mcp-creatio 0.6.2 → 0.6.4

package/dist/creatio/auth/index.js

@@ -14,11 +14,13 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthProviderType = exports.supportsInteractiveAuth = exports.supportsRevoke = void 0;
+exports.BearerAuthMode = exports.AuthProviderType = exports.CreatioOAuthClient = exports.resolveIdentityBase = void 0;
 __exportStar(require("./auth-manager"), exports);
 var auth_1 = require("./auth");
-Object.defineProperty(exports, "supportsRevoke", { enumerable: true, get: function () { return auth_1.supportsRevoke; } });
-Object.defineProperty(exports, "supportsInteractiveAuth", { enumerable: true, get: function () { return auth_1.supportsInteractiveAuth; } });
+Object.defineProperty(exports, "resolveIdentityBase", { enumerable: true, get: function () { return auth_1.resolveIdentityBase; } });
+var providers_1 = require("./providers");
+Object.defineProperty(exports, "CreatioOAuthClient", { enumerable: true, get: function () { return providers_1.CreatioOAuthClient; } });
 var type_1 = require("./providers/type");
 Object.defineProperty(exports, "AuthProviderType", { enumerable: true, get: function () { return type_1.AuthProviderType; } });
+Object.defineProperty(exports, "BearerAuthMode", { enumerable: true, get: function () { return type_1.BearerAuthMode; } });
 //# sourceMappingURL=index.js.map

package/dist/creatio/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAM/B,+BAAiE;AAAxD,sGAAA,cAAc,OAAA;AAAE,+GAAA,uBAAuB,OAAA;AAChD,yCAAoD;AAA3C,wGAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/creatio/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAE/B,+BAA6C;AAApC,2GAAA,mBAAmB,OAAA;AAC5B,yCAAiD;AAAxC,+GAAA,kBAAkB,OAAA;AAC3B,yCAAoE;AAA3D,wGAAA,gBAAgB,OAAA;AAAE,sGAAA,cAAc,OAAA"}

package/dist/creatio/auth/providers/base-oauth2-provider.d.ts

@@ -1,17 +1,23 @@
-import { OAuth2AuthConfig, OAuth2CodeAuthConfig } from '../../client-config';
+import { OAuth2AuthConfig } from '../../client-config';
 import { BaseProvider } from './base-provider';
-type OAuthConfig = OAuth2AuthConfig | OAuth2CodeAuthConfig;
-export declare abstract class BaseOAuth2Provider<T extends OAuthConfig = OAuthConfig> extends BaseProvider<T> {
+/** The raw result of a token fetch — caching and expiry math live in the base. */
+export interface FetchedToken {
+    accessToken: string;
+    expiresInSeconds: number;
+}
+export declare abstract class BaseOAuth2Provider<T extends OAuth2AuthConfig = OAuth2AuthConfig> extends BaseProvider<T> {
     protected abstract readonly authErrorCode: string;
+    private _inflight;
     protected accessToken: string | undefined;
     protected accessTokenExpiryMs: number | undefined;
-    protected abstract ensureAccessToken(force?: boolean): Promise<string | undefined>;
-    protected computeExpiryMs(expiresInSeconds: number, minSeconds?: number): number;
+    /** Raw token acquisition (the network call only); returns undefined on failure. */
+    protected abstract fetchToken(): Promise<FetchedToken | undefined>;
+    private _isFresh;
+    private _acquireToken;
     protected getIdentityBase(): string;
-    protected storageKey(userKey: string): string;
     protected throwNoTokenError(): void;
+    protected ensureAccessToken(force?: boolean): Promise<string | undefined>;
     getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
     refresh(): Promise<void>;
 }
-export {};
 //# sourceMappingURL=base-oauth2-provider.d.ts.map

package/dist/creatio/auth/providers/base-oauth2-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-oauth2-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-oauth2-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAG7E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,KAAK,WAAW,GAAG,gBAAgB,GAAG,oBAAoB,CAAC;AAE3D,8BAAsB,kBAAkB,CACvC,CAAC,SAAS,WAAW,GAAG,WAAW,CAClC,SAAQ,YAAY,CAAC,CAAC,CAAC;IACxB,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAElD,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,SAAS,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IAElD,SAAS,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAElF,SAAS,CAAC,eAAe,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,MAAM;IAInF,SAAS,CAAC,eAAe,IAAI,MAAM;IAenC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAO7C,SAAS,CAAC,iBAAiB,IAAI,IAAI;IAItB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQ7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAKrC"}
+{"version":3,"file":"base-oauth2-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-oauth2-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED,8BAAsB,kBAAkB,CACvC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,CAC5C,SAAQ,YAAY,CAAC,CAAC,CAAC;IACxB,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAKlD,OAAO,CAAC,SAAS,CAA0C;IAE3D,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,SAAS,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC;IAElD,mFAAmF;IACnF,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAElE,OAAO,CAAC,QAAQ;YAMF,aAAa;IAY3B,SAAS,CAAC,eAAe,IAAI,MAAM;IAInC,SAAS,CAAC,iBAAiB,IAAI,IAAI;cAInB,iBAAiB,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAahE,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQ7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAKrC"}

