mcp-creatio 0.6.2 → 0.6.4

package/dist/server/oauth/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":";;;AAMA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E,MAAa,eAAe;IAC3B;;;;OAIG;IACI,MAAM,CAAC,oBAAoB,CAAC,GAAW;QAC7C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,yFAAyF;QACzF,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,4BAA4B,CACzC,MAAiC,EACjC,MAA+B;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,MAAyB;QAC3D,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,+BAA+B,EAAE,CAAC;QACzF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,0BAA0B,CAAC,aAAsB;QAC9D,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,gDAAgD,CAAC;QACzD,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,6CAA6C,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,mCAAmC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC;gBACJ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,yBAAyB,GAAG,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,gEAAgE,GAAG,EAAE,CAAC;YAC9E,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AA3ED,0CA2EC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../../src/server/oauth/validators.ts"],"names":[],"mappings":";;;AAMA,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E,MAAa,eAAe;IAC3B;;;;OAIG;IACI,MAAM,CAAC,oBAAoB,CAAC,GAAW;QAC7C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,yFAAyF;QACzF,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,4BAA4B,CACzC,MAAiC,EACjC,MAA+B;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,MAAyB;QAC3D,IAAI,MAAM,CAAC,UAAU,KAAK,oBAAoB,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3C,OAAO;oBACN,KAAK,EAAE,iBAAiB;oBACxB,iBAAiB,EAAE,+BAA+B;iBAClD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAC5C,CAAC;IAEM,MAAM,CAAC,0BAA0B,CAAC,aAAsB;QAC9D,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,gDAAgD,CAAC;QACzD,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,6CAA6C,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,mCAAmC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC;gBACJ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,yBAAyB,GAAG,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,OAAO,gEAAgE,GAAG,EAAE,CAAC;YAC9E,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;CACD;AApFD,0CAoFC"}

package/dist/sessions/index.d.ts

@@ -1,3 +1,3 @@
 export * from './session-context';
-export * from './token-refresh-scheduler';
+export * from './token-store';
 //# sourceMappingURL=index.d.ts.map

package/dist/sessions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC"}

package/dist/sessions/index.js

@@ -15,5 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./session-context"), exports);
-__exportStar(require("./token-refresh-scheduler"), exports);
+__exportStar(require("./token-store"), exports);
 //# sourceMappingURL=index.js.map

package/dist/sessions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,gDAA8B"}

package/dist/sessions/redis-token-store.d.ts

@@ -0,0 +1,22 @@
+import type { UserTokens } from './session-context';
+import type { TokenStore } from './token-store';
+/**
+ * Redis-backed broker token store: stateless + restart-durable + multi-instance safe. Tokens are
+ * AES-256-GCM encrypted at rest; per-key TTL (reset on every write) handles idle eviction natively,
+ * so {@link evictStale} is a no-op. Lazy-loaded by {@link createTokenStore} so memory-mode never
+ * touches the `redis` dependency.
+ */
+export declare class RedisTokenStore implements TokenStore {
+    private readonly _key;
+    private readonly _ttlSeconds;
+    private readonly _client;
+    constructor(url: string, _key: Buffer, _ttlSeconds: number);
+    private _redisKey;
+    connect(): Promise<void>;
+    get(userKey: string): Promise<UserTokens | null>;
+    set(userKey: string, tokens: UserTokens): Promise<void>;
+    delete(userKey: string): Promise<void>;
+    evictStale(): Promise<number>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=redis-token-store.d.ts.map

package/dist/sessions/redis-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-token-store.d.ts","sourceRoot":"","sources":["../../src/sessions/redis-token-store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAKhD;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAKhD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;gBAGzC,GAAG,EAAE,MAAM,EACM,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM;IAMrC,OAAO,CAAC,SAAS;IAIJ,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAKxB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAehD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAOnC"}

