mcp-creatio 0.6.2 → 0.6.4

package/dist/utils/context.d.ts

@@ -1,10 +1,22 @@
 export type RequestContext = {
     userKey?: string | undefined;
     sessionId?: string | undefined;
+    /**
+     * The raw Bearer token from the incoming request, in the stateless per-request auth model
+     * (delegated/gateway). It is the Creatio access token the client/gateway obtained; the bearer
+     * auth provider passes it straight through to Creatio. Absent for legacy/client-credentials.
+     */
+    bearerToken?: string | undefined;
+    /** Optional per-request Creatio instance override (gateway multi-tenant), from X-Creatio-Base-Url. */
+    baseUrlOverride?: string | undefined;
 };
 export declare function runWithContext<T>(ctx: Partial<RequestContext>, fn: () => Promise<T>): Promise<T>;
 export declare function getRequestContext(): RequestContext | undefined;
 export declare function getUserKey(): string | undefined;
 export declare function getSessionId(): string | undefined;
+/** The raw per-request Bearer token (stateless delegated/gateway auth), if any. */
+export declare function getBearerToken(): string | undefined;
+/** The per-request Creatio base-URL override (gateway multi-tenant), if any. */
+export declare function getBaseUrlOverride(): string | undefined;
 export declare function getEffectiveUserKey(): string | undefined;
 //# sourceMappingURL=context.d.ts.map

package/dist/utils/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B,CAAC;AAMF,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAShG;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAE/C;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sGAAsG;IACtG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC,CAAC;AAMF,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAehG;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED,wBAAgB,UAAU,IAAI,MAAM,GAAG,SAAS,CAE/C;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAEjD;AAED,mFAAmF;AACnF,wBAAgB,cAAc,IAAI,MAAM,GAAG,SAAS,CAEnD;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAYxD"}

package/dist/utils/context.js

@@ -4,6 +4,8 @@ exports.runWithContext = runWithContext;
 exports.getRequestContext = getRequestContext;
 exports.getUserKey = getUserKey;
 exports.getSessionId = getSessionId;
+exports.getBearerToken = getBearerToken;
+exports.getBaseUrlOverride = getBaseUrlOverride;
 exports.getEffectiveUserKey = getEffectiveUserKey;
 const node_async_hooks_1 = require("node:async_hooks");
 const sessions_1 = require("../sessions");
@@ -17,6 +19,12 @@ function runWithContext(ctx, fn) {
     if (typeof ctx.sessionId === 'string') {
         store.sessionId = ctx.sessionId;
     }
+    if (typeof ctx.bearerToken === 'string') {
+        store.bearerToken = ctx.bearerToken;
+    }
+    if (typeof ctx.baseUrlOverride === 'string') {
+        store.baseUrlOverride = ctx.baseUrlOverride;
+    }
     return als.run(store, fn);
 }
 function getRequestContext() {
@@ -28,6 +36,14 @@ function getUserKey() {
 function getSessionId() {
     return als.getStore()?.sessionId;
 }
+/** The raw per-request Bearer token (stateless delegated/gateway auth), if any. */
+function getBearerToken() {
+    return als.getStore()?.bearerToken;
+}
+/** The per-request Creatio base-URL override (gateway multi-tenant), if any. */
+function getBaseUrlOverride() {
+    return als.getStore()?.baseUrlOverride;
+}
 function getEffectiveUserKey() {
     const ctx = als.getStore();
     if (ctx?.userKey) {