package/dist/creatio/auth/providers/base-oauth2-provider.js

@@ -4,34 +4,44 @@ exports.BaseOAuth2Provider = void 0;
 const auth_1 = require("../auth");
 const base_provider_1 = require("./base-provider");
 class BaseOAuth2Provider extends base_provider_1.BaseProvider {
+    // Single-flight: K concurrent callers that find the token expired (e.g. a burst of requests all
+    // 401ing at once) trigger ONE token fetch, not K — avoids a thundering herd against Creatio
+    // Identity on expiry. Mirrors the per-user dedup the broker provider already does.
+    _inflight;
     accessToken;
     accessTokenExpiryMs;
-    computeExpiryMs(expiresInSeconds, minSeconds = 1) {
-        return Date.now() + Math.max(minSeconds, expiresInSeconds - auth_1.EXPIRES_MARGIN_SECONDS) * 1000;
+    _isFresh() {
+        return Boolean(this.accessToken && this.accessTokenExpiryMs && Date.now() < this.accessTokenExpiryMs);
     }
-    getIdentityBase() {
-        if (this.authConfig.idBaseUrl) {
-            let base = String(this.authConfig.idBaseUrl).replace(/\/$/, '');
-            if (!/\/0$/.test(base)) {
-                base = base + '/0';
-            }
-            return base;
-        }
-        let base = this.config.baseUrl.replace(/\/$/, '');
-        if (!/\/0$/.test(base)) {
-            base = base + '/0';
+    async _acquireToken() {
+        const fetched = await this.fetchToken();
+        if (!fetched) {
+            this.accessToken = undefined;
+            this.accessTokenExpiryMs = undefined;
+            return undefined;
         }
-        return base;
+        this.accessToken = fetched.accessToken;
+        this.accessTokenExpiryMs = (0, auth_1.computeTokenExpiryMs)(fetched.expiresInSeconds);
+        return this.accessToken;
     }
-    storageKey(userKey) {
-        const base = this.getIdentityBase();
-        const kind = this.config?.auth?.kind ?? 'unknown';
-        const clientId = this.config?.auth?.clientId ?? 'noclient';
-        return `${kind}|${base}|${clientId}|${userKey}`;
+    getIdentityBase() {
+        return (0, auth_1.resolveIdentityBase)(this.config.baseUrl, this.authConfig.idBaseUrl);
     }
     throwNoTokenError() {
         throw new Error(this.authErrorCode);
     }
+    async ensureAccessToken(force = false) {
+        if (!force && this._isFresh()) {
+            return this.accessToken;
+        }
+        if (this._inflight) {
+            return this._inflight;
+        }
+        this._inflight = this._acquireToken().finally(() => {
+            this._inflight = undefined;
+        });
+        return this._inflight;
+    }
     async getHeaders(accept, isJson) {
         const token = await this.ensureAccessToken(false);
         if (!token) {

package/dist/creatio/auth/providers/base-oauth2-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-oauth2-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-oauth2-provider.ts"],"names":[],"mappings":";;;AACA,kCAA+D;AAE/D,mDAA+C;AAI/C,MAAsB,kBAEpB,SAAQ,4BAAe;IAGd,WAAW,CAAqB;IAEhC,mBAAmB,CAAqB;IAIxC,eAAe,CAAC,gBAAwB,EAAE,aAAqB,CAAC;QACzE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,gBAAgB,GAAG,6BAAsB,CAAC,GAAG,IAAI,CAAC;IAC5F,CAAC;IAES,eAAe;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAES,UAAU,CAAC,OAAe;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,GAAI,IAAI,CAAC,MAAc,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAC3D,MAAM,QAAQ,GAAI,IAAI,CAAC,MAAc,EAAE,IAAI,EAAE,QAAQ,IAAI,UAAU,CAAC;QACpE,OAAO,GAAG,IAAI,IAAI,IAAI,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;IACjD,CAAC;IAES,iBAAiB;QAC1B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAgB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAA,mBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACD;AAtDD,gDAsDC"}
+{"version":3,"file":"base-oauth2-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-oauth2-provider.ts"],"names":[],"mappings":";;;AACA,kCAAkF;AAElF,mDAA+C;AAQ/C,MAAsB,kBAEpB,SAAQ,4BAAe;IAGxB,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IAC3E,SAAS,CAA0C;IAEjD,WAAW,CAAqB;IAEhC,mBAAmB,CAAqB;IAK1C,QAAQ;QACf,OAAO,OAAO,CACb,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,mBAAmB,CACrF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;YAC7B,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;YACrC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,mBAAmB,GAAG,IAAA,2BAAoB,EAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;IAES,eAAe;QACxB,OAAO,IAAA,0BAAmB,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5E,CAAC;IAES,iBAAiB;QAC1B,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,KAAK,GAAG,KAAK;QAC9C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAClD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAgB;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,IAAA,mBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO;QACnB,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACD;AArED,gDAqEC"}