package/dist/sessions/redis-token-store.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisTokenStore = void 0;
+const redis_1 = require("redis");
+const log_1 = __importDefault(require("../log"));
+const token_crypto_1 = require("./token-crypto");
+const KEY_PREFIX = 'mcp:creatio:tok:';
+/**
+ * Redis-backed broker token store: stateless + restart-durable + multi-instance safe. Tokens are
+ * AES-256-GCM encrypted at rest; per-key TTL (reset on every write) handles idle eviction natively,
+ * so {@link evictStale} is a no-op. Lazy-loaded by {@link createTokenStore} so memory-mode never
+ * touches the `redis` dependency.
+ */
+class RedisTokenStore {
+    _key;
+    _ttlSeconds;
+    _client;
+    constructor(url, _key, _ttlSeconds) {
+        this._key = _key;
+        this._ttlSeconds = _ttlSeconds;
+        this._client = (0, redis_1.createClient)({ url });
+        this._client.on('error', (err) => log_1.default.warn('redis.client.error', { error: String(err) }));
+    }
+    _redisKey(userKey) {
+        return `${KEY_PREFIX}${userKey}`;
+    }
+    async connect() {
+        await this._client.connect();
+        log_1.default.info('redis.token_store.connected', {});
+    }
+    async get(userKey) {
+        const blob = await this._client.get(this._redisKey(userKey));
+        if (!blob) {
+            return null;
+        }
+        try {
+            return JSON.parse((0, token_crypto_1.decryptToken)(blob, this._key));
+        }
+        catch (err) {
+            // A corrupt/undecryptable entry (e.g. rotated key) is treated as absent so the user
+            // simply re-authorizes, rather than wedging on a bad blob.
+            log_1.default.warn('redis.token_store.decrypt_failed', { error: String(err) });
+            return null;
+        }
+    }
+    async set(userKey, tokens) {
+        const payload = { ...tokens, storedAtMs: tokens.storedAtMs ?? Date.now() };
+        const blob = (0, token_crypto_1.encryptToken)(JSON.stringify(payload), this._key);
+        await this._client.set(this._redisKey(userKey), blob, { EX: this._ttlSeconds });
+    }
+    async delete(userKey) {
+        await this._client.del(this._redisKey(userKey));
+    }
+    async evictStale() {
+        return 0; // Redis expires keys natively via the per-write TTL.
+    }
+    async close() {
+        try {
+            await this._client.quit();
+        }
+        catch (err) {
+            log_1.default.warn('redis.token_store.close_failed', { error: String(err) });
+        }
+    }
+}
+exports.RedisTokenStore = RedisTokenStore;
+//# sourceMappingURL=redis-token-store.js.map

package/dist/sessions/redis-token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-token-store.js","sourceRoot":"","sources":["../../src/sessions/redis-token-store.ts"],"names":[],"mappings":";;;;;;AAAA,iCAAqC;AAErC,iDAAyB;AAEzB,iDAA4D;AAM5D,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;GAKG;AACH,MAAa,eAAe;IAKT;IACA;IALD,OAAO,CAAkB;IAE1C,YACC,GAAW,EACM,IAAY,EACZ,WAAmB;QADnB,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,OAAO,GAAG,IAAA,oBAAY,EAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAEO,SAAS,CAAC,OAAe;QAChC,OAAO,GAAG,UAAU,GAAG,OAAO,EAAE,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7B,aAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAA,2BAAY,EAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAe,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,oFAAoF;YACpF,2DAA2D;YAC3D,aAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,MAAkB;QACnD,MAAM,OAAO,GAAe,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAe;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,UAAU;QACtB,OAAO,CAAC,CAAC,CAAC,qDAAqD;IAChE,CAAC;IAEM,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACF,CAAC;CACD;AAzDD,0CAyDC"}