package/dist/utils/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":";;AAaA,wCASC;AAED,8CAEC;AAED,gCAEC;AAED,oCAEC;AAED,kDAYC;AAhDD,uDAAqD;AAErD,0CAA6C;AAO7C,MAAM,GAAG,GAAG,IAAI,oCAAiB,EAAkB,CAAC;AAEpD,MAAM,cAAc,GAAG,yBAAc,CAAC,QAAQ,CAAC;AAE/C,SAAgB,cAAc,CAAI,GAA4B,EAAE,EAAoB;IACnF,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,iBAAiB;IAChC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAgB,UAAU;IACzB,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;AAChC,CAAC;AAED,SAAgB,YAAY;IAC3B,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;AAClC,CAAC;AAED,SAAgB,mBAAmB;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,OAAO,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC;QACxB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,EAAE,SAAS,CAAC;AACvB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/utils/context.ts"],"names":[],"mappings":";;AAqBA,wCAeC;AAED,8CAEC;AAED,gCAEC;AAED,oCAEC;AAGD,wCAEC;AAGD,gDAEC;AAED,kDAYC;AAxED,uDAAqD;AAErD,0CAA6C;AAe7C,MAAM,GAAG,GAAG,IAAI,oCAAiB,EAAkB,CAAC;AAEpD,MAAM,cAAc,GAAG,yBAAc,CAAC,QAAQ,CAAC;AAE/C,SAAgB,cAAc,CAAI,GAA4B,EAAE,EAAoB;IACnF,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACzC,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC7C,KAAK,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,iBAAiB;IAChC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAgB,UAAU;IACzB,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;AAChC,CAAC;AAED,SAAgB,YAAY;IAC3B,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,SAAgB,cAAc;IAC7B,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,SAAgB,kBAAkB;IACjC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC;AACxC,CAAC;AAED,SAAgB,mBAAmB;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO,GAAG,CAAC,OAAO,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,OAAO,CAAC;QACxB,CAAC;IACF,CAAC;IACD,OAAO,GAAG,EAAE,SAAS,CAAC;AACvB,CAAC"}

package/dist/utils/env-aliases.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Resolves a legacy value for a canonical variable when the canonical one is unset. Returns the
+ * first legacy alias that holds a value (notifying once per deprecated alias actually used), or
+ * `undefined` when the variable has no aliases / none are set.
+ *
+ * `read` is injected (DIP) so this stays decoupled from how a raw env value is fetched/normalized.
+ */
+export declare function resolveLegacyEnv(canonical: string, read: (name: string) => string | undefined): string | undefined;
+//# sourceMappingURL=env-aliases.d.ts.map

package/dist/utils/env-aliases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-aliases.d.ts","sourceRoot":"","sources":["../../src/utils/env-aliases.ts"],"names":[],"mappings":"AAoDA;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GACxC,MAAM,GAAG,SAAS,CAgBpB"}

package/dist/utils/env-aliases.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveLegacyEnv = resolveLegacyEnv;
+/**
+ * Single source of truth for backward-compatible environment names: each CANONICAL variable maps to
+ * the legacy names it superseded. Centralizing it here means the rename never leaks ad-hoc fallbacks
+ * across the codebase — call sites read only canonical names and this layer resolves the rest.
+ *
+ * These legacy names are intentionally undocumented; they exist only so an early adopter who already
+ * set an old name keeps working (with a deprecation notice) until they migrate.
+ */
+const LEGACY_ALIASES = {
+    // Platform convention — kept indefinitely, no deprecation notice.
+    CREATIO_MCP_PORT: [{ name: 'PORT', deprecated: false }],
+    // Renamed under the unified scheme — supported transitionally with a deprecation notice.
+    CREATIO_MCP_LOG_LEVEL: [{ name: 'MCP_CREATIO_LOG_LEVEL', deprecated: true }],
+    CREATIO_MCP_READONLY: [{ name: 'READONLY_MODE', deprecated: true }],
+    CREATIO_MCP_CRUD_BACKEND: [{ name: 'CREATIO_CRUD_BACKEND', deprecated: true }],
+    CREATIO_MCP_DISABLE_DATAFORGE: [{ name: 'DISABLE_DATAFORGE', deprecated: true }],
+    CREATIO_MCP_DISABLE_GLOBAL_SEARCH: [{ name: 'DISABLE_GLOBAL_SEARCH', deprecated: true }],
+    CREATIO_MCP_ENABLE_PUBLISHED_TOOLS: [{ name: 'ENABLE_PUBLISHED_TOOLS', deprecated: true }],
+    CREATIO_MCP_TRANSPORT: [{ name: 'MCP_TRANSPORT', deprecated: true }],
+};
+const _warned = new Set();
+/**
+ * Emits the deprecation notice straight to stderr (not the structured logger) on purpose: the
+ * logging module resolves its own level through `env()`, so depending on it here would create an
+ * env ↔ log import cycle. A one-line stderr notice keeps this layer self-contained.
+ */
+function noticeOnce(alias, canonical) {
+    if (_warned.has(alias)) {
+        return;
+    }
+    _warned.add(alias);
+    process.stderr.write(`[mcp-creatio] Environment variable "${alias}" is deprecated; use "${canonical}" instead.\n`);
+}
+/**
+ * Resolves a legacy value for a canonical variable when the canonical one is unset. Returns the
+ * first legacy alias that holds a value (notifying once per deprecated alias actually used), or
+ * `undefined` when the variable has no aliases / none are set.
+ *
+ * `read` is injected (DIP) so this stays decoupled from how a raw env value is fetched/normalized.
+ */
+function resolveLegacyEnv(canonical, read) {
+    const aliases = LEGACY_ALIASES[canonical];
+    if (!aliases) {
+        return undefined;
+    }
+    for (const alias of aliases) {
+        const value = read(alias.name);
+        if (value === undefined) {
+            continue;
+        }
+        if (alias.deprecated) {
+            noticeOnce(alias.name, canonical);
+        }
+        return value;
+    }
+    return undefined;
+}
+//# sourceMappingURL=env-aliases.js.map