package/dist/creatio/auth/providers/base-provider.js

@@ -13,7 +13,7 @@ class BaseProvider {
         this.config = config;
     }
     cancelAllRefresh() {
-        // No background refresh timers by default; OAuth2CodeProvider overrides this.
+        // No background refresh timers in any current provider; the hook stays for shutdown symmetry.
     }
 }
 exports.BaseProvider = BaseProvider;

package/dist/creatio/auth/providers/base-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-provider.ts"],"names":[],"mappings":";;;AAKA,MAAsB,YAAY;IAGd,MAAM,CAAsB;IAE/C,IAAc,UAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAS,CAAC;IAC9B,CAAC;IAED,IAAW,IAAI;QACd,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,YAAY,MAA2B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IASM,gBAAgB;QACtB,8EAA8E;IAC/E,CAAC;CACD;AA3BD,oCA2BC"}
+{"version":3,"file":"base-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/base-provider.ts"],"names":[],"mappings":";;;AAKA,MAAsB,YAAY;IAGd,MAAM,CAAsB;IAE/C,IAAc,UAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAS,CAAC;IAC9B,CAAC;IAED,IAAW,IAAI;QACd,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,YAAY,MAA2B;QACtC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;IASM,gBAAgB;QACtB,8FAA8F;IAC/F,CAAC;CACD;AA3BD,oCA2BC"}

package/dist/creatio/auth/providers/broker-provider.d.ts

@@ -0,0 +1,20 @@
+import { BrokerAuthConfig, CreatioClientConfig } from '../../client-config';
+import { BaseProvider } from './base-provider';
+/**
+ * Runtime auth provider for `broker` mode. The broker handler has already brokered the user's
+ * Creatio login and stored their tokens per `userKey`; this provider only SERVES them: it reads the
+ * current request's user tokens, refreshes on demand when expired, and attaches the Bearer. Token
+ * acquisition lives in the broker handler — this side never drives the interactive flow (SRP).
+ */
+export declare class BrokerProvider extends BaseProvider<BrokerAuthConfig> {
+    private readonly _session;
+    private readonly _creatio;
+    private readonly _inflightRefresh;
+    constructor(config: CreatioClientConfig);
+    private _ensureAccessToken;
+    private _refreshDeduped;
+    getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
+    /** Forces a refresh for the current user (called by the HTTP client on a 401, then it retries). */
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=broker-provider.d.ts.map

package/dist/creatio/auth/providers/broker-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/broker-provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,YAAY,CAAC,gBAAgB,CAAC;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAG9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA0C;gBAE/D,MAAM,EAAE,mBAAmB;YAKzB,kBAAkB;IAehC,OAAO,CAAC,eAAe;IAcV,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQ1F,mGAAmG;IACtF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAUrC"}

package/dist/creatio/auth/providers/broker-provider.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrokerProvider = void 0;
+const sessions_1 = require("../../../sessions");
+const utils_1 = require("../../../utils");
+const auth_1 = require("../auth");
+const base_provider_1 = require("./base-provider");
+const creatio_oauth_client_1 = require("./creatio-oauth-client");
+/**
+ * Runtime auth provider for `broker` mode. The broker handler has already brokered the user's
+ * Creatio login and stored their tokens per `userKey`; this provider only SERVES them: it reads the
+ * current request's user tokens, refreshes on demand when expired, and attaches the Bearer. Token
+ * acquisition lives in the broker handler — this side never drives the interactive flow (SRP).
+ */
+class BrokerProvider extends base_provider_1.BaseProvider {
+    _session = sessions_1.SessionContext.instance;
+    _creatio;
+    // Deduplicates concurrent refreshes per user so K parallel requests trigger one refresh, not K
+    // (avoids the thundering herd + rotating-refresh-token races).
+    _inflightRefresh = new Map();
+    constructor(config) {
+        super(config);
+        this._creatio = new creatio_oauth_client_1.CreatioOAuthClient(config.baseUrl, this.authConfig);
+    }
+    async _ensureAccessToken(userKey) {
+        const saved = await this._session.getTokensForUser(userKey);
+        if (!saved) {
+            throw new Error('broker_not_authorized');
+        }
+        if (Date.now() < saved.accessTokenExpiryMs) {
+            return saved.accessToken;
+        }
+        if (!saved.refreshToken) {
+            await this._session.deleteTokensForUser(userKey);
+            throw new Error('broker_token_expired');
+        }
+        return (await this._refreshDeduped(userKey, saved.refreshToken)).accessToken;
+    }
+    _refreshDeduped(userKey, refreshToken) {
+        const existing = this._inflightRefresh.get(userKey);
+        if (existing) {
+            return existing;
+        }
+        const promise = (async () => {
+            const updated = await this._creatio.refresh(refreshToken);
+            await this._session.setTokensForUser(userKey, updated);
+            return updated;
+        })().finally(() => this._inflightRefresh.delete(userKey));
+        this._inflightRefresh.set(userKey, promise);
+        return promise;
+    }
+    async getHeaders(accept, isJson) {
+        const userKey = (0, utils_1.getEffectiveUserKey)();
+        if (!userKey) {
+            throw new Error('broker_no_user');
+        }
+        return (0, auth_1.buildHeaders)(accept, Boolean(isJson), await this._ensureAccessToken(userKey));
+    }
+    /** Forces a refresh for the current user (called by the HTTP client on a 401, then it retries). */
+    async refresh() {
+        const userKey = (0, utils_1.getEffectiveUserKey)();
+        if (!userKey) {
+            return;
+        }
+        const saved = await this._session.getTokensForUser(userKey);
+        if (saved?.refreshToken) {
+            await this._refreshDeduped(userKey, saved.refreshToken);
+        }
+    }
+}
+exports.BrokerProvider = BrokerProvider;
+//# sourceMappingURL=broker-provider.js.map

