mcp-creatio 0.6.2 → 0.6.3

package/dist/config-builder.js

@@ -1,64 +1,145 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getTokenStoreConfig = getTokenStoreConfig;
 exports.getCreatioClientConfig = getCreatioClientConfig;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const creatio_1 = require("./creatio");
+const log_1 = __importDefault(require("./log"));
 const utils_1 = require("./utils");
-function getCreatioClientAuthConfig() {
-    const codeConf = _getOAuth2CodeAuthConfig();
-    if (codeConf) {
-        return codeConf;
+/**
+ * The single user-facing auth selector (`CREATIO_MCP_AUTH_MODE`). When unset it is INFERRED from
+ * the supplied credentials (see {@link resolveAuthConfig}); `delegated`/`gateway` need none.
+ */
+const AUTH_MODES = ['delegated', 'gateway', 'broker', 'client_credentials', 'legacy'];
+const MISSING_CLIENT_CREDENTIALS = 'client_credentials auth requires CREATIO_CLIENT_ID and CREATIO_CLIENT_SECRET';
+const MISSING_LEGACY = 'legacy auth requires CREATIO_LOGIN and CREATIO_PASSWORD';
+const MISSING_BROKER = 'broker auth requires CREATIO_CLIENT_ID';
+function readExplicitMode() {
+    const raw = (0, utils_1.env)('CREATIO_MCP_AUTH_MODE')?.toLowerCase();
+    if (!raw) {
+        return undefined;
     }
-    const oauth2Conf = _getOAuth2AuthConfig();
-    if (oauth2Conf) {
-        return oauth2Conf;
+    if (AUTH_MODES.includes(raw)) {
+        return raw;
     }
-    const legacyConf = _getLegacyAuthConfig();
-    if (legacyConf) {
-        return legacyConf;
+    throw new Error(`unsupported_auth_mode:${raw} (expected one of ${AUTH_MODES.join(', ')})`);
+}
+/**
+ * Infers the mode from supplied credentials when `CREATIO_MCP_AUTH_MODE` is unset:
+ * legacy (login/password) → client_credentials (id/secret) → delegated (stateless, no creds).
+ */
+function inferMode() {
+    if ((0, utils_1.env)('CREATIO_LOGIN') && (0, utils_1.env)('CREATIO_PASSWORD')) {
+        return 'legacy';
+    }
+    if ((0, utils_1.env)('CREATIO_CLIENT_ID') && (0, utils_1.env)('CREATIO_CLIENT_SECRET')) {
+        return 'client_credentials';
     }
-    throw new Error('You must set either CREATIO_CODE_* (client id, client secret, redirect, scope) or CREATIO_CLIENT_ID/CREATIO_CLIENT_SECRET, or both CREATIO_LOGIN and CREATIO_PASSWORD');
+    return 'delegated';
 }
-function _getOAuth2CodeAuthConfig() {
-    const codeClientId = (0, utils_1.env)('CREATIO_CODE_CLIENT_ID');
-    const codeClientSecret = (0, utils_1.env)('CREATIO_CODE_CLIENT_SECRET');
-    const codeRedirectUri = (0, utils_1.env)('CREATIO_CODE_REDIRECT_URI');
-    const codeScope = (0, utils_1.env)('CREATIO_CODE_SCOPE');
-    if (codeClientId && codeClientSecret && codeRedirectUri && codeScope) {
-        return {
-            kind: creatio_1.AuthProviderType.OAuth2Code,
-            clientId: codeClientId,
-            clientSecret: codeClientSecret,
-            redirectUri: codeRedirectUri,
-            scope: codeScope,
-        };
-    }
-    return null;
+function bearerConfig(mode) {
+    const conf = { kind: creatio_1.AuthProviderType.OAuth2Bearer, mode };
+    const idb = (0, utils_1.env)('CREATIO_ID_BASE_URL');
+    if (idb) {
+        conf.idBaseUrl = idb;
+    }
+    return conf;
 }
-function _getOAuth2AuthConfig() {
+function clientCredentialsConfig() {
     const clientId = (0, utils_1.env)('CREATIO_CLIENT_ID');
     const clientSecret = (0, utils_1.env)('CREATIO_CLIENT_SECRET');
-    if (clientId && clientSecret) {
-        const conf = { kind: creatio_1.AuthProviderType.OAuth2, clientId, clientSecret };
-        const idb = (0, utils_1.env)('CREATIO_ID_BASE_URL');
-        if (idb) {
-            conf.idBaseUrl = idb;
+    if (!clientId || !clientSecret) {
+        throw new Error(MISSING_CLIENT_CREDENTIALS);
+    }
+    const conf = { kind: creatio_1.AuthProviderType.OAuth2, clientId, clientSecret };
+    const idb = (0, utils_1.env)('CREATIO_ID_BASE_URL');
+    if (idb) {
+        conf.idBaseUrl = idb;
+    }
+    return conf;
+}
+/** HS256 security rests ENTIRELY on the secret's entropy, so a short secret is brute-forceable
+ *  offline from any issued token. Refuse anything weaker than 32 chars (256 bits of base64). */
+const MIN_JWT_SECRET_LENGTH = 32;
+/**
+ * The secret that signs the tokens the broker issues to its OWN clients. A stable secret is
+ * required to (a) keep client tokens valid across restarts and (b) validate them across multiple
+ * instances. A configured secret must clear the entropy floor; in production an explicit secret is
+ * mandatory (fail closed). Outside production an unset secret yields an ephemeral one (with a
+ * warning) so local/dev just works — at the cost of both properties above.
+ */
+function resolveBrokerJwtSecret() {
+    const configured = (0, utils_1.env)('CREATIO_MCP_JWT_SECRET');
