mcp-creatio 0.6.2 → 0.6.4

package/dist/server/bearer/base-url-guard.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Guards the gateway-only `X-Creatio-Base-Url` override. The override decides where each request's
+ * Bearer token is sent, so an unvalidated value is an SSRF / token-redirection lever (CWE-918):
+ * a compromised or misconfigured gateway could redirect the authenticated token to an attacker host
+ * or pivot to internal metadata endpoints.
+ *
+ * The real production control is an allowlist (`CREATIO_MCP_ALLOWED_BASE_URLS`). When it is set, the
+ * override MUST fall under an allowed origin. When it is NOT set, we keep the trusted-gateway posture
+ * (any http/https host is accepted) but ALWAYS block the cloud-metadata link-local address, since it
+ * is never a legitimate Creatio target and is the classic SSRF prize. On-prem private ranges are NOT
+ * blocked by default — legitimate tenants live there — so use the allowlist to lock things down.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAllowedBaseUrls = parseAllowedBaseUrls;
+exports.isAllowedBaseUrl = isAllowedBaseUrl;
+/** Cloud instance-metadata endpoints (AWS/GCP/Azure IMDS) — never a Creatio base, always blocked. */
+const BLOCKED_HOSTS = new Set(['169.254.169.254', 'fd00:ec2::254', '[fd00:ec2::254]']);
+/** Parse the comma/space-separated `CREATIO_MCP_ALLOWED_BASE_URLS` into normalized origins. */
+function parseAllowedBaseUrls(raw) {
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(/[\s,]+/)
+        .map((s) => s.trim().replace(/\/+$/, '').toLowerCase())
+        .filter(Boolean);
+}
+/**
+ * Whether `raw` is an acceptable base-URL override. `allowlist` is the parsed
+ * {@link parseAllowedBaseUrls} list ([] = none configured).
+ */
+function isAllowedBaseUrl(raw, allowlist) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    const scheme = url.protocol.toLowerCase();
+    if (scheme !== 'http:' && scheme !== 'https:') {
+        return false;
+    }
+    const host = url.hostname.toLowerCase();
+    if (BLOCKED_HOSTS.has(host) || host.startsWith('169.254.')) {
+        return false;
+    }
+    if (allowlist.length === 0) {
+        return true;
+    }
+    const normalized = raw.replace(/\/+$/, '').toLowerCase();
+    return allowlist.some((allowed) => normalized === allowed || normalized.startsWith(allowed + '/'));
+}
+//# sourceMappingURL=base-url-guard.js.map

package/dist/server/bearer/base-url-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-url-guard.js","sourceRoot":"","sources":["../../../src/server/bearer/base-url-guard.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAMH,oDAQC;AAMD,4CAsBC;AAxCD,qGAAqG;AACrG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEvF,+FAA+F;AAC/F,SAAgB,oBAAoB,CAAC,GAAuB;IAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG;SACR,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;SACtD,MAAM,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,GAAW,EAAE,SAAmB;IAChE,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC,IAAI,CACpB,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,CAC3E,CAAC;AACH,CAAC"}