package/dist/sessions/session-context.d.ts

@@ -1,4 +1,5 @@
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { TokenStore } from './token-store';
 export interface SessionInfo {
     id: string;
     userKey?: string | undefined;
@@ -7,35 +8,32 @@ export interface SessionInfo {
     createdAt: Date;
     remoteIp?: string | undefined;
 }
+/**
+ * A user's Creatio tokens, held per `userKey` in `broker` mode (the MCP brokered the login, so it
+ * owns the refresh lifecycle). Other modes store nothing here.
+ */
 export interface UserTokens {
     accessToken: string;
     accessTokenExpiryMs: number;
     refreshToken?: string | undefined;
-    /** When this entry was stored/last refreshed; set by setTokensForUser. Drives idle eviction. */
+    /** When stored/last refreshed; drives idle eviction. */
     storedAtMs?: number | undefined;
 }
-export interface OAuthState {
-    userKey: string;
-    sessionId?: string | undefined;
-    createdAt: number;
-    expiresAt: number;
-}
-export interface OAuthStateResult {
-    userKey: string;
-    sessionId?: string | undefined;
-}
+/**
+ * Tracks live MCP streamable-HTTP sessions (id ↔ transport ↔ user identity) for the HTTP server.
+ *
+ * In the stateless per-request Bearer model the MCP stores NO tokens: every request carries its own
+ * Creatio access token (delegated: from the client; gateway: injected by the Control-Plane). This
+ * context therefore only manages transport/session lifecycle and the identity used for logging.
+ */
 export declare class SessionContext {
-    /** Idle window after which a token entry is considered abandoned and evicted, even if it
-     *  still has a refresh token. Generous (24h) so a returning client within a normal working
-     *  day keeps transparent refresh; resets on every store/refresh. */
-    private static readonly TOKEN_IDLE_TTL_MS;
     private static _instance;
     private readonly _sessions;
-    private readonly _userTokens;
-    private readonly _oauthStates;
     private readonly _deletingSessions;
+    private _tokenStore;
     static get instance(): SessionContext;
-    private _generateState;
+    /** Swap the broker token store (e.g. Redis) — call once at startup, broker mode only. */
+    setTokenStore(store: TokenStore): void;
     createSession(sessionId: string, userKey?: string, remoteIp?: string): SessionInfo;
     getSession(sessionId: string): SessionInfo | undefined;
     hasSession(sessionId: string): boolean;
@@ -45,30 +43,13 @@ export declare class SessionContext {
     deleteSession(sessionId: string): void;
     getAllSessions(): SessionInfo[];
     getSessionsForUser(userKey: string): SessionInfo[];
-    getTokensForSession(sessionId: string): Promise<UserTokens | null>;
-    getTokensForUser(userKey: string): Promise<UserTokens | null>;
-    setTokensForUser(userKey: string, tokens: UserTokens): Promise<void>;
-    deleteTokensForUser(userKey: string): Promise<void>;
-    createOAuthState(userKey: string, sessionId?: string): string;
-    validateOAuthState(state: string): OAuthStateResult | null;
-    validateAndConsumeOAuthState(state: string): OAuthStateResult | undefined;
-    cleanupExpiredOAuthStates(): void;
-    /**
-     * Bound the per-user token map on a long-running process WITHOUT evicting tokens a client
-     * could still use. Refresh is keyed by userKey (not session) — Bearer clients carry identity
-     * in the JWT and often have no live session between reconnects — so a token is removed only
-     * when it is genuinely unreachable:
-     *  - expired AND has no refresh token (cannot be revived), or
-     *  - idle past {@link TOKEN_IDLE_TTL_MS} since it was last stored/refreshed (abandoned).
-     * Unexpired tokens and recently-stored refreshable tokens are always kept. Returns count removed.
-     */
-    evictStaleTokens(now?: number): number;
-    getEffectiveTokens(sessionId?: string, userKey?: string): Promise<UserTokens | null>;
-    createSessionWithUser(sessionId: string, userKey: string, remoteIp?: string): Promise<SessionInfo>;
     getStats(): {
         sessionsCount: number;
-        tokensCount: number;
-        oauthStatesCount: number;
     };
+    getTokensForUser(userKey: string): Promise<UserTokens | null>;
+    setTokensForUser(userKey: string, tokens: UserTokens): Promise<void>;
+    deleteTokensForUser(userKey: string): Promise<void>;
+    /** Evict stale token entries (no-op for a store with native key-expiry, e.g. Redis). */
+    evictStaleTokens(now?: number): Promise<number>;
 }
 //# sourceMappingURL=session-context.d.ts.map

