mcp-creatio 0.3.6

package/dist/server/oauth/oauth-server.js

@@ -0,0 +1,146 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthServer = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const log_1 = __importDefault(require("../../log"));
+const client_manager_1 = require("./client-manager");
+const storage_1 = require("./storage");
+const token_manager_1 = require("./token-manager");
+const validators_1 = require("./validators");
+class OAuthServer {
+    _jwtSecret = crypto_1.default.randomBytes(32).toString('hex');
+    _storage = new storage_1.OAuthStorage();
+    _tokenManager;
+    _accessTokens = new Map();
+    _baseUrl;
+    constructor(baseUrl = 'http://localhost:3000') {
+        this._baseUrl = baseUrl;
+        this._tokenManager = new token_manager_1.OAuthTokenManager(this._jwtSecret);
+    }
+    _autoRegisterClientIfNeeded(client_id, redirect_uri) {
+        if (this._storage.hasClient(client_id)) {
+            return false;
+        }
+        const client = client_manager_1.OAuthClientManager.autoRegisterClient(client_id, redirect_uri);
+        this._storage.addClient(client);
+        return true;
+    }
+    getAuthorizationServerMetadata() {
+        return {
+            issuer: this._baseUrl,
+            authorization_endpoint: `${this._baseUrl}/authorize`,
+            token_endpoint: `${this._baseUrl}/token`,
+            registration_endpoint: `${this._baseUrl}/register`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
+            code_challenge_methods_supported: ['S256'],
+            scopes_supported: ['openid'],
+        };
+    }
+    registerClient(redirect_uris) {
+        const client = client_manager_1.OAuthClientManager.createClient(redirect_uris);
+        this._storage.addClient(client);
+        return client;
+    }
+    validateAuthorizationRequest(params) {
+        let client = this._storage.getClient(params.client_id);
+        if (!client) {
+            const wasRegistered = this._autoRegisterClientIfNeeded(params.client_id, params.redirect_uri);
+            if (wasRegistered) {
+                client = this._storage.getClient(params.client_id);
+            }
+        }
+        return validators_1.OAuthValidators.validateAuthorizationRequest(params, client);
+    }
+    storeState(state, client_id) {
+        this._storage.storeState(state, client_id);
+        log_1.default.info('oauth.state.stored', { state, client_id });
+    }
+    validateState(state, client_id) {
+        log_1.default.info('oauth.state.validate_attempt', {
+            state,
+            client_id,
+            storedStates: this._storage.getAllStates(),
+        });
+        const stateData = this._storage.getState(state);
+        if (!stateData) {
+            log_1.default.warn('oauth.state.not_found', {
+                state,
+                storedStates: this._storage.getAllStates(),
+            });
+            return false;
+        }
+        if (stateData.expires_at < Date.now()) {
+            this._storage.deleteState(state);
+            log_1.default.warn('oauth.state.expired', { state });
+            return false;
+        }
+        if (stateData.client_id !== client_id) {
+            log_1.default.warn('oauth.state.client_mismatch', {
+                state,
+                expected: stateData.client_id,
+                actual: client_id,
+            });
+            return false;
+        }
+        this._storage.deleteState(state);
+        log_1.default.info('oauth.state.validated_successfully', { state, client_id });
+        return true;
+    }
+    generateAuthorizationCode(client_id, redirect_uri, code_challenge, code_challenge_method, userKey) {
+        const code = crypto_1.default.randomBytes(32).toString('base64url');
+        this._storage.storeAuthorizationCode(code, client_id, redirect_uri, code_challenge, code_challenge_method, userKey);
+        log_1.default.info('oauth.authorization_code.generated', { client_id, userKey });
+        return code;
+    }
+    async exchangeCodeForToken(params) {
+        log_1.default.info('oauth.token.exchange_start', {
+            grant_type: params.grant_type,
+            code: params.code ? '***' + params.code.slice(-4) : 'missing',
+            client_id: params.client_id,
+            redirect_uri: params.redirect_uri,
+            has_code_verifier: !!params.code_verifier,
+            stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
+        });
+        const validationError = validators_1.OAuthValidators.validateTokenRequest(params);
+        if (validationError) {
+            return validationError;
+        }
+        const authCode = this._storage.getAuthorizationCode(params.code);
+        if (!authCode) {
+            log_1.default.error('oauth.token.code_not_found', {
+                code: '***' + params.code.slice(-4),
+                stored_codes: this._storage.getAllStoredCodes().map((k) => '***' + k.slice(-4)),
+            });
+            return { error: 'invalid_grant', error_description: 'Invalid authorization code' };
+        }
+        const codeValidationError = this._tokenManager.validateAuthCodeData(authCode, params);
+        if (codeValidationError) {
+            if (codeValidationError.error === 'invalid_grant' &&
+                codeValidationError.error_description === 'Authorization code expired') {
+                this._storage.deleteAuthorizationCode(params.code);
+            }
+            return codeValidationError;
+        }
+        const tokenResponse = this._tokenManager.createTokenResponse(authCode.userKey, params.client_id);
+        this._accessTokens.set(tokenResponse.access_token, tokenResponse);
+        this._storage.deleteAuthorizationCode(params.code);
+        log_1.default.info('oauth.token.issued', { client_id: params.client_id, userKey: authCode.userKey });
+        return tokenResponse;
+    }
+    validateAccessToken(token) {
+        return this._tokenManager.validateAccessToken(token);
+    }
+    getClient(client_id) {
+        return this._storage.getClient(client_id);
+    }
+    cleanup() {
+        this._storage.cleanup();
+    }
+}
+exports.OAuthServer = OAuthServer;
+//# sourceMappingURL=oauth-server.js.map