package/dist/utils/env-aliases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-aliases.js","sourceRoot":"","sources":["../../src/utils/env-aliases.ts"],"names":[],"mappings":";;AA2DA,4CAmBC;AAhED;;;;;;;GAOG;AACH,MAAM,cAAc,GAAqD;IACxE,kEAAkE;IAClE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvD,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC5E,oBAAoB,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnE,wBAAwB,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9E,6BAA6B,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAChF,iCAAiC,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxF,kCAAkC,EAAE,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1F,qBAAqB,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;CACpE,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;AAElC;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,SAAiB;IACnD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,uCAAuC,KAAK,yBAAyB,SAAS,cAAc,CAC5F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC/B,SAAiB,EACjB,IAA0C;IAE1C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/utils/env.d.ts

@@ -1,3 +1,8 @@
+/**
+ * Reads an environment variable by its CANONICAL name, transparently falling back to any legacy
+ * alias (see {@link resolveLegacyEnv}) for backward compatibility. Returns `undefined` for unset or
+ * blank values.
+ */
 export declare function env(name: string): string | undefined;
 export declare function envBool(name: string, def: boolean): boolean;
 //# sourceMappingURL=env.d.ts.map

package/dist/utils/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAAA,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAM3D"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAM3D"}

package/dist/utils/env.js

@@ -2,10 +2,19 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.env = env;
 exports.envBool = envBool;
-function env(name) {
+const env_aliases_1 = require("./env-aliases");
+function readRaw(name) {
     const v = process.env[name];
     return (v && v.trim()) || undefined;
 }
+/**
+ * Reads an environment variable by its CANONICAL name, transparently falling back to any legacy
+ * alias (see {@link resolveLegacyEnv}) for backward compatibility. Returns `undefined` for unset or
+ * blank values.
+ */
+function env(name) {
+    return readRaw(name) ?? (0, env_aliases_1.resolveLegacyEnv)(name, readRaw);
+}
 function envBool(name, def) {
     const v = env(name);
     if (v == null) {

package/dist/utils/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":";;AAAA,kBAGC;AAED,0BAMC;AAXD,SAAgB,GAAG,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACrC,CAAC;AAED,SAAgB,OAAO,CAAC,IAAY,EAAE,GAAY;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;AAChD,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/utils/env.ts"],"names":[],"mappings":";;AAYA,kBAEC;AAED,0BAMC;AAtBD,+CAAiD;AAEjD,SAAS,OAAO,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,SAAS,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAgB,GAAG,CAAC,IAAY;IAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,IAAA,8BAAgB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAgB,OAAO,CAAC,IAAY,EAAE,GAAY;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC;AAChD,CAAC"}

package/dist/utils/index.d.ts

@@ -3,4 +3,5 @@ export * from './mcp';
 export * from './network';
 export * from './pkce';
 export * from './context';
+export * from './redact';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC"}

package/dist/utils/index.js

@@ -19,4 +19,5 @@ __exportStar(require("./mcp"), exports);
 __exportStar(require("./network"), exports);
 __exportStar(require("./pkce"), exports);
 __exportStar(require("./context"), exports);
+__exportStar(require("./redact"), exports);
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,wCAAsB;AACtB,4CAA0B;AAC1B,yCAAuB;AACvB,4CAA0B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,wCAAsB;AACtB,4CAA0B;AAC1B,yCAAuB;AACvB,4CAA0B;AAC1B,2CAAyB"}