package/dist/server/bearer/bearer-edge.d.ts

@@ -0,0 +1,42 @@
+import { BearerAuthConfig } from '../../creatio';
+import type { Express, NextFunction, Request, Response } from 'express';
+/** RFC 9728 Protected Resource Metadata, advertising Creatio Identity as the authorization server. */
+export declare function buildProtectedResourceMetadata(resource: string, identityBase: string): {
+    resource: string;
+    authorization_servers: string[];
+    scopes_supported: string[];
+    bearer_methods_supported: string[];
+};
+/**
+ * The HTTP "edge" for the stateless per-request Bearer model — the only place the two modes differ.
+ *
+ * - **gateway**: a trusted Control-Plane injects the Bearer (+ optional `X-Creatio-Base-Url` for
+ *   multi-tenant routing); the MCP trusts it and passes it through.
+ * - **delegated**: the client obtained the token directly from Creatio Identity; the MCP advertises
+ *   that authorization server via RFC 9728, challenges unauthenticated requests, and fails fast on
+ *   an obviously-expired JWT.
+ *
+ * Both modes are FULLY-TRUSTED-ENVIRONMENT deployments: gateway trusts the Control-Plane in front of
+ * it; delegated trusts the client + the network it runs on. The MCP does NOT cryptographically
+ * verify the Bearer here — Creatio remains the ultimate authority and independently rejects invalid
+ * tokens on the API call — so the runtime is a straight token passthrough; only discovery/trust
+ * differ. The `userKey` derived from the token is therefore an UNVERIFIED, session/logging-only
+ * identity, not an authenticated principal. For an untrusted, direct external client that needs the
+ * MCP itself to verify identity, use `broker` mode (the MCP is its own audience-bound OAuth 2.1 AS).
+ */
+export declare class BearerEdge {
+    private readonly _config;
+    private readonly _baseUrl;
+    private readonly _allowedBaseUrls;
+    private get _isDelegated();
+    /** Identity Service base advertised to clients. */
+    private get _identityBase();
+    constructor(config: BearerAuthConfig, baseUrl: string);
+    private _accept;
+    private _challenge;
+    /** Delegated mode publishes RFC 9728 metadata so clients can discover the authorization server. */
+    registerRoutes(app: Express): void;
+    /** Express middleware guarding `/mcp`. Sets `req.bearerToken` / `req.userKey` / `req.baseUrlOverride`. */
+    mcpAuth(): (req: Request, res: Response, next: NextFunction) => void;
+}
+//# sourceMappingURL=bearer-edge.d.ts.map

package/dist/server/bearer/bearer-edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-edge.d.ts","sourceRoot":"","sources":["../../../src/server/bearer/bearer-edge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkB,MAAM,eAAe,CAAC;AAQjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKxE,sGAAsG;AACtG,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;;;;;EAOpF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAE5C,OAAO,KAAK,YAAY,GAEvB;IAED,mDAAmD;IACnD,OAAO,KAAK,aAAa,GAExB;gBAEW,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM;IAMrD,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,UAAU;IAiBlB,mGAAmG;IAC5F,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAUzC,0GAA0G;IACnG,OAAO,KACL,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI;CAkC/D"}