package/dist/server/oauth/oauth-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-server.js","sourceRoot":"","sources":["../../../src/server/oauth/oauth-server.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,oDAA4B;AAE5B,qDAAsD;AACtD,uCAAyC;AACzC,mDAAoD;AACpD,6CAA+C;AAW/C,MAAa,WAAW;IACN,UAAU,GAAW,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,QAAQ,GAAG,IAAI,sBAAY,EAAE,CAAC;IAC9B,aAAa,CAAoB;IACjC,aAAa,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,QAAQ,CAAS;IAEzB,YAAY,UAAkB,uBAAuB;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,iCAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAEO,2BAA2B,CAAC,SAAiB,EAAE,YAAoB;QAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,mCAAkB,CAAC,kBAAkB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,8BAA8B;QACpC,OAAO;YACN,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,sBAAsB,EAAE,GAAG,IAAI,CAAC,QAAQ,YAAY;YACpD,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,QAAQ;YACxC,qBAAqB,EAAE,GAAG,IAAI,CAAC,QAAQ,WAAW;YAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;YAC7C,qCAAqC,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;YACrE,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,gBAAgB,EAAE,CAAC,QAAQ,CAAC;SAC5B,CAAC;IACH,CAAC;IAEM,cAAc,CAAC,aAAuB;QAC5C,MAAM,MAAM,GAAG,mCAAkB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC;IACf,CAAC;IAEM,4BAA4B,CAAC,MAAiC;QACpE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,aAAa,GAAG,IAAI,CAAC,2BAA2B,CACrD,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,CACnB,CAAC;YACF,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACpD,CAAC;QACF,CAAC;QACD,OAAO,4BAAe,CAAC,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IAEM,UAAU,CAAC,KAAa,EAAE,SAAiB;QACjD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IAEM,aAAa,CAAC,KAAa,EAAE,SAAiB;QACpD,aAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;YACxC,KAAK;YACL,SAAS;YACT,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;SAC1C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,aAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACjC,KAAK;gBACL,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvC,aAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACvC,KAAK;gBACL,QAAQ,EAAE,SAAS,CAAC,SAAS;gBAC7B,MAAM,EAAE,SAAS;aACjB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,aAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,yBAAyB,CAC/B,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe;QAEf,MAAM,IAAI,GAAG,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CACnC,IAAI,EACJ,SAAS,EACT,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,OAAO,CACP,CAAC;QACF,aAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAChC,MAAyB;QAEzB,aAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE;YACtC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa;YACzC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/E,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,4BAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,eAAe,EAAE,CAAC;YACrB,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,aAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACvC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACpC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/E,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,mBAAmB,EAAE,CAAC;YACzB,IACC,mBAAmB,CAAC,KAAK,KAAK,eAAe;gBAC7C,mBAAmB,CAAC,iBAAiB,KAAK,4BAA4B,EACrE,CAAC;gBACF,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,mBAAmB,CAAC;QAC5B,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAC3D,QAAQ,CAAC,OAAO,EAChB,MAAM,CAAC,SAAS,CAChB,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QACpD,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,OAAO,aAAa,CAAC;IACtB,CAAC;IAEM,mBAAmB,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;CACD;AAtKD,kCAsKC"}