package/dist/creatio/auth/providers/broker-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/broker-provider.ts"],"names":[],"mappings":";;;AAAA,gDAA+D;AAC/D,0CAAqD;AAErD,kCAAuC;AAEvC,mDAA+C;AAC/C,iEAA4D;AAE5D;;;;;GAKG;AACH,MAAa,cAAe,SAAQ,4BAA8B;IAChD,QAAQ,GAAG,yBAAc,CAAC,QAAQ,CAAC;IACnC,QAAQ,CAAqB;IAC9C,+FAA+F;IAC/F,+DAA+D;IAC9C,gBAAgB,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE3E,YAAY,MAA2B;QACtC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,OAAe;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,CAAC;IAEO,eAAe,CAAC,OAAe,EAAE,YAAoB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAgB;QACvD,MAAM,OAAO,GAAG,IAAA,2BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAA,mBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,mGAAmG;IAC5F,KAAK,CAAC,OAAO;QACnB,MAAM,OAAO,GAAG,IAAA,2BAAmB,GAAE,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;QACR,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;CACD;AA5DD,wCA4DC"}

package/dist/creatio/auth/providers/creatio-oauth-client.d.ts

@@ -0,0 +1,27 @@
+import { UserTokens } from '../../../sessions';
+import { BrokerAuthConfig } from '../../client-config';
+/**
+ * Thin client for the Creatio Identity authorization-code endpoints — the "Creatio leg" of the
+ * broker. One place owns every call to Creatio's `/connect/authorize` and `/connect/token` (build
+ * the consent URL, exchange a code, refresh), so the broker handler and the runtime provider never
+ * duplicate token-endpoint logic (DRY). It is stateless: callers own where tokens are stored.
+ */
+export declare class CreatioOAuthClient {
+    private readonly _baseUrl;
+    private readonly _auth;
+    private get _identityBase();
+    private get _scope();
+    constructor(baseUrl: string, auth: BrokerAuthConfig);
+    private _baseBody;
+    private _postToken;
+    /** Builds the Creatio consent URL for the brokered login (always with S256 PKCE). */
+    buildAuthorizeUrl(redirectUri: string, state: string, codeChallenge: string): string;
+    /** Exchanges a Creatio authorization code (+ our PKCE verifier) for the user's Creatio tokens. */
+    exchangeCode(code: string, redirectUri: string, codeVerifier: string): Promise<UserTokens>;
+    /** Refreshes the user's Creatio tokens using a stored refresh token. */
+    refresh(refreshToken: string): Promise<UserTokens>;
+    /** Revoke a user's Creatio token (RFC 7009) on logout. Best-effort: a failure must not block the
+     *  local logout (we still purge our own state), so this never throws. */
+    revoke(token: string): Promise<void>;
+}
+//# sourceMappingURL=creatio-oauth-client.d.ts.map

package/dist/creatio/auth/providers/creatio-oauth-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"creatio-oauth-client.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/creatio-oauth-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAYvD;;;;;GAKG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IAEzC,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,KAAK,MAAM,GAEjB;gBAEW,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB;IAKnD,OAAO,CAAC,SAAS;YAUH,UAAU;IAmCxB,qFAAqF;IAC9E,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM;IAY3F,kGAAkG;IACrF,YAAY,CACxB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC;IAStB,wEAAwE;IAC3D,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAU/D;6EACyE;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBjD"}