package/dist/sessions/session-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../src/sessions/session-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,qBAAa,cAAc;IAC1B;;wEAEoE;IACpE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAuB;IAChE,OAAO,CAAC,MAAM,CAAC,SAAS,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAiC;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;IAC9D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IAEvD,WAAkB,QAAQ,IAAI,cAAc,CAK3C;IAED,OAAO,CAAC,cAAc;IAKf,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW;IAgBlF,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAItD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAS/C,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,6BAA6B,GAAG,IAAI;IAOtF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ1D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAiBtC,cAAc,IAAI,WAAW,EAAE;IAI/B,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE;IAI5C,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQlE,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASpE,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzD,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM;IAY7D,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI;IAa1D,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIzE,yBAAyB,IAAI,IAAI;IASxC;;;;;;;;OAQG;IACI,gBAAgB,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM;IAkB5C,kBAAkB,CAC9B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAUhB,qBAAqB,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,CAAC;IAKhB,QAAQ,IAAI;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE;CAO3F"}
+{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../src/sessions/session-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAsB,UAAU,EAAE,MAAM,eAAe,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,6BAA6B,GAAG,SAAS,CAAC;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IAC1B,OAAO,CAAC,MAAM,CAAC,SAAS,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;IAC5D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IAGvD,OAAO,CAAC,WAAW,CAAwC;IAE3D,WAAkB,QAAQ,IAAI,cAAc,CAK3C;IAED,yFAAyF;IAClF,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAItC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW;IAgBlF,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAItD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAS/C,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,6BAA6B,GAAG,IAAI;IAOtF,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAQ1D,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAiBtC,cAAc,IAAI,WAAW,EAAE;IAI/B,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,EAAE;IAIlD,QAAQ,IAAI;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE;IAMrC,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7D,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,wFAAwF;IACjF,gBAAgB,CAAC,GAAG,GAAE,MAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;CAGlE"}

