AACnF,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,GAChB,iBAAiB,GACjB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBAE1B,MAAM,EAAE,oBAAoB;CAKzC;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEpF;AAQD,wBAAgB,uBAAuB,CAAC,MAAM,GAAE,oBAAuC,GAAG,QAAQ,CAajG;AAED,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,UAAU;AACjB,mFAAmF;AACnF,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBnD"}

package/dist/hosted/oauth/auth.js

@@ -15,6 +15,7 @@ export function isMcpUnauthorizedError(error) {
 const INVALID_TOKEN_DESCRIPTIONS = {
     invalid_mcp_jwt: 'MCP access token is invalid or expired.',
     missing_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
+    invalid_contentful_token: 'Contentful session expired. Reconnect and sign in with Contentful.',
 };
 export function unauthorizedMcpResponse(reason = 'missing_bearer') {
     const metadataUrl = getProtectedResourceMetadataUrl();

package/dist/hosted/oauth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAQhD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAA+B,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/hosted/oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAuB;IAEtC,YAAY,MAA4B;QACtC,KAAK,CAAC,cAAc,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,KAAK,YAAY,oBAAoB,CAAC;AAC/C,CAAC;AAED,MAAM,0BAA0B,GAAkD;IAChF,eAAe,EAAE,yCAAyC;IAC1D,wBAAwB,EAAE,oEAAoE;IAC9F,wBAAwB,EAAE,oEAAoE;CAC/F,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,SAA+B,gBAAgB;IACrF,MAAM,WAAW,GAAG,+BAA+B,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,oDAAoD,WAAW,yBAAyB,WAAW,GAAG;QACxG,CAAC,CAAC,6BAA6B,WAAW,GAAG,CAAC;IAChD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE;QACrE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,GAAG;SACxB;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAAgB,EAChB,KAAiB;AACjB,mFAAmF;AACnF,OAAgB;IAEhB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;AAClC,CAAC"}

package/dist/hosted/oauth/cached-cma.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthStore } from './store.js';
+export declare const CONTENTFUL_SESSION_EXPIRED = "Contentful session expired. Sign in with Contentful again.";
+export declare class CachedContentfulTokenError extends Error {
+    readonly reason: 'missing_contentful_token' | 'invalid_contentful_token';
+    constructor(reason: 'missing_contentful_token' | 'invalid_contentful_token', message: string);
+}
+export declare function isCachedContentfulTokenError(error: unknown): error is CachedContentfulTokenError;
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export declare function loadAndValidateContentfulToken(store: OAuthStore, sub: string, spaceId: string | undefined, validateContentfulToken?: (token: string) => Promise<void>): Promise<string>;
+//# sourceMappingURL=cached-cma.d.ts.map

package/dist/hosted/oauth/cached-cma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,0BAA0B,+DACuB,CAAC;AAE/D,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,CAAC;gBAE7D,MAAM,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK7F;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAEhG;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACzD,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/hosted/oauth/cached-cma.js

@@ -0,0 +1,41 @@
+import { isUnusableContentfulCacheReason, patValidationFailureReason } from './log.js';
+export const CONTENTFUL_SESSION_EXPIRED = 'Contentful session expired. Sign in with Contentful again.';
+export class CachedContentfulTokenError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.name = 'CachedContentfulTokenError';
+        this.reason = reason;
+    }
+}
+export function isCachedContentfulTokenError(error) {
+    return error instanceof CachedContentfulTokenError;
+}
+/**
+ * Load the cached CMA token and, when `validateContentfulToken` is passed, confirm
+ * Contentful still accepts it. Invalid/denied tokens are deleted. Transient API
+ * errors are rethrown without deleting the cache.
+ */
+export async function loadAndValidateContentfulToken(store, sub, spaceId, validateContentfulToken) {
+    const token = await store.getContentfulToken(sub, spaceId);
+    if (!token) {
+        throw new CachedContentfulTokenError('missing_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+    }
+    if (validateContentfulToken) {
+        try {
+            await validateContentfulToken(token);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const reason = patValidationFailureReason(message);
+            if (isUnusableContentfulCacheReason(reason)) {
+                await store.deleteContentfulToken(sub, spaceId);
+                throw new CachedContentfulTokenError('invalid_contentful_token', CONTENTFUL_SESSION_EXPIRED);
+            }
+            throw error;
+        }
+    }
+    await store.touchContentfulToken(sub, spaceId);
+    return token;
+}
+//# sourceMappingURL=cached-cma.js.map