package/dist/utils/redact.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Central secret-scrubber for anything that crosses an outward boundary — tool results relayed to
+ * the LLM client and log lines. Invariant #7 / §9 in AGENTS.md ("do not leak secrets or access
+ * tokens in tool responses; strip or mask token-like values") used to be a convention enforced by
+ * hand at each call site; this turns it into one guaranteed choke point.
+ *
+ * It is defense-in-depth, NOT the primary control: providers should still avoid putting credentials
+ * into messages/results in the first place. Because it errs toward over-redaction (a stray "Token
+ * abc" in prose is scrubbed), it is intentionally applied only at the two outward edges, never to
+ * data the server operates on internally.
+ *
+ * Complements {@link redactUrl} in the HTTP middleware (which scrubs single-use OAuth codes from
+ * request URLs) — that one is URL/query-specific; this one is a general value scrubber.
+ */
+/**
+ * Mask credential-looking substrings in arbitrary text. Idempotent (re-running yields the same
+ * output) and safe on non-secret text (returns it unchanged). Always returns a string.
+ */
+export declare function redactSecrets(input: unknown): string;
+/**
+ * Redact secrets from an Error's message while preserving the Error instance (type + stack), so the
+ * MCP layer can relay a clean message without losing diagnostics. Non-Error throwables are wrapped.
+ */
+export declare function redactError(err: unknown): Error;
+//# sourceMappingURL=redact.d.ts.map

package/dist/utils/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAqBH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQpD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAY/C"}

package/dist/utils/redact.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Central secret-scrubber for anything that crosses an outward boundary — tool results relayed to
+ * the LLM client and log lines. Invariant #7 / §9 in AGENTS.md ("do not leak secrets or access
+ * tokens in tool responses; strip or mask token-like values") used to be a convention enforced by
+ * hand at each call site; this turns it into one guaranteed choke point.
+ *
+ * It is defense-in-depth, NOT the primary control: providers should still avoid putting credentials
+ * into messages/results in the first place. Because it errs toward over-redaction (a stray "Token
+ * abc" in prose is scrubbed), it is intentionally applied only at the two outward edges, never to
+ * data the server operates on internally.
+ *
+ * Complements {@link redactUrl} in the HTTP middleware (which scrubs single-use OAuth codes from
+ * request URLs) — that one is URL/query-specific; this one is a general value scrubber.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSecrets = redactSecrets;
+exports.redactError = redactError;
+const REDACTED = '[REDACTED]';
+/**
+ * A value following an auth scheme keyword: `Bearer <jwt>`, `Basic <b64>`, `ApiKey <v>`, `Token <v>`.
+ * The scheme is preserved (it is not the secret); only the credential after it is masked.
+ */
+const AUTH_SCHEME_VALUE_RE = /\b(Bearer|Basic|ApiKey|Token)\s+[\w.\-+/=]+/gi;
+/** An `Authorization` header value in either `Authorization: <v>` or `Authorization=<v>` form. */
+const AUTHORIZATION_HEADER_RE = /\b(Authorization)(\s*[:=]\s*)[^\s,;"']+/gi;
+/**
+ * A secret-bearing parameter's VALUE in query-string (`client_secret=…`), form, or JSON
+ * (`"password":"…"`) shape. The key (and an optional opening quote) is preserved; the value up to
+ * the next delimiter/closing quote is masked. Stops before a closing `"` so JSON stays well-formed.
+ */
+const SECRET_PARAM_RE = /("?\b(?:client_secret|client_id_secret|api_key|apikey|password|passwd|pwd|access_token|refresh_token|id_token|session_token|secret|bpmcsrf)\b"?\s*[:=]\s*)("?)[^"\s,;&}]+/gi;
+/**
+ * Mask credential-looking substrings in arbitrary text. Idempotent (re-running yields the same
+ * output) and safe on non-secret text (returns it unchanged). Always returns a string.
+ */
+function redactSecrets(input) {
+    if (typeof input !== 'string' || input.length === 0) {
+        return typeof input === 'string' ? input : String(input ?? '');
+    }
+    return input
+        .replace(AUTH_SCHEME_VALUE_RE, (_m, scheme) => `${scheme} ${REDACTED}`)
+        .replace(AUTHORIZATION_HEADER_RE, (_m, key, sep) => `${key}${sep}${REDACTED}`)
+        .replace(SECRET_PARAM_RE, (_m, prefix, openQuote) => `${prefix}${openQuote}${REDACTED}`);
+}
+/**
+ * Redact secrets from an Error's message while preserving the Error instance (type + stack), so the
+ * MCP layer can relay a clean message without losing diagnostics. Non-Error throwables are wrapped.
+ */
+function redactError(err) {
+    if (err instanceof Error) {
+        try {
+            err.message = redactSecrets(err.message);
+        }
+        catch {
+            // Some exotic Error subclasses define a non-writable `message`; fall back to a wrapper
+            // that carries the redacted text while keeping the original as the cause for debugging.
+            return new Error(redactSecrets(err.message), { cause: err });
+        }
+        return err;
+    }
+    return new Error(redactSecrets(typeof err === 'string' ? err : String(err)));
+}
+//# sourceMappingURL=redact.js.map