package/dist/server/oauth/storage.d.ts

@@ -0,0 +1,31 @@
+import type { OAuthClient } from './types';
+export interface AuthorizationCodeData {
+    client_id: string;
+    redirect_uri: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    userKey: string;
+    expires_at: number;
+}
+export interface StateData {
+    client_id: string;
+    expires_at: number;
+}
+export declare class OAuthStorage {
+    private readonly _clients;
+    private readonly _authorizationCodes;
+    private readonly _authorizationStates;
+    addClient(client: OAuthClient): void;
+    getClient(client_id: string): OAuthClient | undefined;
+    hasClient(client_id: string): boolean;
+    storeAuthorizationCode(code: string, client_id: string, redirect_uri: string, code_challenge: string, code_challenge_method: string, userKey: string, expiresInMs?: number): void;
+    getAuthorizationCode(code: string): AuthorizationCodeData | undefined;
+    deleteAuthorizationCode(code: string): void;
+    storeState(state: string, client_id: string, expiresInMs?: number): void;
+    getState(state: string): StateData | undefined;
+    deleteState(state: string): void;
+    getAllStates(): string[];
+    getAllStoredCodes(): string[];
+    cleanup(): void;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/server/oauth/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,YAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA4C;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAgC;IAE9D,SAAS,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAIpC,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIrD,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAIrC,sBAAsB,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,qBAAqB,EAAE,MAAM,EAC7B,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,MAAuB,GAClC,IAAI;IAYA,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS;IAIrE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAI3C,UAAU,CAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,MAAuB,GAClC,IAAI;IAKA,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAI9C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIhC,YAAY,IAAI,MAAM,EAAE;IAIxB,iBAAiB,IAAI,MAAM,EAAE;IAI7B,OAAO,IAAI,IAAI;CAiBtB"}