package/dist/hosted/oauth/cached-cma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cached-cma.js","sourceRoot":"","sources":["../../../src/hosted/oauth/cached-cma.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAGvF,MAAM,CAAC,MAAM,0BAA0B,GACrC,4DAA4D,CAAC;AAE/D,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,MAAM,CAA0D;IAEzE,YAAY,MAA+D,EAAE,OAAe;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,OAAO,KAAK,YAAY,0BAA0B,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,GAAW,EACX,OAA2B,EAC3B,uBAA0D;IAE1D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,0BAA0B,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,uBAAuB,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,+BAA+B,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,EAC1B,0BAA0B,CAC3B,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/hosted/oauth/complete.d.ts

@@ -6,6 +6,7 @@ export declare function completeAuthorizationCodeGrant(store: OAuthStore, input:
     clientId: string;
     codeVerifier: string;
     spaceId?: string;
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/complete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA4CD"}
+{"version":3,"file":"complete.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEjE,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAmDD"}

package/dist/hosted/oauth/complete.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 import { generateAuthCode } from './pkce.js';
 import { redirectUrisEquivalent } from './redirect-uri.js';
@@ -13,7 +14,7 @@ export async function issueAuthorizationRedirect(store, authRequestId, sub, requ
     return redirect.toString();
 }
 export async function completeAuthorizationCodeGrant(store, input) {
-    const codeRecord = await store.consumeAuthCode(input.code);
+    const codeRecord = await store.peekAuthCode(input.code);
     if (!codeRecord) {
         throw new Error('Invalid or expired authorization code.');
     }
@@ -32,9 +33,10 @@ export async function completeAuthorizationCodeGrant(store, input) {
     if (digest !== authRequest.codeChallenge) {
         throw new Error('Invalid code_verifier.');
     }
-    const contentfulToken = await store.getContentfulToken(codeRecord.sub, input.spaceId);
-    if (!contentfulToken) {
-        throw new Error('Contentful session expired. Sign in with Contentful again.');
+    await loadAndValidateContentfulToken(store, codeRecord.sub, input.spaceId, input.validateContentfulToken);
+    const consumed = await store.consumeAuthCode(input.code);
+    if (!consumed) {
+        throw new Error('Invalid or expired authorization code.');
     }
     const { accessToken, expiresIn } = await signMcpAccessToken(codeRecord.sub, authRequest.resource);
     const refreshToken = randomUUID();

package/dist/hosted/oauth/complete.js.map

@@ -1 +1 @@
-{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAMC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}
+{"version":3,"file":"complete.js","sourceRoot":"","sources":["../../../src/hosted/oauth/complete.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,aAAqB,EACrB,GAAW,EACX,OAA2B;IAE3B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAiB,EACjB,KAOC;IAOD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,WAAW,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,8BAA8B,CAClC,KAAK,EACL,UAAU,CAAC,GAAG,EACd,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAElG,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,CAAC,gBAAgB,CAAC,YAAY,EAAE;QACzC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAgB/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,wBAAwB,CAAC;AAW/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,sBAAsB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAuDnB;AAED,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CAyBnB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,mBAAmB,GACvB,OAAO,CAAC,QAAQ,CAAC,CA8CnB;AAED,wBAAgB,yCAAyC,IAAI,QAAQ,CAYpE;AAED,wBAAgB,uCAAuC,IAAI,QAAQ,CAMlE;AAED,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBvF"}