package/dist/server/bearer/bearer-edge.js

@@ -0,0 +1,122 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerEdge = void 0;
+exports.buildProtectedResourceMetadata = buildProtectedResourceMetadata;
+const creatio_1 = require("../../creatio");
+const log_1 = __importDefault(require("../../log"));
+const utils_1 = require("../../utils");
+const public_origin_1 = require("../http/public-origin");
+const base_url_guard_1 = require("./base-url-guard");
+const bearer_token_1 = require("./bearer-token");
+const PROTECTED_RESOURCE_METADATA_PATH = '/.well-known/oauth-protected-resource';
+const BASE_URL_OVERRIDE_HEADER = 'x-creatio-base-url';
+/** RFC 9728 Protected Resource Metadata, advertising Creatio Identity as the authorization server. */
+function buildProtectedResourceMetadata(resource, identityBase) {
+    return {
+        resource,
+        authorization_servers: [identityBase],
+        scopes_supported: ['offline_access'],
+        bearer_methods_supported: ['header'],
+    };
+}
+/**
+ * The HTTP "edge" for the stateless per-request Bearer model — the only place the two modes differ.
+ *
+ * - **gateway**: a trusted Control-Plane injects the Bearer (+ optional `X-Creatio-Base-Url` for
+ *   multi-tenant routing); the MCP trusts it and passes it through.
+ * - **delegated**: the client obtained the token directly from Creatio Identity; the MCP advertises
+ *   that authorization server via RFC 9728, challenges unauthenticated requests, and fails fast on
+ *   an obviously-expired JWT.
+ *
+ * Both modes are FULLY-TRUSTED-ENVIRONMENT deployments: gateway trusts the Control-Plane in front of
+ * it; delegated trusts the client + the network it runs on. The MCP does NOT cryptographically
+ * verify the Bearer here — Creatio remains the ultimate authority and independently rejects invalid
+ * tokens on the API call — so the runtime is a straight token passthrough; only discovery/trust
+ * differ. The `userKey` derived from the token is therefore an UNVERIFIED, session/logging-only
+ * identity, not an authenticated principal. For an untrusted, direct external client that needs the
+ * MCP itself to verify identity, use `broker` mode (the MCP is its own audience-bound OAuth 2.1 AS).
+ */
+class BearerEdge {
+    _config;
+    _baseUrl;
+    _allowedBaseUrls;
+    get _isDelegated() {
+        return this._config.mode === creatio_1.BearerAuthMode.Delegated;
+    }
+    /** Identity Service base advertised to clients. */
+    get _identityBase() {
+        return this._config.idBaseUrl ?? `${this._baseUrl.replace(/\/$/, '')}/0`;
+    }
+    constructor(config, baseUrl) {
+        this._config = config;
+        this._baseUrl = baseUrl;
+        this._allowedBaseUrls = (0, base_url_guard_1.parseAllowedBaseUrls)((0, utils_1.env)('CREATIO_MCP_ALLOWED_BASE_URLS'));
+    }
+    _accept(req, token, next, userKey) {
+        const r = req;
+        r.userKey = userKey ?? (0, bearer_token_1.inspectBearer)(token).userKey;
+        r.bearerToken = token;
+        next();
+    }
+    _challenge(req, res, reason) {
+        if (this._isDelegated) {
+            const resourceMetadata = `${(0, public_origin_1.resolvePublicOrigin)(req)}${PROTECTED_RESOURCE_METADATA_PATH}`;
+            res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${resourceMetadata}", error="${reason}"`);
+        }
+        res.status(401).json({
+            error: 'unauthorized',
+            error_description: reason === 'missing_token'
+                ? 'A Creatio access token is required in the Authorization header.'
+                : `Bearer token rejected: ${reason}.`,
+        });
+    }
+    /** Delegated mode publishes RFC 9728 metadata so clients can discover the authorization server. */
+    registerRoutes(app) {
+        if (!this._isDelegated) {
+            return;
+        }
+        app.get(PROTECTED_RESOURCE_METADATA_PATH, (req, res) => {
+            const resource = `${(0, public_origin_1.resolvePublicOrigin)(req)}/mcp`;
+            res.json(buildProtectedResourceMetadata(resource, this._identityBase));
+        });
+    }
+    /** Express middleware guarding `/mcp`. Sets `req.bearerToken` / `req.userKey` / `req.baseUrlOverride`. */
+    mcpAuth() {
+        return (req, res, next) => {
+            const header = req.headers.authorization;
+            if (!header || !header.startsWith('Bearer ')) {
+                return this._challenge(req, res, 'missing_token');
+            }
+            const token = header.slice(7);
+            if (!this._isDelegated) {
+                // gateway: a per-request instance override is honored only here (from the trusted
+                // gateway). Still validate it — the override decides where the Bearer is sent, so a
+                // bad value is an SSRF / token-redirection lever even from a trusted source (CWE-918).
+                const baseOverride = req.headers[BASE_URL_OVERRIDE_HEADER];
+                if (typeof baseOverride === 'string' && baseOverride) {
+                    if (!(0, base_url_guard_1.isAllowedBaseUrl)(baseOverride, this._allowedBaseUrls)) {
+                        log_1.default.warn('bearer.base_url_override.rejected', { override: baseOverride });
+                        res.status(400).json({
+                            error: 'invalid_request',
+                            error_description: 'Disallowed X-Creatio-Base-Url override.',
+                        });
+                        return;
+                    }
+                    req.baseUrlOverride = baseOverride;
+                }
+                return this._accept(req, token, next);
+            }
+            // delegated: fail fast on an obviously-expired JWT; Creatio validates the rest on the call.
+            const decoded = (0, bearer_token_1.inspectBearer)(token);
+            if (decoded.isJwt && (0, bearer_token_1.isExpired)(decoded)) {
+                return this._challenge(req, res, 'token_expired');
+            }
+            return this._accept(req, token, next, decoded.userKey);
+        };
+    }
+}
+exports.BearerEdge = BearerEdge;
+//# sourceMappingURL=bearer-edge.js.map