+    if (configured) {
+        if (configured.length < MIN_JWT_SECRET_LENGTH) {
+            throw new Error(`CREATIO_MCP_JWT_SECRET is too weak: it must be at least ${MIN_JWT_SECRET_LENGTH} ` +
+                `characters (got ${configured.length}). HS256 token security depends entirely on it.`);
         }
-        return conf;
+        return configured;
+    }
+    if ((0, utils_1.env)('NODE_ENV') === 'production') {
+        throw new Error('CREATIO_MCP_JWT_SECRET is required in production for broker mode. Set a stable secret ' +
+            `of at least ${MIN_JWT_SECRET_LENGTH} characters.`);
+    }
+    log_1.default.warn('broker.jwt_secret.ephemeral', {
+        detail: 'CREATIO_MCP_JWT_SECRET is not set — generated a random one. Tokens issued to clients ' +
+            'will be invalidated on restart and will not validate across multiple instances. Set a ' +
+            'stable secret for production or horizontal scaling.',
+    });
+    return node_crypto_1.default.randomBytes(32).toString('base64url');
+}
+function brokerConfig() {
+    const clientId = (0, utils_1.env)('CREATIO_CLIENT_ID');
+    if (!clientId) {
+        throw new Error(MISSING_BROKER);
     }
-    return null;
+    const jwtSecret = resolveBrokerJwtSecret();
+    const conf = { kind: creatio_1.AuthProviderType.Broker, clientId, jwtSecret };
+    const clientSecret = (0, utils_1.env)('CREATIO_CLIENT_SECRET');
+    if (clientSecret) {
+        conf.clientSecret = clientSecret;
+    }
+    const idb = (0, utils_1.env)('CREATIO_ID_BASE_URL');
+    if (idb) {
+        conf.idBaseUrl = idb;
+    }
+    return conf;
 }
-function _getLegacyAuthConfig() {
+function legacyConfig() {
     const login = (0, utils_1.env)('CREATIO_LOGIN');
     const password = (0, utils_1.env)('CREATIO_PASSWORD');
-    if (login && password) {
-        return { kind: creatio_1.AuthProviderType.Legacy, login, password };
+    if (!login || !password) {
+        throw new Error(MISSING_LEGACY);
+    }
+    return { kind: creatio_1.AuthProviderType.Legacy, login, password };
+}
+/**
+ * Resolves the one effective auth config from the unified `CREATIO_MCP_AUTH_MODE` selector
+ * (explicit or inferred). Credential-based modes throw a clear error when their inputs are missing;
+ * stateless Bearer modes (delegated/gateway) need none.
+ */
+function resolveAuthConfig() {
+    const mode = readExplicitMode() ?? inferMode();
+    switch (mode) {
+        case 'delegated':
+            return bearerConfig(creatio_1.BearerAuthMode.Delegated);
+        case 'gateway':
+            return bearerConfig(creatio_1.BearerAuthMode.Gateway);
+        case 'broker':
+            return brokerConfig();
+        case 'client_credentials':
+            return clientCredentialsConfig();
+        case 'legacy':
+            return legacyConfig();
     }
-    return null;
 }
 function getCrudBackend() {
-    const raw = (0, utils_1.env)('CREATIO_CRUD_BACKEND')?.toLowerCase();
+    const raw = (0, utils_1.env)('CREATIO_MCP_CRUD_BACKEND')?.toLowerCase();
     // DataService is the default backend (Creatio's native data API, what the UI uses);
-    // set CREATIO_CRUD_BACKEND=odata to opt into the OData backend instead.
+    // set CREATIO_MCP_CRUD_BACKEND=odata to opt into the OData backend instead.
     if (!raw || raw === 'dataservice') {
         return 'dataservice';
     }
@@ -67,12 +148,35 @@ function getCrudBackend() {
     }
     return 'odata';
 }
-function getCreatioClientConfig() {
+function getRequiredBaseUrl() {
     const baseUrl = (0, utils_1.env)('CREATIO_BASE_URL');
     if (!baseUrl) {
         throw new Error('Environment variable CREATIO_BASE_URL is required but not set');
     }
-    const auth = getCreatioClientAuthConfig();
-    return { baseUrl, auth, crudBackend: getCrudBackend() };
+    return baseUrl;
+}
+/**
+ * Broker token-store selection. `memory` (default) keeps tokens in-process (lost on restart, single
+ * instance); `redis` makes the broker stateless + restart-durable + multi-instance. The at-rest
+ * encryption key derives from `CREATIO_MCP_TOKEN_ENC_KEY` when set, else the (mandatory) broker
+ * `CREATIO_MCP_JWT_SECRET`.
+ */
+function getTokenStoreConfig() {
+    const kind = (0, utils_1.env)('CREATIO_MCP_TOKEN_STORE')?.toLowerCase() === 'redis' ? 'redis' : 'memory';
+    if (kind === 'memory') {
+        return { kind };
+    }
+    return {
+        kind,
+        redisUrl: (0, utils_1.env)('CREATIO_MCP_REDIS_URL'),
+        encryptionSecret: (0, utils_1.env)('CREATIO_MCP_TOKEN_ENC_KEY') || (0, utils_1.env)('CREATIO_MCP_JWT_SECRET'),
+    };
+}
+function getCreatioClientConfig() {
+    return {
+        baseUrl: getRequiredBaseUrl(),
+        auth: resolveAuthConfig(),
+        crudBackend: getCrudBackend(),
+    };
 }
 //# sourceMappingURL=config-builder.js.map