package/dist/utils/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/utils/redact.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;AAyBH,sCAQC;AAMD,kCAYC;AAjDD,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;GAGG;AACH,MAAM,oBAAoB,GAAG,+CAA+C,CAAC;AAE7E,kGAAkG;AAClG,MAAM,uBAAuB,GAAG,2CAA2C,CAAC;AAE5E;;;;GAIG;AACH,MAAM,eAAe,GACpB,6KAA6K,CAAC;AAE/K;;;GAGG;AACH,SAAgB,aAAa,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK;SACV,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;SAC9E,OAAO,CAAC,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;SAC7F,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAc,EAAE,SAAiB,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,GAAY;IACvC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,GAAG,CAAC,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACR,uFAAuF;YACvF,wFAAwF;YACxF,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,aAAa,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/package.json

@@ -1,78 +1,80 @@
 {
-  "name": "mcp-creatio",
-  "version": "0.6.2",
-  "main": "dist/index.js",
-  "bin": {
-    "mcp-creatio": "dist/cli.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "clean": "rimraf ./dist",
-    "prebuild": "npm run clean",
-    "build": "tsc",
-    "start": "ts-node src/index.ts",
-    "start:cli": "ts-node src/cli.ts",
-    "start:stdio": "ts-node src/cli.ts",
-    "prepack": "npm run build",
-    "lint": "eslint --ext .ts src",
-    "lint:fix": "eslint --ext .ts src --fix",
-    "format": "prettier --write \"src/**/*.{ts,js,json,md}\"",
-    "format:check": "prettier --check \"src/**/*.{ts,js,json,md}\""
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/CRACKISH/mcp-creatio.git"
-  },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "creatio",
-    "creatio-crm",
-    "crm",
-    "odata",
-    "mcp-server",
-    "chatgpt",
-    "claude",
-    "github-copilot",
-    "typescript",
-    "ai-tools"
-  ],
-  "author": "",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/CRACKISH/mcp-creatio/issues"
-  },
-  "homepage": "https://github.com/CRACKISH/mcp-creatio#readme",
-  "description": "MCP server for Creatio CRM. Connect Claude Desktop, ChatGPT, and GitHub Copilot to Creatio via Model Context Protocol and OData v4.",
-  "devDependencies": {
-    "@types/express": "5.0.6",
-    "@types/node": "^26.0.1",
-    "@types/supertest": "^7.2.0",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
-    "@typescript-eslint/parser": "^8.62.0",
-    "@vitest/coverage-v8": "^4.1.9",
-    "eslint": "^9.39.4",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.6",
-    "prettier": "^3.8.4",
-    "rimraf": "^6.1.3",
-    "supertest": "^7.2.2",
-    "ts-node": "^10.9.2",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@types/jsonwebtoken": "^9.0.10",
-    "express": "^5.2.1",
-    "fast-xml-parser": "^5.9.3",
-    "jsonwebtoken": "^9.0.3",
-    "zod": "^4.4.3"
-  }
+	"name": "mcp-creatio",
+	"version": "0.6.4",
+	"main": "dist/index.js",
+	"bin": {
+		"mcp-creatio": "dist/cli.js"
+	},
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"test:coverage": "vitest run --coverage",
+		"clean": "rimraf ./dist",
+		"prebuild": "npm run clean",
+		"build": "tsc",
+		"start": "ts-node src/index.ts",
+		"start:cli": "ts-node src/cli.ts",
+		"start:stdio": "ts-node src/cli.ts",
+		"prepack": "npm run build",
+		"lint": "eslint --ext .ts src",
+		"lint:fix": "eslint --ext .ts src --fix",
+		"format": "prettier --write \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\"",
+		"format:check": "prettier --check \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\""
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/CRACKISH/mcp-creatio.git"
+	},
+	"keywords": [
+		"mcp",
+		"model-context-protocol",
+		"creatio",
+		"creatio-crm",
+		"crm",
+		"odata",
+		"mcp-server",
+		"chatgpt",
+		"claude",
+		"github-copilot",
+		"typescript",
+		"ai-tools"
+	],
+	"author": "",
+	"license": "MIT",
+	"bugs": {
+		"url": "https://github.com/CRACKISH/mcp-creatio/issues"
+	},
+	"homepage": "https://github.com/CRACKISH/mcp-creatio#readme",
+	"description": "MCP server for Creatio CRM. Connect Claude Desktop, ChatGPT, and GitHub Copilot to Creatio via Model Context Protocol and OData v4.",
+	"devDependencies": {
+		"@types/express": "5.0.6",
+		"@types/node": "^26.0.1",
+		"@types/supertest": "^7.2.0",
+		"@typescript-eslint/eslint-plugin": "^8.62.0",
+		"@typescript-eslint/parser": "^8.62.0",
+		"@vitest/coverage-v8": "^4.1.9",
+		"eslint": "^9.39.4",
+		"eslint-config-prettier": "^10.1.8",
+		"eslint-plugin-import": "^2.32.0",
+		"eslint-plugin-prettier": "^5.5.6",
+		"prettier": "^3.8.4",
+		"rimraf": "^6.1.3",
+		"supertest": "^7.2.2",
+		"ts-node": "^10.9.2",
+		"typescript": "^6.0.3",
+		"vitest": "^4.1.9"
+	},
+	"dependencies": {
+		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@types/jsonwebtoken": "^9.0.10",
+		"express": "^5.2.1",
+		"fast-xml-parser": "^5.9.3",
+		"jsonwebtoken": "^9.0.3",
+		"redis": "^4.7.1",
+		"undici": "^6.27.0",
+		"zod": "^4.4.3"
+	}
 }