package/dist/server/bearer/bearer-edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-edge.js","sourceRoot":"","sources":["../../../src/server/bearer/bearer-edge.ts"],"names":[],"mappings":";;;;;;AAcA,wEAOC;AArBD,2CAAiE;AACjE,oDAA4B;AAC5B,uCAAkC;AAClC,yDAA4D;AAE5D,qDAA0E;AAC1E,iDAA0D;AAI1D,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AACjF,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAEtD,sGAAsG;AACtG,SAAgB,8BAA8B,CAAC,QAAgB,EAAE,YAAoB;IACpF,OAAO;QACN,QAAQ;QACR,qBAAqB,EAAE,CAAC,YAAY,CAAC;QACrC,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;QACpC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,UAAU;IACL,OAAO,CAAmB;IAC1B,QAAQ,CAAS;IACjB,gBAAgB,CAAW;IAE5C,IAAY,YAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,wBAAc,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,mDAAmD;IACnD,IAAY,aAAa;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;IAC1E,CAAC;IAED,YAAY,MAAwB,EAAE,OAAe;QACpD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,gBAAgB,GAAG,IAAA,qCAAoB,EAAC,IAAA,WAAG,EAAC,+BAA+B,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,OAAO,CAAC,GAAY,EAAE,KAAa,EAAE,IAAkB,EAAE,OAAgB;QAChF,MAAM,CAAC,GAAG,GAA2D,CAAC;QACtE,CAAC,CAAC,OAAO,GAAG,OAAO,IAAI,IAAA,4BAAa,EAAC,KAAK,CAAC,CAAC,OAAO,CAAC;QACpD,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC;IACR,CAAC;IAEO,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,MAAc;QAC7D,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,gBAAgB,GAAG,GAAG,IAAA,mCAAmB,EAAC,GAAG,CAAC,GAAG,gCAAgC,EAAE,CAAC;YAC1F,GAAG,CAAC,SAAS,CACZ,kBAAkB,EAClB,6BAA6B,gBAAgB,aAAa,MAAM,GAAG,CACnE,CAAC;QACH,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,cAAc;YACrB,iBAAiB,EAChB,MAAM,KAAK,eAAe;gBACzB,CAAC,CAAC,iEAAiE;gBACnE,CAAC,CAAC,0BAA0B,MAAM,GAAG;SACvC,CAAC,CAAC;IACJ,CAAC;IAED,mGAAmG;IAC5F,cAAc,CAAC,GAAY;QACjC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;QACR,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,gCAAgC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;YACzE,MAAM,QAAQ,GAAG,GAAG,IAAA,mCAAmB,EAAC,GAAG,CAAC,MAAM,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,0GAA0G;IACnG,OAAO;QACb,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;YAChE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAE9B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACxB,kFAAkF;gBAClF,oFAAoF;gBACpF,uFAAuF;gBACvF,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;gBAC3D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,EAAE,CAAC;oBACtD,IAAI,CAAC,IAAA,iCAAgB,EAAC,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;wBAC5D,aAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;wBAC1E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;4BACpB,KAAK,EAAE,iBAAiB;4BACxB,iBAAiB,EAAE,yCAAyC;yBAC5D,CAAC,CAAC;wBACH,OAAO;oBACR,CAAC;oBACA,GAA8C,CAAC,eAAe,GAAG,YAAY,CAAC;gBAChF,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;YAED,4FAA4F;YAC5F,MAAM,OAAO,GAAG,IAAA,4BAAa,EAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,KAAK,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,CAAC;IACH,CAAC;CACD;AA3FD,gCA2FC"}