package/dist/config-builder.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-builder.js","sourceRoot":"","sources":["../src/config-builder.ts"],"names":[],"mappings":";;AAkFA,wDAOC;AAzFD,uCAQmB;AACnB,mCAA8B;AAE9B,SAAS,0BAA0B;IAClC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CACd,uKAAuK,CACvK,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAChC,MAAM,YAAY,GAAG,IAAA,WAAG,EAAC,wBAAwB,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,IAAA,WAAG,EAAC,4BAA4B,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,IAAA,WAAG,EAAC,2BAA2B,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAA,WAAG,EAAC,oBAAoB,CAAC,CAAC;IAC5C,IAAI,YAAY,IAAI,gBAAgB,IAAI,eAAe,IAAI,SAAS,EAAE,CAAC;QACtE,OAAO;YACN,IAAI,EAAE,0BAAgB,CAAC,UAAU;YACjC,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,gBAAgB;YAC9B,WAAW,EAAE,eAAe;YAC5B,KAAK,EAAE,SAAS;SAChB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB;IAC5B,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,mBAAmB,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAA,WAAG,EAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,0BAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACzF,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,qBAAqB,CAAC,CAAC;QACvC,IAAI,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB;IAC5B,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,eAAe,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,kBAAkB,CAAC,CAAC;IACzC,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,0BAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC;IACvD,oFAAoF;IACpF,wEAAwE;IACxE,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,sCAAsC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAgB,sBAAsB;IACrC,MAAM,OAAO,GAAG,IAAA,WAAG,EAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"config-builder.js","sourceRoot":"","sources":["../src/config-builder.ts"],"names":[],"mappings":";;;;;AA6LA,kDAUC;AAED,wDAMC;AA/MD,8DAAiC;AAEjC,uCAUmB;AACnB,gDAAwB;AAExB,mCAA8B;AAE9B;;;GAGG;AACH,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,CAAU,CAAC;AAG/F,MAAM,0BAA0B,GAC/B,8EAA8E,CAAC;AAChF,MAAM,cAAc,GAAG,yDAAyD,CAAC;AACjF,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAEhE,SAAS,gBAAgB;IACxB,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAK,UAAgC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,GAAe,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,qBAAqB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS;IACjB,IAAI,IAAA,WAAG,EAAC,eAAe,CAAC,IAAI,IAAA,WAAG,EAAC,kBAAkB,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,IAAA,WAAG,EAAC,mBAAmB,CAAC,IAAI,IAAA,WAAG,EAAC,uBAAuB,CAAC,EAAE,CAAC;QAC9D,OAAO,oBAAoB,CAAC;IAC7B,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,IAAoB;IACzC,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,0BAAgB,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,qBAAqB,CAAC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB;IAC/B,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,mBAAmB,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAA,WAAG,EAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,0BAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzF,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,qBAAqB,CAAC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;gGACgG;AAChG,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;GAMG;AACH,SAAS,sBAAsB;IAC9B,MAAM,UAAU,GAAG,IAAA,WAAG,EAAC,wBAAwB,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,CAAC;QAChB,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACd,2DAA2D,qBAAqB,GAAG;gBAClF,mBAAmB,UAAU,CAAC,MAAM,iDAAiD,CACtF,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,IAAI,IAAA,WAAG,EAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACd,wFAAwF;YACvF,eAAe,qBAAqB,cAAc,CACnD,CAAC;IACH,CAAC;IACD,aAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE;QACvC,MAAM,EACL,uFAAuF;YACvF,wFAAwF;YACxF,qDAAqD;KACtD,CAAC,CAAC;IACH,OAAO,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY;IACpB,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,mBAAmB,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,SAAS,GAAG,sBAAsB,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,0BAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtF,MAAM,YAAY,GAAG,IAAA,WAAG,EAAC,uBAAuB,CAAC,CAAC;IAClD,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IAClC,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,qBAAqB,CAAC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACT,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,YAAY;IACpB,MAAM,KAAK,GAAG,IAAA,WAAG,EAAC,eAAe,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAA,WAAG,EAAC,kBAAkB,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,0BAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB;IACzB,MAAM,IAAI,GAAG,gBAAgB,EAAE,IAAI,SAAS,EAAE,CAAC;IAC/C,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,WAAW;YACf,OAAO,YAAY,CAAC,wBAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,KAAK,SAAS;YACb,OAAO,YAAY,CAAC,wBAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,QAAQ;YACZ,OAAO,YAAY,EAAE,CAAC;QACvB,KAAK,oBAAoB;YACxB,OAAO,uBAAuB,EAAE,CAAC;QAClC,KAAK,QAAQ;YACZ,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;AACF,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,GAAG,GAAG,IAAA,WAAG,EAAC,0BAA0B,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3D,oFAAoF;IACpF,4EAA4E;IAC5E,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,sCAAsC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IAC1B,MAAM,OAAO,GAAG,IAAA,WAAG,EAAC,kBAAkB,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB;IAClC,MAAM,IAAI,GAAG,IAAA,WAAG,EAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5F,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,CAAC;IACjB,CAAC;IACD,OAAO;QACN,IAAI;QACJ,QAAQ,EAAE,IAAA,WAAG,EAAC,uBAAuB,CAAC;QACtC,gBAAgB,EAAE,IAAA,WAAG,EAAC,2BAA2B,CAAC,IAAI,IAAA,WAAG,EAAC,wBAAwB,CAAC;KACnF,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB;IACrC,OAAO;QACN,OAAO,EAAE,kBAAkB,EAAE;QAC7B,IAAI,EAAE,iBAAiB,EAAE;QACzB,WAAW,EAAE,cAAc,EAAE;KAC7B,CAAC;AACH,CAAC"}