package/dist/creatio/auth/providers/creatio-oauth-client.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatioOAuthClient = void 0;
+const log_1 = __importDefault(require("../../../log"));
+const auth_1 = require("../auth");
+const DEFAULT_TOKEN_LIFETIME_SECONDS = 180;
+/**
+ * Thin client for the Creatio Identity authorization-code endpoints — the "Creatio leg" of the
+ * broker. One place owns every call to Creatio's `/connect/authorize` and `/connect/token` (build
+ * the consent URL, exchange a code, refresh), so the broker handler and the runtime provider never
+ * duplicate token-endpoint logic (DRY). It is stateless: callers own where tokens are stored.
+ */
+class CreatioOAuthClient {
+    _baseUrl;
+    _auth;
+    get _identityBase() {
+        return (0, auth_1.resolveIdentityBase)(this._baseUrl, this._auth.idBaseUrl);
+    }
+    get _scope() {
+        return this._auth.scope || 'offline_access';
+    }
+    constructor(baseUrl, auth) {
+        this._baseUrl = baseUrl;
+        this._auth = auth;
+    }
+    _baseBody() {
+        const body = new URLSearchParams();
+        body.set('client_id', this._auth.clientId);
+        // Confidential clients send a secret; public clients (PKCE) send none.
+        if (this._auth.clientSecret) {
+            body.set('client_secret', this._auth.clientSecret);
+        }
+        return body;
+    }
+    async _postToken(body, op) {
+        const url = this._identityBase + auth_1.TOKEN_ENDPOINT;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        const text = await res.text().catch(() => '');
+        if (!res.ok || !text) {
+            log_1.default.error(`broker.creatio.${op}_failed`, {
+                status: res.status,
+                body: text.slice(0, 200),
+            });
+            throw new Error(`creatio_oauth_${op}_error:${res.status}`);
+        }
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            throw new Error(`creatio_oauth_${op}_parse_failed`);
+        }
+        if (!json.access_token) {
+            throw new Error(`creatio_oauth_${op}_no_access_token`);
+        }
+        const lifetime = Number(json.expires_in) || DEFAULT_TOKEN_LIFETIME_SECONDS;
+        return {
+            accessToken: String(json.access_token),
+            accessTokenExpiryMs: (0, auth_1.computeTokenExpiryMs)(lifetime),
+            ...(json.refresh_token ? { refreshToken: String(json.refresh_token) } : {}),
+        };
+    }
+    /** Builds the Creatio consent URL for the brokered login (always with S256 PKCE). */
+    buildAuthorizeUrl(redirectUri, state, codeChallenge) {
+        const url = new URL(this._identityBase + auth_1.AUTHORIZE_ENDPOINT);
+        url.searchParams.set('client_id', this._auth.clientId);
+        url.searchParams.set('redirect_uri', redirectUri);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('state', state);
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', auth_1.PKCE_S256);
+        url.searchParams.set('scope', this._scope);
+        return url.toString();
+    }
+    /** Exchanges a Creatio authorization code (+ our PKCE verifier) for the user's Creatio tokens. */
+    async exchangeCode(code, redirectUri, codeVerifier) {
+        const body = this._baseBody();
+        body.set('grant_type', 'authorization_code');
+        body.set('code', code);
+        body.set('redirect_uri', redirectUri);
+        body.set('code_verifier', codeVerifier);
+        return this._postToken(body, 'exchange');
+    }
+    /** Refreshes the user's Creatio tokens using a stored refresh token. */
+    async refresh(refreshToken) {
+        const body = this._baseBody();
+        body.set('grant_type', 'refresh_token');
+        body.set('refresh_token', refreshToken);
+        body.set('scope', this._scope);
+        const tokens = await this._postToken(body, 'refresh');
+        // Rotating refresh tokens: keep the previous one if Creatio did not return a new one.
+        return tokens.refreshToken ? tokens : { ...tokens, refreshToken };
+    }
+    /** Revoke a user's Creatio token (RFC 7009) on logout. Best-effort: a failure must not block the
+     *  local logout (we still purge our own state), so this never throws. */
+    async revoke(token) {
+        const body = this._baseBody();
+        body.set('token', token);
+        try {
+            const res = await fetch(this._identityBase + auth_1.REVOCATION_ENDPOINT, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            });
+            if (!res.ok) {
+                log_1.default.warn('broker.creatio.revoke_failed', { status: res.status });
+            }
+        }
+        catch (err) {
+            log_1.default.warn('broker.creatio.revoke_error', { error: String(err) });
+        }
+    }
+}
+exports.CreatioOAuthClient = CreatioOAuthClient;
+//# sourceMappingURL=creatio-oauth-client.js.map