package/dist/server/oauth/storage.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthStorage = void 0;
+const log_1 = __importDefault(require("../../log"));
+class OAuthStorage {
+    _clients = new Map();
+    _authorizationCodes = new Map();
+    _authorizationStates = new Map();
+    addClient(client) {
+        this._clients.set(client.client_id, client);
+    }
+    getClient(client_id) {
+        return this._clients.get(client_id);
+    }
+    hasClient(client_id) {
+        return this._clients.has(client_id);
+    }
+    storeAuthorizationCode(code, client_id, redirect_uri, code_challenge, code_challenge_method, userKey, expiresInMs = 10 * 60 * 1000) {
+        const expires_at = Date.now() + expiresInMs;
+        this._authorizationCodes.set(code, {
+            client_id,
+            redirect_uri,
+            code_challenge,
+            code_challenge_method,
+            userKey,
+            expires_at,
+        });
+    }
+    getAuthorizationCode(code) {
+        return this._authorizationCodes.get(code);
+    }
+    deleteAuthorizationCode(code) {
+        this._authorizationCodes.delete(code);
+    }
+    storeState(state, client_id, expiresInMs = 30 * 60 * 1000) {
+        const expires_at = Date.now() + expiresInMs;
+        this._authorizationStates.set(state, { client_id, expires_at });
+    }
+    getState(state) {
+        return this._authorizationStates.get(state);
+    }
+    deleteState(state) {
+        this._authorizationStates.delete(state);
+    }
+    getAllStates() {
+        return Array.from(this._authorizationStates.keys());
+    }
+    getAllStoredCodes() {
+        return Array.from(this._authorizationCodes.keys());
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [code, data] of this._authorizationCodes.entries()) {
+            if (now > data.expires_at) {
+                this._authorizationCodes.delete(code);
+            }
+        }
+        for (const [state, data] of this._authorizationStates.entries()) {
+            if (now > data.expires_at) {
+                this._authorizationStates.delete(state);
+            }
+        }
+        log_1.default.info('oauth.storage.cleanup.completed', {
+            remaining_codes: this._authorizationCodes.size,
+            remaining_states: this._authorizationStates.size,
+        });
+    }
+}
+exports.OAuthStorage = OAuthStorage;
+//# sourceMappingURL=storage.js.map

package/dist/server/oauth/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../../src/server/oauth/storage.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAkB5B,MAAa,YAAY;IACP,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,mBAAmB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE9D,SAAS,CAAC,MAAmB;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAEM,sBAAsB,CAC5B,IAAY,EACZ,SAAiB,EACjB,YAAoB,EACpB,cAAsB,EACtB,qBAA6B,EAC7B,OAAe,EACf,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE;YAClC,SAAS;YACT,YAAY;YACZ,cAAc;YACd,qBAAqB;YACrB,OAAO;YACP,UAAU;SACV,CAAC,CAAC;IACJ,CAAC;IAEM,oBAAoB,CAAC,IAAY;QACvC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,uBAAuB,CAAC,IAAY;QAC1C,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAEM,UAAU,CAChB,KAAa,EACb,SAAiB,EACjB,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI;QAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IAEM,QAAQ,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAEM,WAAW,CAAC,KAAa;QAC/B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEM,YAAY;QAClB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAEM,iBAAiB;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAEM,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/D,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACF,CAAC;QACD,aAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,IAAI;YAC9C,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI;SAChD,CAAC,CAAC;IACJ,CAAC;CACD;AAvFD,oCAuFC"}

package/dist/server/oauth/token-manager.d.ts

@@ -0,0 +1,13 @@
+import type { AuthorizationCodeData } from './storage';
+import type { OAuthAccessToken, OAuthError, OAuthTokenRequest } from './types';
+export declare class OAuthTokenManager {
+    private readonly _jwtSecret;
+    constructor(jwtSecret: string);
+    generateAccessToken(userKey: string, client_id: string): string;
+    generateRefreshToken(): string;
+    validateAccessToken(token: string): string | null;
+    createTokenResponse(userKey: string, client_id: string, refresh_token_required?: boolean): OAuthAccessToken;
+    verifyPKCE(code_verifier: string, code_challenge: string): boolean;
+    validateAuthCodeData(authCode: AuthorizationCodeData, params: OAuthTokenRequest): OAuthError | null;
+}
+//# sourceMappingURL=token-manager.d.ts.map

package/dist/server/oauth/token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE/E,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,SAAS,EAAE,MAAM;IAItB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAI/D,oBAAoB,IAAI,MAAM;IAI9B,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAUjD,mBAAmB,CACzB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,sBAAsB,GAAE,OAAc,GACpC,gBAAgB;IAeZ,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO;IAKlE,oBAAoB,CAC1B,QAAQ,EAAE,qBAAqB,EAC/B,MAAM,EAAE,iBAAiB,GACvB,UAAU,GAAG,IAAI;CAkBpB"}