package/dist/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa,QAA8B,CAAC"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,aAAa,QAA0C,CAAC"}

package/dist/consts.js

@@ -2,5 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HTTP_MCP_PORT = void 0;
 const utils_1 = require("./utils");
-exports.HTTP_MCP_PORT = Number((0, utils_1.env)('PORT')) || 3000;
+// Canonical CREATIO_MCP_PORT; env() transparently falls back to the conventional PORT (no warning).
+exports.HTTP_MCP_PORT = Number((0, utils_1.env)('CREATIO_MCP_PORT')) || 3000;
 //# sourceMappingURL=consts.js.map

package/dist/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAEjB,QAAA,aAAa,GAAG,MAAM,CAAC,IAAA,WAAG,EAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":";;;AAAA,mCAA8B;AAE9B,oGAAoG;AACvF,QAAA,aAAa,GAAG,MAAM,CAAC,IAAA,WAAG,EAAC,kBAAkB,CAAC,CAAC,IAAI,IAAI,CAAC"}

package/dist/creatio/auth/auth-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-manager.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/auth-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAG9C,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;gBAErC,MAAM,EAAE,mBAAmB;IAchC,WAAW,IAAI,oBAAoB;CAG1C"}
+{"version":3,"file":"auth-manager.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/auth-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAS9C,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuB;gBAErC,MAAM,EAAE,mBAAmB;IAgBhC,WAAW,IAAI,oBAAoB;CAG1C"}

package/dist/creatio/auth/auth-manager.js

@@ -11,8 +11,11 @@ class CreatioAuthManager {
         if (authKind === providers_1.AuthProviderType.OAuth2) {
             this._provider = new providers_1.OAuth2Provider(this._config);
         }
-        else if (authKind === providers_1.AuthProviderType.OAuth2Code) {
-            this._provider = new providers_1.OAuth2CodeProvider(this._config);
+        else if (authKind === providers_1.AuthProviderType.OAuth2Bearer) {
+            this._provider = new providers_1.OAuth2BearerProvider(this._config);
+        }
+        else if (authKind === providers_1.AuthProviderType.Broker) {
+            this._provider = new providers_1.BrokerProvider(this._config);
         }
         else if (authKind === providers_1.AuthProviderType.Legacy) {
             this._provider = new providers_1.LegacyProvider(this._config);