package/dist/sessions/session-context.js

@@ -4,27 +4,31 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionContext = void 0;
-const crypto_1 = __importDefault(require("crypto"));
 const log_1 = __importDefault(require("../log"));
+const token_store_1 = require("./token-store");
+/**
+ * Tracks live MCP streamable-HTTP sessions (id ↔ transport ↔ user identity) for the HTTP server.
+ *
+ * In the stateless per-request Bearer model the MCP stores NO tokens: every request carries its own
+ * Creatio access token (delegated: from the client; gateway: injected by the Control-Plane). This
+ * context therefore only manages transport/session lifecycle and the identity used for logging.
+ */
 class SessionContext {
-    /** Idle window after which a token entry is considered abandoned and evicted, even if it
-     *  still has a refresh token. Generous (24h) so a returning client within a normal working
-     *  day keeps transparent refresh; resets on every store/refresh. */
-    static TOKEN_IDLE_TTL_MS = 24 * 60 * 60 * 1000;
     static _instance;
     _sessions = new Map();
-    _userTokens = new Map();
-    _oauthStates = new Map();
     _deletingSessions = new Set();
+    // Broker-mode Creatio token store. Defaults to in-memory (single instance, lost on restart);
+    // swapped for the Redis store at startup via {@link setTokenStore} when configured.
+    _tokenStore = new token_store_1.InMemoryTokenStore();
     static get instance() {
         if (!SessionContext._instance) {
             SessionContext._instance = new SessionContext();
         }
         return SessionContext._instance;
     }
-    _generateState() {
-        // Cryptographically secure, unguessable CSRF/state token (CWE-330).
-        return crypto_1.default.randomBytes(32).toString('base64url');
+    /** Swap the broker token store (e.g. Redis) — call once at startup, broker mode only. */
+    setTokenStore(store) {
+        this._tokenStore = store;
     }
     createSession(sessionId, userKey, remoteIp) {
         const session = {
@@ -91,106 +95,22 @@ class SessionContext {
     getSessionsForUser(userKey) {
         return Array.from(this._sessions.values()).filter((s) => s.userKey === userKey);
     }
-    async getTokensForSession(sessionId) {
-        const session = this._sessions.get(sessionId);
-        if (!session?.userKey) {
-            return null;
-        }
-        return this.getTokensForUser(session.userKey);
-    }
-    async getTokensForUser(userKey) {
-        return this._userTokens.get(userKey) || null;
-    }
-    async setTokensForUser(userKey, tokens) {
-        // Stamp the store time (unless the caller supplied one) so idle eviction can tell a
-        // recently-refreshed token from an abandoned one.
-        this._userTokens.set(userKey, {
-            ...tokens,
-            storedAtMs: tokens.storedAtMs ?? Date.now(),
-        });
-    }
-    async deleteTokensForUser(userKey) {
-        this._userTokens.delete(userKey);
-    }
-    createOAuthState(userKey, sessionId) {
-        const state = this._generateState();
-        const stateInfo = {
-            userKey,
-            sessionId,
-            createdAt: Date.now(),
-            expiresAt: Date.now() + 10 * 60 * 1000,
-        };
-        this._oauthStates.set(state, stateInfo);
-        return state;
+    getStats() {
+        return { sessionsCount: this._sessions.size };
     }
-    validateOAuthState(state) {
-        const stateInfo = this._oauthStates.get(state);
-        if (!stateInfo) {
-            return null;
-        }
-        if (Date.now() > stateInfo.expiresAt) {
-            this._oauthStates.delete(state);
-            return null;
-        }
-        this._oauthStates.delete(state);
-        return { userKey: stateInfo.userKey, sessionId: stateInfo.sessionId };
+    // --- Per-user Creatio token store (broker mode only) — delegated to the configured TokenStore ---
+    getTokensForUser(userKey) {
+        return this._tokenStore.get(userKey);
     }
-    validateAndConsumeOAuthState(state) {
-        return this.validateOAuthState(state) ?? undefined;
+    setTokensForUser(userKey, tokens) {
+        return this._tokenStore.set(userKey, tokens);
     }
-    cleanupExpiredOAuthStates() {
-        const now = Date.now();
-        for (const [state, stateInfo] of this._oauthStates.entries()) {
-            if (now > stateInfo.expiresAt) {
-                this._oauthStates.delete(state);
-            }
-        }
+    deleteTokensForUser(userKey) {
+        return this._tokenStore.delete(userKey);
     }
-    /**
-     * Bound the per-user token map on a long-running process WITHOUT evicting tokens a client
-     * could still use. Refresh is keyed by userKey (not session) — Bearer clients carry identity
-     * in the JWT and often have no live session between reconnects — so a token is removed only
-     * when it is genuinely unreachable:
-     *  - expired AND has no refresh token (cannot be revived), or
-     *  - idle past {@link TOKEN_IDLE_TTL_MS} since it was last stored/refreshed (abandoned).
-     * Unexpired tokens and recently-stored refreshable tokens are always kept. Returns count removed.
-     */
+    /** Evict stale token entries (no-op for a store with native key-expiry, e.g. Redis). */
     evictStaleTokens(now = Date.now()) {
-        let removed = 0;
-        for (const [userKey, tokens] of this._userTokens.entries()) {
-            const expired = now > tokens.accessTokenExpiryMs;
-            const deadNoRefresh = expired && !tokens.refreshToken;
-            const idleFor = now - (tokens.storedAtMs ?? now);
-            const abandoned = idleFor > SessionContext.TOKEN_IDLE_TTL_MS;
-            if (deadNoRefresh || abandoned) {
-                this._userTokens.delete(userKey);
-                removed++;
-            }
-        }
-        if (removed > 0) {
-            log_1.default.info('session.tokens.evicted', { removed, remaining: this._userTokens.size });
-        }
-        return removed;
-    }
-    async getEffectiveTokens(sessionId, userKey) {
-        if (userKey) {
-            return this.getTokensForUser(userKey);
-        }
-        if (sessionId) {
-            return this.getTokensForSession(sessionId);
-        }
-        return null;
-    }
-    async createSessionWithUser(sessionId, userKey, remoteIp) {
-        const session = this.createSession(sessionId, userKey, remoteIp);
-        return session;
-    }
-    getStats() {
-        return {
-            sessionsCount: this._sessions.size,
-            tokensCount: this._userTokens.size,
-            oauthStatesCount: this._oauthStates.size,
-        };
+        return this._tokenStore.evictStale(now);
     }
 }
 exports.SessionContext = SessionContext;