package/dist/creatio/auth/providers/oauth2-code-provider.d.ts

@@ -1,21 +0,0 @@
-import { CreatioClientConfig, OAuth2CodeAuthConfig } from '../../client-config';
-import { BaseOAuth2Provider } from './base-oauth2-provider';
-export declare class OAuth2CodeProvider extends BaseOAuth2Provider<OAuth2CodeAuthConfig> {
-    private readonly _sessionContext;
-    private readonly _tokenRefreshScheduler;
-    private readonly _inflightRefresh;
-    protected readonly authErrorCode = "oauth2_code_need_consent";
-    private get _scope();
-    constructor(config: CreatioClientConfig);
-    private _exchangeCodeForTokens;
-    private _refreshTokens;
-    protected throwNoTokenError(): void;
-    private _refreshTokensDeduped;
-    protected ensureAccessToken(force?: boolean): Promise<string | undefined>;
-    finishAuthorization(code: string): Promise<void>;
-    getAuthorizeUrl(state: string): Promise<string>;
-    revoke(): Promise<void>;
-    refreshUserTokens(userKey: string): Promise<void>;
-    cancelAllRefresh(): void;
-}
-//# sourceMappingURL=oauth2-code-provider.d.ts.map

package/dist/creatio/auth/providers/oauth2-code-provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-code-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-code-provider.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,qBAAa,kBAAmB,SAAQ,kBAAkB,CAAC,oBAAoB,CAAC;IAC/E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAA+B;IAGtE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;IAE3E,SAAS,CAAC,QAAQ,CAAC,aAAa,8BAA8B;IAE9D,OAAO,KAAK,MAAM,GAEjB;gBAEW,MAAM,EAAE,mBAAmB;YAKzB,sBAAsB;YA2CtB,cAAc;IAuD5B,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAQnC,OAAO,CAAC,qBAAqB;cAcb,iBAAiB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IA+BhE,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa/C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCvB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWvD,gBAAgB,IAAI,IAAI;CAG/B"}