package/dist/server/oauth/token-manager.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTokenManager = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const log_1 = __importDefault(require("../../log"));
+class OAuthTokenManager {
+    _jwtSecret;
+    constructor(jwtSecret) {
+        this._jwtSecret = jwtSecret;
+    }
+    generateAccessToken(userKey, client_id) {
+        return jsonwebtoken_1.default.sign({ userKey, client_id }, this._jwtSecret, { expiresIn: '1h' });
+    }
+    generateRefreshToken() {
+        return crypto_1.default.randomBytes(32).toString('base64url');
+    }
+    validateAccessToken(token) {
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, this._jwtSecret);
+            return decoded.userKey || null;
+        }
+        catch (error) {
+            log_1.default.warn('oauth.token.invalid', { error: String(error) });
+            return null;
+        }
+    }
+    createTokenResponse(userKey, client_id, refresh_token_required = true) {
+        const access_token = this.generateAccessToken(userKey, client_id);
+        const expires_in = 3600;
+        const tokenResponse = {
+            access_token,
+            token_type: 'Bearer',
+            expires_in,
+            userKey,
+        };
+        if (refresh_token_required) {
+            tokenResponse.refresh_token = this.generateRefreshToken();
+        }
+        return tokenResponse;
+    }
+    verifyPKCE(code_verifier, code_challenge) {
+        const hash = crypto_1.default.createHash('sha256').update(code_verifier).digest('base64url');
+        return hash === code_challenge;
+    }
+    validateAuthCodeData(authCode, params) {
+        if (Date.now() > authCode.expires_at) {
+            return { error: 'invalid_grant', error_description: 'Authorization code expired' };
+        }
+        if (authCode.client_id !== params.client_id) {
+            return { error: 'invalid_grant', error_description: 'Client mismatch' };
+        }
+        if (authCode.redirect_uri !== params.redirect_uri) {
+            return { error: 'invalid_grant', error_description: 'Redirect URI mismatch' };
+        }
+        if (!params.code_verifier) {
+            return { error: 'invalid_request', error_description: 'Missing code_verifier' };
+        }
+        if (!this.verifyPKCE(params.code_verifier, authCode.code_challenge)) {
+            return { error: 'invalid_grant', error_description: 'PKCE verification failed' };
+        }
+        return null;
+    }
+}
+exports.OAuthTokenManager = OAuthTokenManager;
+//# sourceMappingURL=token-manager.js.map

package/dist/server/oauth/token-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.js","sourceRoot":"","sources":["../../../src/server/oauth/token-manager.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAE5B,gEAA+B;AAE/B,oDAA4B;AAK5B,MAAa,iBAAiB;IACZ,UAAU,CAAS;IAEpC,YAAY,SAAiB;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEM,mBAAmB,CAAC,OAAe,EAAE,SAAiB;QAC5D,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEM,oBAAoB;QAC1B,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAEM,mBAAmB,CAAC,KAAa;QACvC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAQ,CAAC;YAC1D,OAAO,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEM,mBAAmB,CACzB,OAAe,EACf,SAAiB,EACjB,yBAAkC,IAAI;QAEtC,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC;QACxB,MAAM,aAAa,GAAqB;YACvC,YAAY;YACZ,UAAU,EAAE,QAAQ;YACpB,UAAU;YACV,OAAO;SACP,CAAC;QACF,IAAI,sBAAsB,EAAE,CAAC;YAC5B,aAAa,CAAC,aAAa,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,aAAa,CAAC;IACtB,CAAC;IAEM,UAAU,CAAC,aAAqB,EAAE,cAAsB;QAC9D,MAAM,IAAI,GAAG,gBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnF,OAAO,IAAI,KAAK,cAAc,CAAC;IAChC,CAAC;IAEM,oBAAoB,CAC1B,QAA+B,EAC/B,MAAyB;QAEzB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAtED,8CAsEC"}