package/dist/creatio/auth/auth-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-manager.js","sourceRoot":"","sources":["../../../src/creatio/auth/auth-manager.ts"],"names":[],"mappings":";;;AAGA,2CAAmG;AAEnG,MAAa,kBAAkB;IACb,OAAO,CAAsB;IAC7B,SAAS,CAAuB;IAEjD,YAAY,MAA2B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,IAAI,QAAQ,KAAK,4BAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,QAAQ,KAAK,4BAAgB,CAAC,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC,SAAS,GAAG,IAAI,8BAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,QAAQ,KAAK,4BAAgB,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAEM,WAAW;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;CACD;AArBD,gDAqBC"}
+{"version":3,"file":"auth-manager.js","sourceRoot":"","sources":["../../../src/creatio/auth/auth-manager.ts"],"names":[],"mappings":";;;AAGA,2CAMqB;AAErB,MAAa,kBAAkB;IACb,OAAO,CAAsB;IAC7B,SAAS,CAAuB;IAEjD,YAAY,MAA2B;QACtC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QACxC,IAAI,QAAQ,KAAK,4BAAgB,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,QAAQ,KAAK,4BAAgB,CAAC,YAAY,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,GAAG,IAAI,gCAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,QAAQ,KAAK,4BAAgB,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,IAAI,QAAQ,KAAK,4BAAgB,CAAC,MAAM,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACF,CAAC;IAEM,WAAW;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;CACD;AAvBD,gDAuBC"}

package/dist/creatio/auth/auth.d.ts

@@ -1,32 +1,5 @@
-import { AuthProviderType } from './providers';
-/**
- * Core capability every auth provider has: attach auth headers, refresh on 401, and a
- * safe cancel hook for background timers. Kept deliberately small (ISP) — revocation and
- * the interactive authorization-code dance are separate, optional capabilities below, so
- * a provider is never forced to stub methods it does not support.
- */
-export interface ICreatioAuthProvider {
-    type: AuthProviderType;
-    getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
-    refresh(): Promise<void>;
-    /** Cancels any background token-refresh timers. Safe no-op for providers without them. */
-    cancelAllRefresh(): void;
-}
-/** A provider whose tokens can be explicitly revoked (OAuth2 variants). */
-export interface IRevocableAuthProvider extends ICreatioAuthProvider {
-    revoke(): Promise<void>;
-}
-/** A provider that drives the interactive OAuth2 authorization-code flow. */
-export interface IInteractiveAuthProvider extends ICreatioAuthProvider {
-    getAuthorizeUrl(state: string): Promise<string>;
-    finishAuthorization(code: string): Promise<void>;
-}
-export declare function supportsRevoke(provider: ICreatioAuthProvider): provider is IRevocableAuthProvider;
-export declare function supportsInteractiveAuth(provider: ICreatioAuthProvider): provider is IInteractiveAuthProvider;
-export declare function buildHeaders(accept: string, isJson?: boolean, token?: string): Record<string, string>;
-export declare const TOKEN_ENDPOINT = "/connect/token";
-export declare const AUTHORIZE_ENDPOINT = "/connect/authorize";
-export declare const REVOCATION_ENDPOINT = "/connect/revocation";
-export declare const TOKEN_BODY_SNIPPET_MAX = 1024;
-export declare const EXPIRES_MARGIN_SECONDS = 30;
+export * from './contracts';
+export * from './headers';
+export * from './identity';
+export * from './constants';
 //# sourceMappingURL=auth.d.ts.map

package/dist/creatio/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,0FAA0F;IAC1F,gBAAgB,IAAI,IAAI,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IACnE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,6EAA6E;AAC7E,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACrE,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,QAAQ,IAAI,sBAAsB,CAEjG;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,oBAAoB,GAC5B,QAAQ,IAAI,wBAAwB,CAGtC;AAED,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,EAChB,KAAK,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,eAAO,MAAM,sBAAsB,KAAK,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/auth.ts"],"names":[],"mappings":"AAEA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/creatio/auth/auth.js

@@ -1,29 +1,23 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPIRES_MARGIN_SECONDS = exports.TOKEN_BODY_SNIPPET_MAX = exports.REVOCATION_ENDPOINT = exports.AUTHORIZE_ENDPOINT = exports.TOKEN_ENDPOINT = void 0;
-exports.supportsRevoke = supportsRevoke;
-exports.supportsInteractiveAuth = supportsInteractiveAuth;
-exports.buildHeaders = buildHeaders;
-function supportsRevoke(provider) {
-    return typeof provider.revoke === 'function';
-}
-function supportsInteractiveAuth(provider) {
-    const p = provider;
-    return typeof p.getAuthorizeUrl === 'function' && typeof p.finishAuthorization === 'function';
-}
-function buildHeaders(accept, isJson, token) {
-    const headers = { Accept: accept };
-    if (isJson) {
-        headers['Content-Type'] = 'application/json';
-    }
-    if (token) {
-        headers['Authorization'] = `Bearer ${token}`;
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-    return headers;
-}
-exports.TOKEN_ENDPOINT = '/connect/token';
-exports.AUTHORIZE_ENDPOINT = '/connect/authorize';
-exports.REVOCATION_ENDPOINT = '/connect/revocation';
-exports.TOKEN_BODY_SNIPPET_MAX = 1024;
-exports.EXPIRES_MARGIN_SECONDS = 30;
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Internal barrel for the auth core, split by concern (SRP): provider contract, header building,
+// identity-base resolution, and protocol constants. Providers import from here ('../auth').
+__exportStar(require("./contracts"), exports);
+__exportStar(require("./headers"), exports);
+__exportStar(require("./identity"), exports);
+__exportStar(require("./constants"), exports);
 //# sourceMappingURL=auth.js.map