package/dist/creatio/auth/providers/creatio-oauth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"creatio-oauth-client.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/creatio-oauth-client.ts"],"names":[],"mappings":";;;;;;AAAA,uDAA+B;AAG/B,kCAOiB;AAEjB,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAE3C;;;;;GAKG;AACH,MAAa,kBAAkB;IACb,QAAQ,CAAS;IACjB,KAAK,CAAmB;IAEzC,IAAY,aAAa;QACxB,OAAO,IAAA,0BAAmB,EAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,IAAY,MAAM;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAC7C,CAAC;IAED,YAAY,OAAe,EAAE,IAAsB;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACnB,CAAC;IAEO,SAAS;QAChB,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,uEAAuE;QACvE,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,UAAU,CACvB,IAAqB,EACrB,EAA0B;QAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,qBAAc,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,aAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,SAAS,EAAE;gBACxC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACxB,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,IAA4E,CAAC;QACjF,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,eAAe,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,8BAA8B,CAAC;QAC3E,OAAO;YACN,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YACtC,mBAAmB,EAAE,IAAA,2BAAoB,EAAC,QAAQ,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC;IACH,CAAC;IAED,qFAAqF;IAC9E,iBAAiB,CAAC,WAAmB,EAAE,KAAa,EAAE,aAAqB;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,yBAAkB,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,gBAAS,CAAC,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAED,kGAAkG;IAC3F,KAAK,CAAC,YAAY,CACxB,IAAY,EACZ,WAAmB,EACnB,YAAoB;QAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,wEAAwE;IACjE,KAAK,CAAC,OAAO,CAAC,YAAoB;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,sFAAsF;QACtF,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;IACnE,CAAC;IAED;6EACyE;IAClE,KAAK,CAAC,MAAM,CAAC,KAAa;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,GAAG,0BAAmB,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,aAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,aAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;CACD;AAtHD,gDAsHC"}

package/dist/creatio/auth/providers/index.d.ts

@@ -1,5 +1,7 @@
 export * from './legacy-provider';
 export * from './oauth2-provider';
-export * from './oauth2-code-provider';
+export * from './oauth2-bearer-provider';
+export * from './broker-provider';
+export * from './creatio-oauth-client';
 export * from './type';
 //# sourceMappingURL=index.d.ts.map

package/dist/creatio/auth/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,QAAQ,CAAC"}

package/dist/creatio/auth/providers/index.js

@@ -16,6 +16,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./legacy-provider"), exports);
 __exportStar(require("./oauth2-provider"), exports);
-__exportStar(require("./oauth2-code-provider"), exports);
+__exportStar(require("./oauth2-bearer-provider"), exports);
+__exportStar(require("./broker-provider"), exports);
+__exportStar(require("./creatio-oauth-client"), exports);
 __exportStar(require("./type"), exports);
 //# sourceMappingURL=index.js.map

package/dist/creatio/auth/providers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,oDAAkC;AAClC,yDAAuC;AACvC,yCAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,oDAAkC;AAClC,2DAAyC;AACzC,oDAAkC;AAClC,yDAAuC;AACvC,yCAAuB"}

package/dist/creatio/auth/providers/oauth2-bearer-provider.d.ts

@@ -0,0 +1,17 @@
+import { BearerAuthConfig } from '../../client-config';
+import { BaseProvider } from './base-provider';
+/**
+ * Stateless per-request Bearer passthrough provider.
+ *
+ * The MCP issues and stores no tokens: every request already carries a Creatio access token
+ * (obtained by the client from Creatio Identity in `delegated` mode, or injected by a trusted
+ * Control-Plane in `gateway` mode). This provider simply attaches that token — read from the
+ * per-request {@link getBearerToken} context — to outgoing Creatio calls. Token acquisition and
+ * refresh are the client's / gateway's responsibility, which is why there is nothing to refresh
+ * here and no server-side token store.
+ */
+export declare class OAuth2BearerProvider extends BaseProvider<BearerAuthConfig> {
+    getHeaders(accept: string, isJson?: boolean): Promise<Record<string, string>>;
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=oauth2-bearer-provider.d.ts.map

package/dist/creatio/auth/providers/oauth2-bearer-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-bearer-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-bearer-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,YAAY,CAAC,gBAAgB,CAAC;IAC1D,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAU7E,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAIrC"}