package/dist/server/oauth/types.d.ts

@@ -0,0 +1,51 @@
+export interface OAuthClient {
+    client_id: string;
+    client_secret?: string;
+    redirect_uris: string[];
+    grant_types: string[];
+    response_types?: string[];
+    token_endpoint_auth_method?: string;
+    created_at: number;
+}
+export interface OAuthAuthorizationRequest {
+    client_id: string;
+    redirect_uri: string;
+    response_type: string;
+    state?: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    scope?: string;
+}
+export interface OAuthTokenRequest {
+    grant_type: string;
+    client_id: string;
+    code?: string;
+    redirect_uri?: string;
+    code_verifier?: string;
+    refresh_token?: string;
+}
+export interface OAuthAccessToken {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope?: string;
+    userKey: string;
+}
+export interface OAuthError {
+    error: string;
+    error_description?: string;
+    error_uri?: string;
+}
+export interface OAuthAuthorizationServerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    registration_endpoint: string;
+    response_types_supported: string[];
+    grant_types_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    code_challenge_methods_supported: string[];
+    scopes_supported?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/oauth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,qCAAqC,EAAE,MAAM,EAAE,CAAC;IAChD,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/server/oauth/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/server/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/server/oauth/types.ts"],"names":[],"mappings":""}

package/dist/server/oauth/validators.d.ts

@@ -0,0 +1,7 @@
+import type { OAuthAuthorizationRequest, OAuthClient, OAuthError, OAuthTokenRequest } from './types';
+export declare class OAuthValidators {
+    static validateAuthorizationRequest(params: OAuthAuthorizationRequest, client: OAuthClient | undefined): OAuthError | null;
+    static validateTokenRequest(params: OAuthTokenRequest): OAuthError | null;
+    static validateClientRegistration(redirect_uris: unknown): string | null;
+}
+//# sourceMappingURL=validators.d.ts.map

package/dist/server/oauth/validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,MAAM,SAAS,CAAC;AACjB,qBAAa,eAAe;WACb,4BAA4B,CACzC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,WAAW,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI;WAgBN,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,UAAU,GAAG,IAAI;WAUlE,0BAA0B,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;CAmB/E"}

package/dist/server/oauth/validators.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthValidators = void 0;
+class OAuthValidators {
+    static validateAuthorizationRequest(params, client) {
+        if (!client) {
+            return { error: 'invalid_client', error_description: 'Client not found' };
+        }
+        if (!client.redirect_uris.includes(params.redirect_uri)) {
+            return { error: 'invalid_request', error_description: 'Invalid redirect_uri' };
+        }
+        if (params.response_type !== 'code') {
+            return { error: 'unsupported_response_type' };
+        }
+        if (!params.code_challenge || params.code_challenge_method !== 'S256') {
+            return { error: 'invalid_request', error_description: 'PKCE required' };
+        }
+        return null;
+    }
+    static validateTokenRequest(params) {
+        if (params.grant_type !== 'authorization_code') {
+            return { error: 'unsupported_grant_type' };
+        }
+        if (!params.code || !params.code_verifier) {
+            return { error: 'invalid_request', error_description: 'Missing code or code_verifier' };
+        }
+        return null;
+    }
+    static validateClientRegistration(redirect_uris) {
+        if (!redirect_uris || !Array.isArray(redirect_uris)) {
+            return 'redirect_uris is required and must be an array';
+        }
+        if (redirect_uris.length === 0) {
+            return 'redirect_uris must contain at least one URI';
+        }
+        for (const uri of redirect_uris) {
+            if (typeof uri !== 'string') {
+                return 'All redirect_uris must be strings';
+            }
+            try {
+                new URL(uri);
+            }
+            catch {
+                return `Invalid redirect_uri: ${uri}`;
+            }
+        }
+        return null;
+    }
+}
+exports.OAuthValidators = OAuthValidators;
+//# sourceMappingURL=validators.js.map