package/dist/sessions/session-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../src/sessions/session-context.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAI5B,iDAAyB;AA+BzB,MAAa,cAAc;IAC1B;;wEAEoE;IAC5D,MAAM,CAAU,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACxD,MAAM,CAAC,SAAS,CAA6B;IACpC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,MAAM,KAAK,QAAQ;QACzB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC/B,cAAc,CAAC,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,cAAc;QACrB,oEAAoE;QACpE,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAEM,aAAa,CAAC,SAAiB,EAAE,OAAgB,EAAE,QAAiB;QAC1E,MAAM,OAAO,GAAgB;YAC5B,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,mBAAmB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,mBAAmB,CAAC,SAAiB,EAAE,SAAwC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;IACF,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YAC1B,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAEM,aAAa,CAAC,SAAiB;QACrC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,cAAc;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,kBAAkB,CAAC,OAAe;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,MAAkB;QAChE,oFAAoF;QACpF,kDAAkD;QAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7B,GAAG,MAAM;YACT,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE;SAC3C,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,OAAe;QAC/C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEM,gBAAgB,CAAC,OAAe,EAAE,SAAkB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,SAAS,GAAe;YAC7B,OAAO;YACP,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SACtC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,kBAAkB,CAAC,KAAa;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;IACvE,CAAC;IAEM,4BAA4B,CAAC,KAAa;QAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACpD,CAAC;IAEM,yBAAyB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACI,gBAAgB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC;YACjD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACtD,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,OAAO,GAAG,cAAc,CAAC,iBAAiB,CAAC;YAC7D,IAAI,aAAa,IAAI,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC9B,SAAkB,EAClB,OAAgB;QAEhB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,qBAAqB,CACjC,SAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,QAAQ;QACd,OAAO;YACN,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAClC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACxC,CAAC;IACH,CAAC;;AAtNF,wCAuNC"}
+{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../src/sessions/session-context.ts"],"names":[],"mappings":";;;;;;AAEA,iDAAyB;AAEzB,+CAA+D;AAuB/D;;;;;;GAMG;AACH,MAAa,cAAc;IAClB,MAAM,CAAC,SAAS,CAA6B;IACpC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IACvD,6FAA6F;IAC7F,oFAAoF;IAC5E,WAAW,GAAe,IAAI,gCAAkB,EAAE,CAAC;IAEpD,MAAM,KAAK,QAAQ;QACzB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC/B,cAAc,CAAC,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,yFAAyF;IAClF,aAAa,CAAC,KAAiB;QACrC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,CAAC;IAEM,aAAa,CAAC,SAAiB,EAAE,OAAgB,EAAE,QAAiB;QAC1E,MAAM,OAAO,GAAgB;YAC5B,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,mBAAmB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,mBAAmB,CAAC,SAAiB,EAAE,SAAwC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;IACF,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YAC1B,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAEM,aAAa,CAAC,SAAiB;QACrC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,cAAc;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,kBAAkB,CAAC,OAAe;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjF,CAAC;IAEM,QAAQ;QACd,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,mGAAmG;IAE5F,gBAAgB,CAAC,OAAe;QACtC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAEM,gBAAgB,CAAC,OAAe,EAAE,MAAkB;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEM,mBAAmB,CAAC,OAAe;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,wFAAwF;IACjF,gBAAgB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;CACD;AAnHD,wCAmHC"}

package/dist/sessions/token-crypto.d.ts

@@ -0,0 +1,8 @@
+/** Derive a stable 32-byte key from a secret (any length), domain-separated so it never collides
+ *  with the JWT-signing use of the same secret when no dedicated `CREATIO_MCP_TOKEN_ENC_KEY` is set. */
+export declare function deriveTokenKey(secret: string): Buffer;
+/** Encrypt to a self-describing `iv.tag.ciphertext` (base64url) blob. */
+export declare function encryptToken(plaintext: string, key: Buffer): string;
+/** Decrypt an `iv.tag.ciphertext` blob; throws if the key is wrong or the blob was tampered with. */
+export declare function decryptToken(blob: string, key: Buffer): string;
+//# sourceMappingURL=token-crypto.d.ts.map

package/dist/sessions/token-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-crypto.d.ts","sourceRoot":"","sources":["../../src/sessions/token-crypto.ts"],"names":[],"mappings":"AAUA;wGACwG;AACxG,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMnE;AAED,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAW9D"}