package/dist/creatio/auth/providers/oauth2-bearer-provider.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2BearerProvider = void 0;
+const utils_1 = require("../../../utils");
+const auth_1 = require("../auth");
+const base_provider_1 = require("./base-provider");
+/**
+ * Stateless per-request Bearer passthrough provider.
+ *
+ * The MCP issues and stores no tokens: every request already carries a Creatio access token
+ * (obtained by the client from Creatio Identity in `delegated` mode, or injected by a trusted
+ * Control-Plane in `gateway` mode). This provider simply attaches that token — read from the
+ * per-request {@link getBearerToken} context — to outgoing Creatio calls. Token acquisition and
+ * refresh are the client's / gateway's responsibility, which is why there is nothing to refresh
+ * here and no server-side token store.
+ */
+class OAuth2BearerProvider extends base_provider_1.BaseProvider {
+    async getHeaders(accept, isJson) {
+        const token = (0, utils_1.getBearerToken)();
+        if (!token) {
+            // No token in context ⇒ unauthenticated request. The HTTP edge turns this into a 401
+            // (delegated: with a WWW-Authenticate challenge; gateway: a plain rejection).
+            throw new Error('bearer_token_required');
+        }
+        return (0, auth_1.buildHeaders)(accept, Boolean(isJson), token);
+    }
+    async refresh() {
+        // Nothing to refresh: the client (delegated) or gateway owns the token lifecycle. A stale
+        // token surfaces as a 401 from Creatio, which the caller resolves by presenting a fresh one.
+    }
+}
+exports.OAuth2BearerProvider = OAuth2BearerProvider;
+//# sourceMappingURL=oauth2-bearer-provider.js.map

package/dist/creatio/auth/providers/oauth2-bearer-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-bearer-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-bearer-provider.ts"],"names":[],"mappings":";;;AAAA,0CAAgD;AAEhD,kCAAuC;AAEvC,mDAA+C;AAE/C;;;;;;;;;GASG;AACH,MAAa,oBAAqB,SAAQ,4BAA8B;IAChE,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,MAAgB;QACvD,MAAM,KAAK,GAAG,IAAA,sBAAc,GAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,qFAAqF;YACrF,8EAA8E;YAC9E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAA,mBAAY,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAEM,KAAK,CAAC,OAAO;QACnB,0FAA0F;QAC1F,6FAA6F;IAC9F,CAAC;CACD;AAfD,oDAeC"}

package/dist/creatio/auth/providers/oauth2-provider.d.ts

@@ -1,9 +1,9 @@
 import { CreatioClientConfig, OAuth2AuthConfig } from '../../client-config';
-import { BaseOAuth2Provider } from './base-oauth2-provider';
+import { BaseOAuth2Provider, FetchedToken } from './base-oauth2-provider';
 export declare class OAuth2Provider extends BaseOAuth2Provider<OAuth2AuthConfig> {
     private readonly _config;
     protected readonly authErrorCode = "oauth2_auth_failed";
     constructor(config: CreatioClientConfig);
-    protected ensureAccessToken(): Promise<string | undefined>;
+    protected fetchToken(): Promise<FetchedToken | undefined>;
 }
 //# sourceMappingURL=oauth2-provider.d.ts.map

package/dist/creatio/auth/providers/oauth2-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,qBAAa,cAAe,SAAQ,kBAAkB,CAAC,gBAAgB,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAE9C,SAAS,CAAC,QAAQ,CAAC,aAAa,wBAAwB;gBAE5C,MAAM,EAAE,mBAAmB;cAKvB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA0EhE"}
+{"version":3,"file":"oauth2-provider.d.ts","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-provider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5E,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE1E,qBAAa,cAAe,SAAQ,kBAAkB,CAAC,gBAAgB,CAAC;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAE9C,SAAS,CAAC,QAAQ,CAAC,aAAa,wBAAwB;gBAE5C,MAAM,EAAE,mBAAmB;cAKvB,UAAU,IAAI,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;CAqE/D"}

package/dist/creatio/auth/providers/oauth2-provider.js

@@ -14,11 +14,7 @@ class OAuth2Provider extends base_oauth2_provider_1.BaseOAuth2Provider {
         super(config);
         this._config = config;
     }
-    async ensureAccessToken() {
-        const now = Date.now();
-        if (this.accessToken && this.accessTokenExpiryMs && now < this.accessTokenExpiryMs) {
-            return this.accessToken;
-        }
+    async fetchToken() {
         const url = `${this.getIdentityBase()}${auth_1.TOKEN_ENDPOINT}`;
         const body = new URLSearchParams();
         body.set('grant_type', 'client_credentials');
@@ -69,11 +65,10 @@ class OAuth2Provider extends base_oauth2_provider_1.BaseOAuth2Provider {
                 log_1.default.creatioAuthFailed(this._config.baseUrl, 'no_access_token_in_response', 'oauth2');
                 throw new Error('oauth2_no_access_token');
             }
-            this.accessToken = String(tokenResponse.access_token);
-            const expiresIn = Number(tokenResponse.expires_in) || 3600;
-            this.accessTokenExpiryMs = this.computeExpiryMs(expiresIn, 1);
+            const accessToken = String(tokenResponse.access_token);
+            const expiresInSeconds = Number(tokenResponse.expires_in) || 3600;
             log_1.default.creatioAuthOk(this._config.baseUrl, 'oauth2');
-            return this.accessToken;
+            return { accessToken, expiresInSeconds };
         }
         catch (e) {
             log_1.default.error('oauth.token.exception', { error: String(e?.message ?? e) });