package/dist/hosted/oauth/handlers.js

@@ -2,9 +2,10 @@ import { validatePatForDeployment } from '../../config/hosted.js';
 import { flushTelemetry, recordOAuthTelemetryFailure, recordOAuthTelemetrySuccess, } from '../../telemetry/index.js';
 import { completeAuthorizationCodeGrant, issueAuthorizationRedirect } from './complete.js';
 import { getContentfulAuthorizeUrl, getMcpResourceUrl, getPublicOrigin } from './config.js';
-import { authorizationCodeGrantFailureReason, oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason, } from './log.js';
+import { oauthLogAuthFailure, oauthLogVerbose, patValidationFailureReason } from './log.js';
 import { normalizeLoopbackRedirectUri, redirectUriMatchesRegistered } from './redirect-uri.js';
-import { completeRefreshTokenGrant, isRefreshTokenGrantError } from './refresh.js';
+import { completeRefreshTokenGrant } from './refresh.js';
+import { oauthTokenGrantFailureResponse } from './token-grant-response.js';
 function errorRedirect(redirectUri, message, state) {
     if (!redirectUri) {
         return new Response(message, { status: 400 });
@@ -115,6 +116,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 codeVerifier,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             recordOAuthTelemetrySuccess('authorization-code');
             await flushTelemetry();
@@ -126,12 +130,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const reason = authorizationCodeGrantFailureReason(message);
-            oauthLogAuthFailure('authorization-code', reason);
-            recordOAuthTelemetryFailure('authorization-code', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'authorization-code');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     if (grantType === 'refresh_token') {
@@ -149,6 +150,9 @@ export async function handleOAuthTokenPost(request, ctx) {
                 clientId,
                 resource,
                 spaceId: ctx.deployment.spaceId,
+                validateContentfulToken: async (contentfulToken) => {
+                    await validatePatForDeployment(contentfulToken, ctx.deployment);
+                },
             });
             oauthLogVerbose('refresh-token ok');
             recordOAuthTelemetrySuccess('refresh-token');
@@ -161,12 +165,9 @@ export async function handleOAuthTokenPost(request, ctx) {
             });
         }
         catch (error) {
-            const reason = isRefreshTokenGrantError(error) ? error.reason : 'refresh_token_grant_failed';
-            const message = error instanceof Error ? error.message : String(error);
-            oauthLogAuthFailure('refresh-token', reason);
-            recordOAuthTelemetryFailure('refresh-token', reason);
+            const response = oauthTokenGrantFailureResponse(error, 'refresh-token');
             await flushTelemetry();
-            return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+            return response;
         }
     }
     recordOAuthTelemetryFailure('token', 'unsupported_grant_type');

package/dist/hosted/oauth/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EACL,mCAAmC,EACnC,mBAAmB,EACnB,eAAe,EACf,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AASnF,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;YAC5D,mBAAmB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAClD,2BAA2B,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;aAChC,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC;YAC7F,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,mBAAmB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC7C,2BAA2B,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtF,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/hosted/oauth/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAQ3E,SAAS,aAAa,CAAC,WAA0B,EAAE,OAAe,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC;IACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,mBAAmB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9C,IAAI,mBAAmB,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,2DAA2D,EAAE;gBAC/E,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,GAAG,CAAC,KAAK,EACT,mBAAmB,EACnB,SAAS,EACT,OAAO,CACR,CAAC;QACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,WAAW,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,WAAW,EAAE,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC,WAAW,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;QAC/E,OAAO,aAAa,CAAC,WAAW,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,qBAAqB,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IAExE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC;QAC/D,QAAQ;QACR,WAAW,EAAE,qBAAqB;QAClC,aAAa;QACb,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAuD,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACjD,YAAY;QACZ,UAAU,EAAE,IAAI,CAAC,WAAW;KAC7B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAClD,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,0BAA0B,EAAE,MAAM;KACnC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,GAAwB;IAExB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,MAAuB,CAAC;IAE5B,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE3C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAEjD,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YACxD,2BAA2B,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;YACrE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC5D,IAAI;gBACJ,WAAW;gBACX,QAAQ;gBACR,YAAY;gBACZ,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YAClD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;YAC7E,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;QAErD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,2BAA2B,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YAChE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE;gBACvD,YAAY;gBACZ,QAAQ;gBACR,QAAQ;gBACR,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBAC/B,uBAAuB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;oBACjD,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;gBAClE,CAAC;aACF,CAAC,CAAC;YACH,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACpC,2BAA2B,CAAC,eAAe,CAAC,CAAC;YAC7C,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC,IAAI,CAAC;gBACnB,YAAY,EAAE,KAAK,CAAC,WAAW;gBAC/B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,UAAU,EAAE,KAAK,CAAC,SAAS;gBAC3B,aAAa,EAAE,KAAK,CAAC,YAAY;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACxE,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC/D,MAAM,cAAc,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAgB,EAChB,GAAwB;IAExB,IAAI,IAA0D,CAAC;IAC/D,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAyD,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,gDAAgD,EAAE,EAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,eAAe,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtF,eAAe,CAAC,oBAAoB,EAAE;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QACvD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE/C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE;YAC7C,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;YACrC,OAAO;SACR,CAAC,CAAC;QACH,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,cAAc,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yCAAyC;IACvD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,QAAQ,EAAE,iBAAiB,EAAE;QAC7B,qBAAqB,EAAE,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,eAAe,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/hosted/oauth/log.d.ts