package/dist/server/bearer/bearer-token.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Lightweight, crypto-free inspection of an incoming Bearer token.
+ *
+ * In the stateless per-request model (delegated/gateway — both fully-trusted deployments) the Bearer
+ * is a Creatio access token. Creatio remains the cryptographic authority: it rejects bad/expired
+ * tokens with 401 on the actual API call. The MCP does NOT verify the signature here — it only needs
+ * a stable per-request identity (for session mapping / logging) and a cheap obviously-expired guard.
+ *
+ * SECURITY NOTE: the `userKey` returned here is therefore UNVERIFIED — it is read from an unsigned
+ * decode of a token the MCP does not trust. Use it only as a session/logging key, never as proof of
+ * an authenticated principal. (An untrusted direct client that needs the MCP to verify identity must
+ * use `broker` mode, where the MCP issues and verifies its own audience-bound tokens.)
+ */
+export interface DecodedBearer {
+    /** An UNVERIFIED stable identity for the token: `sub` claim when present, else a short
+     *  fingerprint. Suitable for session keying/logging only — not an authenticated principal. */
+    userKey: string;
+    /** Expiry (epoch seconds) if the token is a JWT with `exp`. */
+    expSeconds?: number;
+    /** Whether the token parsed as a JWT (vs an opaque/reference token). */
+    isJwt: boolean;
+}
+/** Extracts a stable userKey + optional expiry from a Bearer token without verifying its signature. */
+export declare function inspectBearer(token: string): DecodedBearer;
+/** True when a JWT's `exp` is in the past (with a small skew), so we can fail fast before calling Creatio. */
+export declare function isExpired(decoded: DecodedBearer, nowMs?: number, skewSeconds?: number): boolean;
+//# sourceMappingURL=bearer-token.d.ts.map

package/dist/server/bearer/bearer-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-token.d.ts","sourceRoot":"","sources":["../../../src/server/bearer/bearer-token.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,aAAa;IAC7B;kGAC8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,KAAK,EAAE,OAAO,CAAC;CACf;AAED,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAY1D;AAED,8GAA8G;AAC9G,wBAAgB,SAAS,CACxB,OAAO,EAAE,aAAa,EACtB,KAAK,GAAE,MAAmB,EAC1B,WAAW,SAAK,GACd,OAAO,CAKT"}

package/dist/server/bearer/bearer-token.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectBearer = inspectBearer;
+exports.isExpired = isExpired;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+/** Extracts a stable userKey + optional expiry from a Bearer token without verifying its signature. */
+function inspectBearer(token) {
+    const decoded = safeDecode(token);
+    if (decoded && typeof decoded === 'object') {
+        const sub = typeof decoded.sub === 'string' ? decoded.sub : undefined;
+        const exp = typeof decoded.exp === 'number' ? decoded.exp : undefined;
+        return {
+            userKey: sub ?? fingerprint(token),
+            ...(exp !== undefined ? { expSeconds: exp } : {}),
+            isJwt: true,
+        };
+    }
+    return { userKey: fingerprint(token), isJwt: false };
+}
+/** True when a JWT's `exp` is in the past (with a small skew), so we can fail fast before calling Creatio. */
+function isExpired(decoded, nowMs = Date.now(), skewSeconds = 30) {
+    if (decoded.expSeconds === undefined) {
+        return false;
+    }
+    return nowMs / 1000 > decoded.expSeconds + skewSeconds;
+}
+function safeDecode(token) {
+    try {
+        const decoded = jsonwebtoken_1.default.decode(token);
+        return decoded && typeof decoded === 'object' ? decoded : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A short, non-reversible fingerprint of an opaque token, used only as a per-request session key.
+ * Not security-sensitive (the token itself is the credential); it just needs to be stable + opaque.
+ */
+function fingerprint(token) {
+    let hash = 0;
+    for (let i = 0; i < token.length; i++) {
+        hash = (hash * 31 + token.charCodeAt(i)) | 0;
+    }
+    return `tok_${(hash >>> 0).toString(36)}`;
+}
+//# sourceMappingURL=bearer-token.js.map