package/dist/creatio/auth/providers/oauth2-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-provider.ts"],"names":[],"mappings":";;;;;;AAAA,uDAA+B;AAE/B,kCAAiE;AAEjE,iEAA4D;AAE5D,MAAa,cAAe,SAAQ,yCAAoC;IACtD,OAAO,CAAsB;IAE3B,aAAa,GAAG,oBAAoB,CAAC;IAExD,YAAY,MAA2B;QACtC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,iBAAiB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,mBAAmB,IAAI,GAAG,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,WAAW,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,GAAG,qBAAc,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC;YACJ,aAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACrB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAI,QAAQ,CAAC,OAAe,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,WAAW,GAChB,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,6BAAsB;gBAC3D,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAsB,CAAC,GAAG,mBAAmB;gBACrE,CAAC,CAAC,YAAY,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE;oBAC9B,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,WAAW;oBACX,WAAW;iBACX,CAAC,CAAC;gBACH,aAAG,CAAC,iBAAiB,CACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,eAAe,QAAQ,CAAC,MAAM,EAAE,EAChC,QAAQ,CACR,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,aAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnF,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,aAAa,GAAQ,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACJ,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;oBACrC,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,WAAW;oBACX,WAAW;iBACX,CAAC,CAAC;gBACH,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,aAAG,CAAC,iBAAiB,CACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,6BAA6B,EAC7B,QAAQ,CACR,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;YAC3D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC9D,aAAG,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,WAAW,CAAC;QACzB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACjB,aAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AApFD,wCAoFC"}
+{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../../../src/creatio/auth/providers/oauth2-provider.ts"],"names":[],"mappings":";;;;;;AAAA,uDAA+B;AAE/B,kCAAiE;AAEjE,iEAA0E;AAE1E,MAAa,cAAe,SAAQ,yCAAoC;IACtD,OAAO,CAAsB;IAE3B,aAAa,GAAG,oBAAoB,CAAC;IAExD,YAAY,MAA2B;QACtC,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,UAAU;QACzB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,EAAE,GAAG,qBAAc,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC;YACJ,aAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;aACrB,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,WAAW,GAAI,QAAQ,CAAC,OAAe,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC3E,MAAM,WAAW,GAChB,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,6BAAsB;gBAC3D,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAsB,CAAC,GAAG,mBAAmB;gBACrE,CAAC,CAAC,YAAY,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,aAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE;oBAC9B,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,WAAW;oBACX,WAAW;iBACX,CAAC,CAAC;gBACH,aAAG,CAAC,iBAAiB,CACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,eAAe,QAAQ,CAAC,MAAM,EAAE,EAChC,QAAQ,CACR,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;gBACnB,aAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACnF,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,aAAa,GAAQ,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACJ,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;oBACrC,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,WAAW;oBACX,WAAW;iBACX,CAAC,CAAC;gBACH,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;gBACnD,aAAG,CAAC,iBAAiB,CACpB,IAAI,CAAC,OAAO,CAAC,OAAO,EACpB,6BAA6B,EAC7B,QAAQ,CACR,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3C,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;YAClE,aAAG,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACjB,aAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACvE,aAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/E,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD;AA/ED,wCA+EC"}

package/dist/creatio/auth/providers/type.d.ts

@@ -1,6 +1,25 @@
 export declare enum AuthProviderType {
     Legacy = "legacy",
     OAuth2 = "oauth2",
-    OAuth2Code = "oauth2_code"
+    /**
+     * Stateless per-request Bearer passthrough: the incoming request carries a Creatio access token
+     * (obtained by the client directly from Creatio Identity in `delegated` mode, or injected by a
+     * fronting Control-Plane in `gateway` mode). The MCP issues no tokens and stores none.
+     */
+    OAuth2Bearer = "oauth2_bearer",
+    /**
+     * Broker: the MCP is its own OAuth 2.1 authorization server for clients (DCR + /authorize +
+     * /token), brokering the user login to Creatio via authorization_code + PKCE and holding the
+     * user's Creatio tokens server-side. The "connect → authorize → work as me" UX for standalone
+     * direct clients (Claude Desktop / ChatGPT) where Creatio offers no dynamic client registration.
+     */
+    Broker = "broker"
+}
+/** Where the per-request Bearer comes from / how strictly the MCP treats it. */
+export declare enum BearerAuthMode {
+    /** Client authenticates directly against Creatio Identity; MCP advertises it (RFC 9728) + validates. */
+    Delegated = "delegated",
+    /** A trusted fronting gateway (Creatio.ai Control-Plane) injects the Bearer; MCP trusts it. */
+    Gateway = "gateway"
 }
 //# sourceMappingURL=type.d.ts.map