@@ -6,5 +6,7 @@ export declare function oauthLogMcpHandlerError(message: string, details?: Recor
 /** Always emitted for auth failures — visible in Vercel runtime logs. */
 export declare function oauthLogAuthFailure(route: string, reason: string, details?: Record<string, unknown>): void;
 export declare function authorizationCodeGrantFailureReason(message: string): string;
+export declare function isUnusableContentfulCacheReason(reason: string): boolean;
+export declare function isTransientContentfulFailure(reason: string): boolean;
 export declare function patValidationFailureReason(message: string): string;
 //# sourceMappingURL=log.d.ts.map

package/dist/hosted/oauth/log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}
+{"version":3,"file":"log.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAMtG,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGtF;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIhG;AAED,yEAAyE;AACzE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,IAAI,CAMN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB3E;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBlE"}

package/dist/hosted/oauth/log.js

@@ -40,6 +40,16 @@ export function authorizationCodeGrantFailureReason(message) {
     }
     return 'invalid_grant';
 }
+export function isUnusableContentfulCacheReason(reason) {
+    return (reason === 'invalid_contentful_token' ||
+        reason === 'space_access_denied' ||
+        reason === 'missing_contentful_token');
+}
+export function isTransientContentfulFailure(reason) {
+    return (reason === 'contentful_api_error' ||
+        reason === 'space_check_failed' ||
+        reason === 'pat_validation_failed');
+}
 export function patValidationFailureReason(message) {
     if (message.includes('does not have access to the configured Contentful space')) {
         return 'space_access_denied';

package/dist/hosted/oauth/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"log.js","sourceRoot":"","sources":["../../../src/hosted/oauth/log.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,OAAiC;IAC9E,IAAI,CAAC,qBAAqB,EAAE;QAAE,OAAO;IACrC,aAAa,CAAC,oBAAoB,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,OAAiC;IACxF,aAAa,CACX,wCAAwC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjG,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,OAAiC;IAEjC,aAAa,CACX,uCAAuC,KAAK,WAAW,MAAM,GAC3D,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAC5C,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,OAAe;IACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC9D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC1C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAAc;IAC5D,OAAO,CACL,MAAM,KAAK,0BAA0B;QACrC,MAAM,KAAK,qBAAqB;QAChC,MAAM,KAAK,0BAA0B,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CACL,MAAM,KAAK,sBAAsB;QACjC,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,OAAO,CAAC,QAAQ,CAAC,yDAAyD,CAAC,EAAE,CAAC;QAChF,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5D,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,yCAAyC,CAAC,EAAE,CAAC;QAChE,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,uBAAuB,CAAC;AACjC,CAAC"}