package/dist/creatio/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/creatio/auth/auth.ts"],"names":[],"mappings":";;;AA2BA,wCAEC;AAED,0DAKC;AAED,oCAaC;AAxBD,SAAgB,cAAc,CAAC,QAA8B;IAC5D,OAAO,OAAQ,QAA4C,CAAC,MAAM,KAAK,UAAU,CAAC;AACnF,CAAC;AAED,SAAgB,uBAAuB,CACtC,QAA8B;IAE9B,MAAM,CAAC,GAAG,QAA6C,CAAC;IACxD,OAAO,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,mBAAmB,KAAK,UAAU,CAAC;AAC/F,CAAC;AAED,SAAgB,YAAY,CAC3B,MAAc,EACd,MAAgB,EAChB,KAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAEY,QAAA,cAAc,GAAG,gBAAgB,CAAC;AAClC,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAC1C,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,sBAAsB,GAAG,IAAI,CAAC;AAC9B,QAAA,sBAAsB,GAAG,EAAE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/creatio/auth/auth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,4FAA4F;AAC5F,8CAA4B;AAC5B,4CAA0B;AAC1B,6CAA2B;AAC3B,8CAA4B"}

package/dist/creatio/auth/constants.d.ts

@@ -0,0 +1,14 @@
+/** Creatio Identity endpoints, relative to the identity base (see {@link resolveIdentityBase}). */
+export declare const TOKEN_ENDPOINT = "/connect/token";
+export declare const AUTHORIZE_ENDPOINT = "/connect/authorize";
+export declare const REVOCATION_ENDPOINT = "/connect/revocation";
+/** Max bytes of a token-endpoint error body to log, so diagnostics never dump huge payloads. */
+export declare const TOKEN_BODY_SNIPPET_MAX = 1024;
+/** Safety margin (seconds) subtracted from a token's lifetime so it is refreshed before it expires. */
+export declare const EXPIRES_MARGIN_SECONDS = 30;
+/** PKCE challenge method the broker always uses on the Creatio leg. */
+export declare const PKCE_S256 = "S256";
+/** Absolute expiry (epoch ms) for a token living `expiresInSeconds`, minus the safety margin so it
+ *  is refreshed before it actually expires. The single source of truth for token-expiry math. */
+export declare function computeTokenExpiryMs(expiresInSeconds: number, minSeconds?: number): number;
+//# sourceMappingURL=constants.d.ts.map

package/dist/creatio/auth/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/constants.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,uGAAuG;AACvG,eAAO,MAAM,sBAAsB,KAAK,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,SAAS,SAAS,CAAC;AAEhC;iGACiG;AACjG,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,SAAI,GAAG,MAAM,CAErF"}

package/dist/creatio/auth/constants.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PKCE_S256 = exports.EXPIRES_MARGIN_SECONDS = exports.TOKEN_BODY_SNIPPET_MAX = exports.REVOCATION_ENDPOINT = exports.AUTHORIZE_ENDPOINT = exports.TOKEN_ENDPOINT = void 0;
+exports.computeTokenExpiryMs = computeTokenExpiryMs;
+/** Creatio Identity endpoints, relative to the identity base (see {@link resolveIdentityBase}). */
+exports.TOKEN_ENDPOINT = '/connect/token';
+exports.AUTHORIZE_ENDPOINT = '/connect/authorize';
+exports.REVOCATION_ENDPOINT = '/connect/revocation';
+/** Max bytes of a token-endpoint error body to log, so diagnostics never dump huge payloads. */
+exports.TOKEN_BODY_SNIPPET_MAX = 1024;
+/** Safety margin (seconds) subtracted from a token's lifetime so it is refreshed before it expires. */
+exports.EXPIRES_MARGIN_SECONDS = 30;
+/** PKCE challenge method the broker always uses on the Creatio leg. */
+exports.PKCE_S256 = 'S256';
+/** Absolute expiry (epoch ms) for a token living `expiresInSeconds`, minus the safety margin so it
+ *  is refreshed before it actually expires. The single source of truth for token-expiry math. */
+function computeTokenExpiryMs(expiresInSeconds, minSeconds = 1) {
+    return Date.now() + Math.max(minSeconds, expiresInSeconds - exports.EXPIRES_MARGIN_SECONDS) * 1000;
+}
+//# sourceMappingURL=constants.js.map