package/dist/sessions/token-crypto.js

@@ -0,0 +1,43 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveTokenKey = deriveTokenKey;
+exports.encryptToken = encryptToken;
+exports.decryptToken = decryptToken;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * AES-256-GCM encryption for tokens at rest. Stored Creatio tokens are bearer credentials, so a
+ * persistent store (Redis) must never hold them in plaintext — a dump of the store would otherwise
+ * be a credential leak. GCM gives confidentiality + integrity (a tampered blob fails to decrypt).
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+/** Derive a stable 32-byte key from a secret (any length), domain-separated so it never collides
+ *  with the JWT-signing use of the same secret when no dedicated `CREATIO_MCP_TOKEN_ENC_KEY` is set. */
+function deriveTokenKey(secret) {
+    return node_crypto_1.default.createHash('sha256').update(`mcp-creatio:token-enc:${secret}`).digest();
+}
+/** Encrypt to a self-describing `iv.tag.ciphertext` (base64url) blob. */
+function encryptToken(plaintext, key) {
+    const iv = node_crypto_1.default.randomBytes(IV_BYTES);
+    const cipher = node_crypto_1.default.createCipheriv(ALGORITHM, key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [iv, tag, ciphertext].map((b) => b.toString('base64url')).join('.');
+}
+/** Decrypt an `iv.tag.ciphertext` blob; throws if the key is wrong or the blob was tampered with. */
+function decryptToken(blob, key) {
+    const [ivB64, tagB64, ctB64] = blob.split('.');
+    if (!ivB64 || !tagB64 || !ctB64) {
+        throw new Error('token_blob_malformed');
+    }
+    const decipher = node_crypto_1.default.createDecipheriv(ALGORITHM, key, Buffer.from(ivB64, 'base64url'));
+    decipher.setAuthTag(Buffer.from(tagB64, 'base64url'));
+    return Buffer.concat([
+        decipher.update(Buffer.from(ctB64, 'base64url')),
+        decipher.final(),
+    ]).toString('utf8');
+}
+//# sourceMappingURL=token-crypto.js.map

package/dist/sessions/token-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-crypto.js","sourceRoot":"","sources":["../../src/sessions/token-crypto.ts"],"names":[],"mappings":";;;;;AAYA,wCAEC;AAGD,oCAMC;AAGD,oCAWC;AArCD,8DAAiC;AAEjC;;;;GAIG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB;wGACwG;AACxG,SAAgB,cAAc,CAAC,MAAc;IAC5C,OAAO,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACvF,CAAC;AAED,yEAAyE;AACzE,SAAgB,YAAY,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,qBAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,qBAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED,qGAAqG;AACrG,SAAgB,YAAY,CAAC,IAAY,EAAE,GAAW;IACrD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChD,QAAQ,CAAC,KAAK,EAAE;KAChB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC"}

package/dist/sessions/token-store.d.ts

@@ -0,0 +1,42 @@
+import type { UserTokens } from './session-context';
+/** Idle window after which an abandoned token entry is evicted (24h), even if refreshable. */
+export declare const TOKEN_IDLE_TTL_MS: number;
+/**
+ * Where the broker keeps each user's Creatio tokens. The default {@link InMemoryTokenStore} is fine
+ * for a single dev/process instance (tokens are lost on restart); {@link RedisTokenStore} makes the
+ * broker stateless + horizontally scalable + restart-durable for production. Async by contract so a
+ * network-backed store fits without changing callers.
+ */
+export interface TokenStore {
+    get(userKey: string): Promise<UserTokens | null>;
+    set(userKey: string, tokens: UserTokens): Promise<void>;
+    delete(userKey: string): Promise<void>;
+    /** Drop entries that are dead-and-non-refreshable or idle past the TTL; returns how many. A
+     *  store with native key-expiry (Redis) returns 0 here — expiry is handled on write. */
+    evictStale(now: number): Promise<number>;
+    close(): Promise<void>;
+}
+export declare class InMemoryTokenStore implements TokenStore {
+    private readonly _tokens;
+    get(userKey: string): Promise<UserTokens | null>;
+    set(userKey: string, tokens: UserTokens): Promise<void>;
+    delete(userKey: string): Promise<void>;
+    evictStale(now: number): Promise<number>;
+    close(): Promise<void>;
+    /** Test/diagnostic helper — current entry count. */
+    size(): number;
+}
+export type TokenStoreKind = 'memory' | 'redis';
+export interface TokenStoreConfig {
+    kind: TokenStoreKind;
+    /** Redis connection URL (redis store only). */
+    redisUrl?: string | undefined;
+    /** Secret the at-rest encryption key is derived from (redis store only). */
+    encryptionSecret?: string | undefined;
+}
+/**
+ * Build the configured token store. Redis is imported lazily (and listed as a dependency) so a
+ * memory-mode deployment never loads it. Encryption is mandatory for the Redis store.
+ */
+export declare function createTokenStore(config: TokenStoreConfig): Promise<TokenStore>;
+//# sourceMappingURL=token-store.d.ts.map