package/dist/server/bearer/bearer-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-token.js","sourceRoot":"","sources":["../../../src/server/bearer/bearer-token.ts"],"names":[],"mappings":";;;;;AA0BA,sCAYC;AAGD,8BASC;AAlDD,gEAA+B;AAyB/B,uGAAuG;AACvG,SAAgB,aAAa,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,OAAO;YACN,OAAO,EAAE,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC;YAClC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,EAAE,IAAI;SACX,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED,8GAA8G;AAC9G,SAAgB,SAAS,CACxB,OAAsB,EACtB,QAAgB,IAAI,CAAC,GAAG,EAAE,EAC1B,WAAW,GAAG,EAAE;IAEhB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAA0B,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3C,CAAC"}

package/dist/server/bearer/index.d.ts

@@ -0,0 +1,3 @@
+export * from './bearer-token';
+export * from './bearer-edge';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/bearer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/bearer/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC"}

package/dist/server/bearer/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./bearer-token"), exports);
+__exportStar(require("./bearer-edge"), exports);
+//# sourceMappingURL=index.js.map

package/dist/server/bearer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/bearer/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,gDAA8B"}

package/dist/server/http/auth-edge.d.ts

@@ -0,0 +1,26 @@
+import { SessionContext } from '../../sessions';
+import type { CreatioClientConfig } from '../../creatio';
+import type { Express, RequestHandler } from 'express';
+export interface RateLimitOptions {
+    windowMs: number;
+    max: number;
+}
+export type RateLimitFactory = (options: RateLimitOptions) => RequestHandler;
+/**
+ * The HTTP auth strategy for the `/mcp` surface: a guard middleware, the mode-specific discovery /
+ * OAuth routes, and optional periodic cleanup. Extracting this keeps {@link HttpServer} from
+ * branching on `auth.kind` (and from owning the `config!`/`as` casts) — it just consumes a strategy.
+ */
+export interface AuthEdge {
+    mcpAuth(): RequestHandler;
+    registerRoutes(app: Express, rateLimit: RateLimitFactory): void;
+    /** Periodic maintenance (e.g. evict expired broker codes/tokens); omitted when there is none. */
+    cleanup?(): void;
+}
+/**
+ * Build the auth edge for the configured mode, or `undefined` when no `/mcp` auth applies
+ * (e.g. a single-identity stdio-style config served over HTTP). The one place that maps an auth
+ * config to its HTTP strategy.
+ */
+export declare function createAuthEdge(config: CreatioClientConfig | undefined, session: SessionContext): AuthEdge | undefined;
+//# sourceMappingURL=auth-edge.d.ts.map

package/dist/server/http/auth-edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-edge.d.ts","sourceRoot":"","sources":["../../../src/server/http/auth-edge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAMhD,OAAO,KAAK,EAAsC,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACZ;AACD,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,cAAc,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACxB,OAAO,IAAI,cAAc,CAAC;IAC1B,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChE,iGAAiG;IACjG,OAAO,CAAC,IAAI,IAAI,CAAC;CACjB;AA0DD;;;;GAIG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,OAAO,EAAE,cAAc,GACrB,QAAQ,GAAG,SAAS,CAmBtB"}