package/dist/creatio/auth/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/creatio/auth/constants.ts"],"names":[],"mappings":";;;AAaA,oDAEC;AAfD,mGAAmG;AACtF,QAAA,cAAc,GAAG,gBAAgB,CAAC;AAClC,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAC1C,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AACzD,gGAAgG;AACnF,QAAA,sBAAsB,GAAG,IAAI,CAAC;AAC3C,uGAAuG;AAC1F,QAAA,sBAAsB,GAAG,EAAE,CAAC;AACzC,uEAAuE;AAC1D,QAAA,SAAS,GAAG,MAAM,CAAC;AAEhC;iGACiG;AACjG,SAAgB,oBAAoB,CAAC,gBAAwB,EAAE,UAAU,GAAG,CAAC;IAC5E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,gBAAgB,GAAG,8BAAsB,CAAC,GAAG,IAAI,CAAC;AAC5F,CAAC"}

package/dist/creatio/auth/contracts.d.ts

@@ -0,0 +1,15 @@
+import { AuthProviderType } from './providers';
+/**
+ * The single capability every auth provider has: attach auth headers, refresh on 401, and a safe
+ * cancel hook for background timers. Deliberately small (ISP) — the stateless Bearer, client-
+ * credentials and legacy providers all fit this one shape; there is no longer any token-issuing or
+ * interactive-flow surface on the MCP (clients authenticate against Creatio Identity directly).
+ */
+export interface ICreatioAuthProvider {
+    type: AuthProviderType;
+    getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
+    refresh(): Promise<void>;
+    /** Cancels any background timers. Safe no-op for providers without them. */
+    cancelAllRefresh(): void;
+}
+//# sourceMappingURL=contracts.d.ts.map

package/dist/creatio/auth/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,4EAA4E;IAC5E,gBAAgB,IAAI,IAAI,CAAC;CACzB"}

package/dist/creatio/auth/contracts.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=contracts.js.map

package/dist/creatio/auth/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../../src/creatio/auth/contracts.ts"],"names":[],"mappings":""}

package/dist/creatio/auth/headers.d.ts

@@ -0,0 +1,3 @@
+/** Builds the standard Creatio request headers, optionally with a JSON content-type and a Bearer token. */
+export declare function buildHeaders(accept: string, isJson?: boolean, token?: string): Record<string, string>;
+//# sourceMappingURL=headers.d.ts.map

package/dist/creatio/auth/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/headers.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,wBAAgB,YAAY,CAC3B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,EAChB,KAAK,CAAC,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB"}

package/dist/creatio/auth/headers.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHeaders = buildHeaders;
+/** Builds the standard Creatio request headers, optionally with a JSON content-type and a Bearer token. */
+function buildHeaders(accept, isJson, token) {
+    const headers = { Accept: accept };
+    if (isJson) {
+        headers['Content-Type'] = 'application/json';
+    }
+    if (token) {
+        headers['Authorization'] = `Bearer ${token}`;
+    }
+    return headers;
+}
+//# sourceMappingURL=headers.js.map

package/dist/creatio/auth/headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../../../src/creatio/auth/headers.ts"],"names":[],"mappings":";;AACA,oCAaC;AAdD,2GAA2G;AAC3G,SAAgB,YAAY,CAC3B,MAAc,EACd,MAAgB,EAChB,KAAc;IAEd,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/creatio/auth/identity.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Canonical Creatio identity base: an explicit `idBaseUrl` when given, otherwise the instance base
+ * URL, in both cases normalized to end with the `/0` workspace segment (where Creatio hosts the
+ * OAuth/OIDC endpoints, e.g. `/0/connect/token`, `/0/.well-known/openid-configuration`). Shared by
+ * the client-credentials provider and the delegated-mode JWKS validator so they target the same host.
+ */
+export declare function resolveIdentityBase(baseUrl: string, idBaseUrl?: string): string;
+//# sourceMappingURL=identity.d.ts.map

package/dist/creatio/auth/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/identity.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAO/E"}

package/dist/creatio/auth/identity.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveIdentityBase = resolveIdentityBase;
+/**
+ * Canonical Creatio identity base: an explicit `idBaseUrl` when given, otherwise the instance base
+ * URL, in both cases normalized to end with the `/0` workspace segment (where Creatio hosts the
+ * OAuth/OIDC endpoints, e.g. `/0/connect/token`, `/0/.well-known/openid-configuration`). Shared by
+ * the client-credentials provider and the delegated-mode JWKS validator so they target the same host.
+ */
+function resolveIdentityBase(baseUrl, idBaseUrl) {
+    const raw = idBaseUrl ? String(idBaseUrl) : baseUrl;
+    let base = raw.replace(/\/$/, '');
+    if (!/\/0$/.test(base)) {
+        base = base + '/0';
+    }
+    return base;
+}
+//# sourceMappingURL=identity.js.map

package/dist/creatio/auth/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/creatio/auth/identity.ts"],"names":[],"mappings":";;AAMA,kDAOC;AAbD;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,OAAe,EAAE,SAAkB;IACtE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/creatio/auth/index.d.ts