package/dist/hosted/oauth/refresh.d.ts

@@ -1,5 +1,5 @@
 import type { OAuthStore } from './store.js';
-export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token';
+export type RefreshTokenGrantFailureReason = 'invalid_refresh_token' | 'refresh_client_mismatch' | 'refresh_resource_mismatch' | 'missing_contentful_token' | 'invalid_contentful_token';
 export declare class RefreshTokenGrantError extends Error {
     readonly reason: RefreshTokenGrantFailureReason;
     constructor(reason: RefreshTokenGrantFailureReason, message?: string);
@@ -11,6 +11,8 @@ export declare function completeRefreshTokenGrant(store: OAuthStore, input: {
     resource?: string;
     /** Host Contentful space — refresh must not mint a JWT if the CMA cache is gone. */
     spaceId?: string;
+    /** When set, refuse refresh if Contentful rejects the cached CMA token. */
+    validateContentfulToken?: (token: string) => Promise<void>;
 }): Promise<{
     accessToken: string;
     tokenType: string;

package/dist/hosted/oauth/refresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAoCD"}
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,MAAM,8BAA8B,GACtC,uBAAuB,GACvB,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAC;gBAEpC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,MAAM;CAKrE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAExF;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D,GACA,OAAO,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CA0CD"}

package/dist/hosted/oauth/refresh.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { isCachedContentfulTokenError, loadAndValidateContentfulToken } from './cached-cma.js';
 import { signMcpAccessToken } from './jwt.js';
 export class RefreshTokenGrantError extends Error {
     reason;
@@ -22,10 +23,15 @@ export async function completeRefreshTokenGrant(store, input) {
     if (input.resource && input.resource !== record.resource) {
         throw new RefreshTokenGrantError('refresh_resource_mismatch', 'Invalid resource.');
     }
-    const contentfulToken = await store.getContentfulToken(record.sub, input.spaceId);
-    if (!contentfulToken) {
-        await store.revokeRefreshToken(input.refreshToken);
-        throw new RefreshTokenGrantError('missing_contentful_token', 'Contentful session expired. Sign in with Contentful again.');
+    try {
+        await loadAndValidateContentfulToken(store, record.sub, input.spaceId, input.validateContentfulToken);
+    }
+    catch (error) {
+        if (isCachedContentfulTokenError(error)) {
+            await store.revokeRefreshToken(input.refreshToken);
+            throw new RefreshTokenGrantError(error.reason, error.message);
+        }
+        throw error;
     }
     await store.revokeRefreshToken(input.refreshToken);
     const newRefreshToken = randomUUID();

package/dist/hosted/oauth/refresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAS9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAMC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,IAAI,sBAAsB,CAC9B,0BAA0B,EAC1B,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/hosted/oauth/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAU9C,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,MAAM,CAAiC;IAEhD,YAAY,MAAsC,EAAE,OAAgB;QAClE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,sBAAsB,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAiB,EACjB,KAQC;IAOD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,EAAE,mCAAmC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,oBAAoB,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,mBAAmB,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,8BAA8B,CAClC,KAAK,EACL,MAAM,CAAC,GAAG,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,uBAAuB,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACnD,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,eAAe,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,KAAK,CAAC,gBAAgB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,YAAY,EAAE,eAAe;KAC9B,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/store.d.ts

@@ -48,9 +48,13 @@ export interface OAuthStore {
     }>;
     getPendingAuthRequest(authRequestId: string): Promise<PendingAuthRequest | null>;
     saveAuthCode(code: string, record: AuthCodeRecord): Promise<void>;
+    peekAuthCode(code: string): Promise<AuthCodeRecord | null>;
     consumeAuthCode(code: string): Promise<AuthCodeRecord | null>;
     storeContentfulToken(sub: string, token: string, spaceId?: string): Promise<void>;
     getContentfulToken(sub: string, spaceId?: string): Promise<string | null>;
+    /** Slide CMA TTL only after Contentful accepted the token. */
+    touchContentfulToken(sub: string, spaceId?: string): Promise<void>;
+    deleteContentfulToken(sub: string, spaceId?: string): Promise<void>;
     saveRefreshToken(token: string, record: RefreshTokenRecord): Promise<void>;
     getRefreshToken(token: string): Promise<RefreshTokenRecord | null>;
     revokeRefreshToken(token: string): Promise<void>;