package/dist/server/http/auth-edge.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthEdge = createAuthEdge;
+const creatio_1 = require("../../creatio");
+const bearer_1 = require("../bearer");
+const oauth_1 = require("../oauth");
+const broker_handlers_1 = require("./broker-handlers");
+/** Stateless per-request Bearer edge (delegated / gateway). */
+class BearerAuthEdge {
+    _edge;
+    constructor(_edge) {
+        this._edge = _edge;
+    }
+    mcpAuth() {
+        return this._edge.mcpAuth();
+    }
+    registerRoutes(app) {
+        this._edge.registerRoutes(app);
+    }
+}
+/** Broker edge: the MCP's own OAuth 2.1 AS + the brokered Creatio login. */
+class BrokerAuthEdge {
+    _handlers;
+    _oauth;
+    _session;
+    // Per-route fixed-window limits (per IP) for the unauthenticated broker OAuth surface.
+    static RL_AUTH_FLOW = { windowMs: 60_000, max: 60 };
+    static RL_TOKEN = { windowMs: 60_000, max: 30 };
+    static RL_REGISTER = { windowMs: 60_000, max: 10 };
+    constructor(_handlers, _oauth, _session) {
+        this._handlers = _handlers;
+        this._oauth = _oauth;
+        this._session = _session;
+    }
+    mcpAuth() {
+        return this._handlers.mcpAuth();
+    }
+    registerRoutes(app, rateLimit) {
+        const h = this._handlers;
+        app.get('/.well-known/oauth-authorization-server', (q, s) => h.handleMetadata(q, s));
+        app.get('/.well-known/oauth-protected-resource', (q, s) => h.handleProtectedResourceMetadata(q, s));
+        app.post('/register', rateLimit(BrokerAuthEdge.RL_REGISTER), (q, s) => h.handleRegister(q, s));
+        app.get('/authorize', rateLimit(BrokerAuthEdge.RL_AUTH_FLOW), (q, s) => h.handleAuthorize(q, s));
+        app.get('/oauth/callback', rateLimit(BrokerAuthEdge.RL_AUTH_FLOW), (q, s) => h.handleCallback(q, s));
+        app.post('/token', rateLimit(BrokerAuthEdge.RL_TOKEN), (q, s) => h.handleToken(q, s));
+        app.post('/revoke', rateLimit(BrokerAuthEdge.RL_TOKEN), (q, s) => h.handleRevoke(q, s));
+    }
+    cleanup() {
+        // Broker keeps transient state (codes, pending auths, user tokens) — keep the maps bounded.
+        this._oauth.cleanup();
+        void this._session.evictStaleTokens();
+    }
+}
+/**
+ * Build the auth edge for the configured mode, or `undefined` when no `/mcp` auth applies
+ * (e.g. a single-identity stdio-style config served over HTTP). The one place that maps an auth
+ * config to its HTTP strategy.
+ */
+function createAuthEdge(config, session) {
+    const auth = config?.auth;
+    if (!auth || !config) {
+        return undefined;
+    }
+    if (auth.kind === creatio_1.AuthProviderType.OAuth2Bearer) {
+        return new BearerAuthEdge(new bearer_1.BearerEdge(auth, config.baseUrl));
+    }
+    if (auth.kind === creatio_1.AuthProviderType.Broker) {
+        const brokerAuth = auth;
+        const oauth = new oauth_1.OAuthServer(brokerAuth.jwtSecret);
+        const handlers = new broker_handlers_1.BrokerHandlers(oauth, new creatio_1.CreatioOAuthClient(config.baseUrl, brokerAuth), session);
+        return new BrokerAuthEdge(handlers, oauth, session);
+    }
+    return undefined;
+}
+//# sourceMappingURL=auth-edge.js.map

package/dist/server/http/auth-edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-edge.js","sourceRoot":"","sources":["../../../src/server/http/auth-edge.ts"],"names":[],"mappings":";;AAyFA,wCAsBC;AA/GD,2CAAqE;AAErE,sCAAuC;AACvC,oCAAuC;AAEvC,uDAAmD;AAuBnD,+DAA+D;AAC/D,MAAM,cAAc;IACU;IAA7B,YAA6B,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;IAAG,CAAC;IAE3C,OAAO;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEM,cAAc,CAAC,GAAY;QACjC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;CACD;AAED,4EAA4E;AAC5E,MAAM,cAAc;IAOD;IACA;IACA;IARlB,uFAAuF;IAC/E,MAAM,CAAU,YAAY,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,CAAU,QAAQ,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAEpE,YACkB,SAAyB,EACzB,MAAmB,EACnB,QAAwB;QAFxB,cAAS,GAAT,SAAS,CAAgB;QACzB,WAAM,GAAN,MAAM,CAAa;QACnB,aAAQ,GAAR,QAAQ,CAAgB;IACvC,CAAC;IAEG,OAAO;QACb,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAEM,cAAc,CAAC,GAAY,EAAE,SAA2B;QAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC,CACvC,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrE,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CACtB,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CACvB,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC3E,CAAC,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CACtB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAEM,OAAO;QACb,4FAA4F;QAC5F,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtB,KAAK,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IACvC,CAAC;;AAGF;;;;GAIG;AACH,SAAgB,cAAc,CAC7B,MAAuC,EACvC,OAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,0BAAgB,CAAC,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,cAAc,CAAC,IAAI,mBAAU,CAAC,IAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,0BAAgB,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAwB,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,mBAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,gCAAc,CAClC,KAAK,EACL,IAAI,4BAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,EAClD,OAAO,CACP,CAAC;QACF,OAAO,IAAI,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC"}