@@ -1,5 +1,6 @@
 export * from './auth-manager';
-export type { ICreatioAuthProvider, IRevocableAuthProvider, IInteractiveAuthProvider, } from './auth';
-export { supportsRevoke, supportsInteractiveAuth } from './auth';
-export { AuthProviderType } from './providers/type';
+export type { ICreatioAuthProvider } from './auth';
+export { resolveIdentityBase } from './auth';
+export { CreatioOAuthClient } from './providers';
+export { AuthProviderType, BearerAuthMode } from './providers/type';
 //# sourceMappingURL=index.d.ts.map

package/dist/creatio/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EACX,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACxB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,YAAY,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/creatio/auth/index.js

@@ -14,11 +14,13 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthProviderType = exports.supportsInteractiveAuth = exports.supportsRevoke = void 0;
+exports.BearerAuthMode = exports.AuthProviderType = exports.CreatioOAuthClient = exports.resolveIdentityBase = void 0;
 __exportStar(require("./auth-manager"), exports);
 var auth_1 = require("./auth");
-Object.defineProperty(exports, "supportsRevoke", { enumerable: true, get: function () { return auth_1.supportsRevoke; } });
-Object.defineProperty(exports, "supportsInteractiveAuth", { enumerable: true, get: function () { return auth_1.supportsInteractiveAuth; } });
+Object.defineProperty(exports, "resolveIdentityBase", { enumerable: true, get: function () { return auth_1.resolveIdentityBase; } });
+var providers_1 = require("./providers");
+Object.defineProperty(exports, "CreatioOAuthClient", { enumerable: true, get: function () { return providers_1.CreatioOAuthClient; } });
 var type_1 = require("./providers/type");
 Object.defineProperty(exports, "AuthProviderType", { enumerable: true, get: function () { return type_1.AuthProviderType; } });
+Object.defineProperty(exports, "BearerAuthMode", { enumerable: true, get: function () { return type_1.BearerAuthMode; } });
 //# sourceMappingURL=index.js.map

package/dist/creatio/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAM/B,+BAAiE;AAAxD,sGAAA,cAAc,OAAA;AAAE,+GAAA,uBAAuB,OAAA;AAChD,yCAAoD;AAA3C,wGAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAE/B,+BAA6C;AAApC,2GAAA,mBAAmB,OAAA;AAC5B,yCAAiD;AAAxC,+GAAA,kBAAkB,OAAA;AAC3B,yCAAoE;AAA3D,wGAAA,gBAAgB,OAAA;AAAE,sGAAA,cAAc,OAAA"}

package/dist/creatio/auth/providers/base-oauth2-provider.d.ts

@@ -1,17 +1,23 @@
-import { OAuth2AuthConfig, OAuth2CodeAuthConfig } from '../../client-config';
+import { OAuth2AuthConfig } from '../../client-config';
 import { BaseProvider } from './base-provider';
-type OAuthConfig = OAuth2AuthConfig | OAuth2CodeAuthConfig;
-export declare abstract class BaseOAuth2Provider<T extends OAuthConfig = OAuthConfig> extends BaseProvider<T> {
+/** The raw result of a token fetch — caching and expiry math live in the base. */
+export interface FetchedToken {
+    accessToken: string;
+    expiresInSeconds: number;
+}
+export declare abstract class BaseOAuth2Provider<T extends OAuth2AuthConfig = OAuth2AuthConfig> extends BaseProvider<T> {
     protected abstract readonly authErrorCode: string;
+    private _inflight;
     protected accessToken: string | undefined;
     protected accessTokenExpiryMs: number | undefined;
-    protected abstract ensureAccessToken(force?: boolean): Promise<string | undefined>;
-    protected computeExpiryMs(expiresInSeconds: number, minSeconds?: number): number;
+    /** Raw token acquisition (the network call only); returns undefined on failure. */
+    protected abstract fetchToken(): Promise<FetchedToken | undefined>;
+    private _isFresh;
+    private _acquireToken;
     protected getIdentityBase(): string;
-    protected storageKey(userKey: string): string;
     protected throwNoTokenError(): void;
+    protected ensureAccessToken(force?: boolean): Promise<string | undefined>;
     getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
     refresh(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=base-oauth2-provider.d.ts.map