package/dist/hosted/oauth/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CA6G/D"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAIlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,QAAoB,CAAC;AAG9D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAcD,MAAM,WAAW,UAAU;IACzB,mBAAmB,CAAC,KAAK,EAAE;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACjF,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC3D,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1E,8DAA8D;IAC9D,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAiI/D"}

package/dist/hosted/oauth/store.js

@@ -31,6 +31,17 @@ export function resolveOAuthSpaceId(explicit) {
 export function refreshTokenKey(token) {
     return `cms-edit:oauth:refresh:${token}`;
 }
+function authCodeKey(code) {
+    return `cms-edit:oauth:code:${code}`;
+}
+function parseAuthCodeRecord(raw) {
+    if (!raw)
+        return null;
+    if (typeof raw === 'string') {
+        return JSON.parse(raw);
+    }
+    return raw;
+}
 export function createOAuthStore(redis) {
     return {
         async registerOAuthClient(input) {
@@ -69,20 +80,20 @@ export function createOAuthStore(redis) {
             return raw;
         },
         async saveAuthCode(code, record) {
-            await redis.set(`cms-edit:oauth:code:${code}`, JSON.stringify(record), {
+            await redis.set(authCodeKey(code), JSON.stringify(record), {
                 ex: AUTH_CODE_TTL_SECONDS,
             });
         },
+        async peekAuthCode(code) {
+            return parseAuthCodeRecord(await redis.get(authCodeKey(code)));
+        },
         async consumeAuthCode(code) {
-            const key = `cms-edit:oauth:code:${code}`;
+            const key = authCodeKey(code);
             const raw = await redis.get(key);
             if (!raw)
                 return null;
             await redis.del(key);
-            if (typeof raw === 'string') {
-                return JSON.parse(raw);
-            }
-            return raw;
+            return parseAuthCodeRecord(raw);
         },
         async storeContentfulToken(sub, token, spaceId) {
             const resolved = resolveOAuthSpaceId(spaceId);
@@ -100,8 +111,6 @@ export function createOAuthStore(redis) {
             const key = contentfulTokenKey(sub, resolved);
             const token = await redis.get(key);
             if (typeof token === 'string' && token.length > 0) {
-                // Sliding TTL: active MCP use keeps the Contentful link alive across deploys.
-                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
                 return token;
             }
             // Soft cutover: pre-3.4.5 unscoped tokens (same Redis / shared cmsedit-sessions).
@@ -113,6 +122,25 @@ export function createOAuthStore(redis) {
             }
             return null;
         },
+        async touchContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            if (!resolved) {
+                return;
+            }
+            const key = contentfulTokenKey(sub, resolved);
+            const token = await redis.get(key);
+            if (typeof token === 'string' && token.length > 0) {
+                await redis.expire(key, CONTENTFUL_TOKEN_TTL_SECONDS);
+            }
+        },
+        async deleteContentfulToken(sub, spaceId) {
+            const resolved = resolveOAuthSpaceId(spaceId);
+            const keys = [legacyContentfulTokenKey(sub)];
+            if (resolved) {
+                keys.unshift(contentfulTokenKey(sub, resolved));
+            }
+            await Promise.all(keys.map((key) => redis.del(key)));
+        },
         async saveRefreshToken(token, record) {
             await redis.set(refreshTokenKey(token), JSON.stringify(record), {
                 ex: REFRESH_TOKEN_TTL_SECONDS,