package/dist/server/http/broker-handlers.d.ts

@@ -0,0 +1,45 @@
+import { CreatioOAuthClient } from '../../creatio';
+import { SessionContext } from '../../sessions';
+import { OAuthServer } from '../oauth';
+import type { NextFunction, Request, Response } from 'express';
+/**
+ * Broker mode HTTP handlers: the MCP is its own OAuth 2.1 authorization server for clients and
+ * brokers the user login to Creatio (authorization_code + PKCE). The MCP-client PKCE and our own
+ * Creatio-leg PKCE are kept in separate fields (server-side {@link OAuthServer.createPendingAuthorization})
+ * — nothing is embedded in the Creatio `state`, so the two never collide.
+ */
+export declare class BrokerHandlers {
+    private readonly _oauth;
+    private readonly _creatio;
+    private readonly _session;
+    private readonly _callbackPath;
+    constructor(_oauth: OAuthServer, _creatio: CreatioOAuthClient, _session: SessionContext);
+    private _callbackUrl;
+    /** RFC 6750 `401` challenge pointing at our protected-resource metadata. `invalid_token` tells a
+     *  client holding a now-unusable token to re-authenticate (vs. a plain "no credentials" prompt). */
+    private _challenge;
+    private _redirectError;
+    handleMetadata(req: Request, res: Response): void;
+    /** RFC 9728: in broker mode WE are the authorization server, so it points back at this origin. */
+    handleProtectedResourceMetadata(req: Request, res: Response): void;
+    /**
+     * Guards `/mcp`: validates the token THIS server issued, confirms we still hold the user's
+     * brokered Creatio tokens, and exposes the `userKey`. The Creatio tokens are kept in memory and
+     * are therefore lost on restart, while the token we issued (a stateless JWT) survives — so a
+     * reconnecting client looks authenticated but every Creatio call would fail. When the tokens are
+     * gone we answer `401` with `error="invalid_token"` so the client transparently re-runs OAuth.
+     */
+    mcpAuth(): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+    handleRegister(req: Request, res: Response): void;
+    handleAuthorize(req: Request, res: Response): Promise<void>;
+    handleCallback(req: Request, res: Response): Promise<void>;
+    handleToken(req: Request, res: Response): Promise<void>;
+    /**
+     * RFC 7009 token revocation / logout: invalidate the user's brokered session. Resolve the user
+     * from the presented token, revoke their Creatio token upstream (best-effort), and purge the
+     * server-side Creatio tokens + our issued refresh tokens. Always answers 200 — even for an
+     * unknown token — so it is not a token-validity oracle.
+     */
+    handleRevoke(req: Request, res: Response): Promise<void>;
+}
+//# sourceMappingURL=broker-handlers.d.ts.map

package/dist/server/http/broker-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-handlers.d.ts","sourceRoot":"","sources":["../../../src/server/http/broker-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,WAAW,EAAmB,MAAM,UAAU,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAiC/D;;;;;GAKG;AACH,qBAAa,cAAc;IAIzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL1B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAGjC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,kBAAkB,EAC5B,QAAQ,EAAE,cAAc;IAG1C,OAAO,CAAC,YAAY;IAIpB;wGACoG;IACpG,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,cAAc;IAiBf,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAIxD,kGAAkG;IAC3F,+BAA+B,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAKzE;;;;;;OAMG;IACI,OAAO,KACC,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC;IA2BvE,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI;IAU3C,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAyC3D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC1D,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBpE;;;;;OAKG;IACU,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBrE"}