package/dist/server/oauth/validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":";;;AAMA,MAAa,eAAe;IACpB,MAAM,CAAC,4BAA4B,CACzC,MAAiC,EACjC,MAA+B;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,MAAyB;QAC3D,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,0BAA0B,CAAC,aAAsB;QAC9D,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,gDAAgD,CAAC;QACzD,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,6CAA6C,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,mCAAmC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC;gBACJ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,yBAAyB,GAAG,EAAE,CAAC;YACvC,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AAjDD,0CAiDC"}

package/dist/services/index.d.ts

@@ -0,0 +1,3 @@
+export * from './session-context';
+export * from './token-refresh-scheduler';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC"}

package/dist/services/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./session-context"), exports);
+__exportStar(require("./token-refresh-scheduler"), exports);
+//# sourceMappingURL=index.js.map

package/dist/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4DAA0C"}

package/dist/services/session-context.d.ts

@@ -0,0 +1,57 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+export interface SessionInfo {
+    id: string;
+    userKey?: string | undefined;
+    transport?: StreamableHTTPServerTransport | undefined;
+    isLogged: boolean;
+    createdAt: Date;
+    remoteIp?: string | undefined;
+}
+export interface UserTokens {
+    accessToken: string;
+    accessTokenExpiryMs: number;
+    refreshToken?: string | undefined;
+}
+export interface OAuthState {
+    userKey: string;
+    createdAt: number;
+    expiresAt: number;
+}
+export declare class SessionContext {
+    private static _instance;
+    private readonly _sessions;
+    private readonly _userTokens;
+    private readonly _oauthStates;
+    private readonly _deletingSessions;
+    static get instance(): SessionContext;
+    private _generateState;
+    createSession(sessionId: string, userKey?: string, remoteIp?: string): SessionInfo;
+    getSession(sessionId: string): SessionInfo | undefined;
+    hasSession(sessionId: string): boolean;
+    markSessionAsLogged(sessionId: string): boolean;
+    setSessionTransport(sessionId: string, transport: StreamableHTTPServerTransport): void;
+    mapSessionToUser(sessionId: string, userKey: string): void;
+    deleteSession(sessionId: string): void;
+    getAllSessions(): SessionInfo[];
+    getSessionsForUser(userKey: string): SessionInfo[];
+    getTokensForSession(sessionId: string): Promise<UserTokens | null>;
+    getTokensForUser(userKey: string): Promise<UserTokens | null>;
+    setTokensForUser(userKey: string, tokens: UserTokens): Promise<void>;
+    deleteTokensForUser(userKey: string): Promise<void>;
+    createOAuthState(userKey: string): string;
+    validateOAuthState(state: string): {
+        userKey: string;
+    } | null;
+    validateAndConsumeOAuthState(state: string): string | undefined;
+    setSessionUserKey(sessionId: string, userKey: string): void;
+    cleanupExpiredOAuthStates(): void;
+    getEffectiveTokens(sessionId?: string, userKey?: string): Promise<UserTokens | null>;
+    createSessionWithUser(sessionId: string, userKey: string, remoteIp?: string): Promise<SessionInfo>;
+    mapAllSessionsToUser(userKey: string): void;
+    getStats(): {
+        sessionsCount: number;
+        tokensCount: number;
+        oauthStatesCount: number;
+    };
+}
+//# sourceMappingURL=session-context.d.ts.map

package/dist/services/session-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../src/services/session-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,cAAc;IAC1B,OAAO,CAAC,MAAM,CAAC,SAAS,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IAEvD,WAAkB,QAAQ,IAAI,cAAc,CAK3C;IAED,OAAO,CAAC,cAAc;IAOf,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW;IAgBlF,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAItD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAS/C,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,6BAA6B,GAAG,IAAI;IAOtF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ1D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAiBtC,cAAc,IAAI,WAAW,EAAE;IAI/B,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE;IAI5C,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQlE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAWzC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;QACzC,OAAO,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI;IAaD,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAK/D,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ3D,yBAAyB,IAAI,IAAI;IAS3B,kBAAkB,CAC9B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAUhB,qBAAqB,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC;IAKhB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAe3C,QAAQ,IAAI;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE;CAO3F"}