package/dist/hosted/oauth/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AA2B/D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAe;IAC7D,OAAO,uBAAuB,GAAG,IAAI,OAAO,mBAAmB,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,uBAAuB,GAAG,mBAAmB,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,0BAA0B,KAAK,EAAE,CAAC;AAC3C,CAAC;AAmBD,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAA4B;gBACtC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YACpD,CAAC;YACD,OAAO,GAA8B,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,OAAO;YAClC,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBAClF,EAAE,EAAE,wBAAwB;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,aAAa;YACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACrE,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,GAAG,GAAG,uBAAuB,IAAI,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;YAC3C,CAAC;YACD,OAAO,GAAqB,CAAC;QAC/B,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO;YACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,8EAA8E;gBAC9E,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;gBACtD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kFAAkF;YAClF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC9D,EAAE,EAAE,yBAAyB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosted/oauth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9D,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AA2B/D;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAe;IAC7D,OAAO,uBAAuB,GAAG,IAAI,OAAO,mBAAmB,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,uBAAuB,GAAG,mBAAmB,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAiB;IACnD,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,0BAA0B,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,uBAAuB,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC3C,CAAC;IACD,OAAO,GAAqB,CAAC;AAC/B,CAAC;AAuBD,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAAK;YAC7B,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,MAAM,GAA4B;gBACtC,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;YACF,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7E,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,QAAQ;YAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;YACpD,CAAC;YACD,OAAO,GAA8B,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,OAAO;YAClC,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;gBAClF,EAAE,EAAE,wBAAwB;aAC7B,CAAC,CAAC;YACH,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,aAAa;YACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM;YAC7B,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBACzD,EAAE,EAAE,qBAAqB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI;YACrB,OAAO,mBAAmB,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO;YAC5C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO;YACnC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,kFAAkF;YAClF,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,4BAA4B,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO;YACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO;YACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM;YAClC,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;gBAC9D,EAAE,EAAE,yBAAyB;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,KAAK;YACzB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAC/C,CAAC;YACD,OAAO,GAAyB,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC5B,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hosted/oauth/token-grant-response.d.ts

@@ -0,0 +1,7 @@
+export type TokenGrantRoute = 'authorization-code' | 'refresh-token';
+/**
+ * Map token-endpoint failures: invalid CMA / grant errors → 400 invalid_grant;
+ * Contentful 5xx / unclassified PAT errors → 503 so clients retry.
+ */
+export declare function oauthTokenGrantFailureResponse(error: unknown, route: TokenGrantRoute): Response;
+//# sourceMappingURL=token-grant-response.d.ts.map

package/dist/hosted/oauth/token-grant-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-grant-response.d.ts","sourceRoot":"","sources":["../../../src/hosted/oauth/token-grant-response.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,eAAe,CAAC;AAErE;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,GAAG,QAAQ,CAgC/F"}

package/dist/hosted/oauth/token-grant-response.js

@@ -0,0 +1,34 @@
+import { recordOAuthTelemetryFailure } from '../../telemetry/index.js';
+import { isCachedContentfulTokenError } from './cached-cma.js';
+import { authorizationCodeGrantFailureReason, isTransientContentfulFailure, oauthLogAuthFailure, patValidationFailureReason, } from './log.js';
+import { isRefreshTokenGrantError } from './refresh.js';
+/**
+ * Map token-endpoint failures: invalid CMA / grant errors → 400 invalid_grant;
+ * Contentful 5xx / unclassified PAT errors → 503 so clients retry.
+ */
+export function oauthTokenGrantFailureResponse(error, route) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (isCachedContentfulTokenError(error)) {
+        oauthLogAuthFailure(route, error.reason);
+        recordOAuthTelemetryFailure(route, error.reason);
+        return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+    }
+    if (isRefreshTokenGrantError(error)) {
+        oauthLogAuthFailure(route, error.reason);
+        recordOAuthTelemetryFailure(route, error.reason);
+        return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+    }
+    const patReason = patValidationFailureReason(message);
+    if (isTransientContentfulFailure(patReason)) {
+        oauthLogAuthFailure(route, patReason);
+        recordOAuthTelemetryFailure(route, patReason);
+        return Response.json({ error: 'temporarily_unavailable', error_description: message }, { status: 503 });
+    }
+    const reason = route === 'authorization-code'
+        ? authorizationCodeGrantFailureReason(message)
+        : 'refresh_token_grant_failed';
+    oauthLogAuthFailure(route, reason);
+    recordOAuthTelemetryFailure(route, reason);
+    return Response.json({ error: 'invalid_grant', error_description: message }, { status: 400 });
+}
+//# sourceMappingURL=token-grant-response.js.map