package/dist/sessions/token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../../src/sessions/token-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,QAAsB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;4FACwF;IACxF,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,qBAAa,kBAAmB,YAAW,UAAU;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAE5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAInC,oDAAoD;IAC7C,IAAI,IAAI,MAAM;CAGrB;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBpF"}

package/dist/sessions/token-store.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryTokenStore = exports.TOKEN_IDLE_TTL_MS = void 0;
+exports.createTokenStore = createTokenStore;
+const log_1 = __importDefault(require("../log"));
+const token_crypto_1 = require("./token-crypto");
+/** Idle window after which an abandoned token entry is evicted (24h), even if refreshable. */
+exports.TOKEN_IDLE_TTL_MS = 24 * 60 * 60 * 1000;
+class InMemoryTokenStore {
+    _tokens = new Map();
+    async get(userKey) {
+        return this._tokens.get(userKey) ?? null;
+    }
+    async set(userKey, tokens) {
+        this._tokens.set(userKey, { ...tokens, storedAtMs: tokens.storedAtMs ?? Date.now() });
+    }
+    async delete(userKey) {
+        this._tokens.delete(userKey);
+    }
+    async evictStale(now) {
+        let removed = 0;
+        for (const [userKey, tokens] of this._tokens) {
+            const deadNoRefresh = now > tokens.accessTokenExpiryMs && !tokens.refreshToken;
+            const abandoned = now - (tokens.storedAtMs ?? now) > exports.TOKEN_IDLE_TTL_MS;
+            if (deadNoRefresh || abandoned) {
+                this._tokens.delete(userKey);
+                removed++;
+            }
+        }
+        if (removed > 0) {
+            log_1.default.info('session.tokens.evicted', { removed, remaining: this._tokens.size });
+        }
+        return removed;
+    }
+    async close() {
+        this._tokens.clear();
+    }
+    /** Test/diagnostic helper — current entry count. */
+    size() {
+        return this._tokens.size;
+    }
+}
+exports.InMemoryTokenStore = InMemoryTokenStore;
+/**
+ * Build the configured token store. Redis is imported lazily (and listed as a dependency) so a
+ * memory-mode deployment never loads it. Encryption is mandatory for the Redis store.
+ */
+async function createTokenStore(config) {
+    if (config.kind === 'memory') {
+        return new InMemoryTokenStore();
+    }
+    if (!config.redisUrl) {
+        throw new Error('redis token store requires CREATIO_MCP_REDIS_URL');
+    }
+    if (!config.encryptionSecret) {
+        throw new Error('redis token store requires an encryption secret (CREATIO_MCP_JWT_SECRET)');
+    }
+    const { RedisTokenStore } = await import('./redis-token-store.js');
+    const store = new RedisTokenStore(config.redisUrl, (0, token_crypto_1.deriveTokenKey)(config.encryptionSecret), Math.floor(exports.TOKEN_IDLE_TTL_MS / 1000));
+    await store.connect();
+    return store;
+}
+//# sourceMappingURL=token-store.js.map

package/dist/sessions/token-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../../src/sessions/token-store.ts"],"names":[],"mappings":";;;;;;AAgFA,4CAkBC;AAlGD,iDAAyB;AAEzB,iDAAgD;AAIhD,8FAA8F;AACjF,QAAA,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAkBrD,MAAa,kBAAkB;IACb,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAElD,KAAK,CAAC,GAAG,CAAC,OAAe;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,MAAkB;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAe;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,GAAW;QAClC,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,GAAG,GAAG,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC/E,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,yBAAiB,CAAC;YACvE,IAAI,aAAa,IAAI,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7B,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,oDAAoD;IAC7C,IAAI;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1B,CAAC;CACD;AAvCD,gDAuCC;AAYD;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,MAAwB;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,eAAe,CAChC,MAAM,CAAC,QAAQ,EACf,IAAA,6BAAc,EAAC,MAAM,CAAC,gBAAgB,CAAC,EACvC,IAAI,CAAC,KAAK,CAAC,yBAAiB,GAAG,IAAI,CAAC,CACpC,CAAC;IACF,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK,CAAC;AACd,CAAC"}