package/dist/hosted/oauth/token-grant-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-grant-response.js","sourceRoot":"","sources":["../../../src/hosted/oauth/token-grant-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAIxD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc,EAAE,KAAsB;IACnF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvE,IAAI,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,SAAS,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACtC,2BAA2B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAChE,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,KAAK,KAAK,oBAAoB;QAC5B,CAAC,CAAC,mCAAmC,CAAC,OAAO,CAAC;QAC9C,CAAC,CAAC,4BAA4B,CAAC;IACnC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAChG,CAAC"}

package/docs/mcp/hosted-guide.md

@@ -304,7 +304,7 @@ OAuth is two steps: Grok obtains an MCP token, then you sign in with Contentful
 
 | Problem | What to do |
 |---------|------------|
-| **401 / connection failed** | Reconnect: Claude → Settings → Integrations, or Grok `/mcps` → press `i`. Complete Contentful sign-in. If Grok says “Failed to get tools after auth”, the MCP JWT refreshed but the Contentful cache was gone — delete that server’s entry from `~/.grok/mcp_credentials.json` and press `i` again so the browser opens Contentful. On Vercel, search `[cms-edit:oauth] auth_failure` (`reason=missing_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |
+| **401 / connection failed** | Reconnect: Claude → Settings → Integrations, or Grok `/mcps` → press `i`. Complete Contentful sign-in. If Grok says “Failed to get tools after auth” or `auth required`, the MCP JWT refreshed but Contentful rejected (or never had) the CMA cache. cms-edit **3.5.3+** returns `invalid_token` and refuses refresh so Grok re-runs Contentful sign-in. If it still loops, delete that server’s entry from `~/.grok/mcp_credentials.json` and press `i` again. On Vercel, search `[cms-edit:oauth] auth_failure` (`missing_contentful_token` or `invalid_contentful_token`). Set `LOG_CMS_OAUTH=1` for connect success traces. |
 | **No cms_edit tool** | Confirm the integration is connected under Settings → Integrations |
 | **No active session** | Do not pass `--space` on hosted. Check `/api/health` — `redis` must be ok. MCP uses `_mcp` session automatically. Manual session: `["--session", "name", "open", "--page-slug", "/"]`. Fallback: `["read", "<entry-id>", "--id"]` |
 | **Wrong space** | Your Contentful account must have access to this deployment's space |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/contentful-cms",
-  "version": "3.5.2",
+  "version": "3.5.3",
   "description": "CLI tool for AI agents to read and edit Contentful draft content without publish permissions",
   "repository": {
     "type": "git",

package/skills/setup/SKILL.md

@@ -86,8 +86,8 @@ Do **not** register a local `mcpServers.cms-edit` entry in Claude Desktop — us
 **OAuth / sign-in fails**
 → Confirm the user was invited to the Contentful space and is signing in with the correct account. In Grok, use `/mcps` → press `i` (not just toggle). Confirm config URL ends with `/api/mcp`.
 
-**Grok: Failed to get tools after auth**
-→ MCP refresh succeeded but the host has no Contentful token for that space. Delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in. Current cms-edit refuses refresh without a CMA cache so this loop should stop after the host is bumped.
+**Grok: Failed to get tools after auth / auth required**
+→ MCP refresh succeeded but the CMA cache is missing **or Contentful rejected it**. cms-edit **3.5.3+** deletes the dead cache and returns `invalid_token` so Grok re-runs Contentful sign-in. If it still loops, delete the server’s entry in `~/.grok/mcp_credentials.json`, then `/mcps` → `i` and complete Contentful sign-in.
 
 **Grok browser flashes and closes**
 → Usually a redirect_uri mismatch before cms-edit v2.7.7+; upgrade the hosted deployment and retry OAuth.