From a3a747b316931ed6dc22a60569137a1dff62bc0e Mon Sep 17 00:00:00 2001
From: jonnyparris <6400000+jonnyparris@users.noreply.github.com>
Date: Tue, 26 May 2026 11:19:38 +0100
Subject: [PATCH] chore(oauth): add oauth4webapi and wiring points
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 0 of cf-portal MCP OAuth support — pure dependency addition with
no functional changes. oauth4webapi will be used in subsequent phases
for PKCE + DCR + token refresh against cf-portal.

Plan: memory/workload/plans/2026-05-26-dodo-cf-portal-oauth.md
---
 package-lock.json | 10 ++++++++++
 package.json      |  1 +
 2 files changed, 11 insertions(+)

diff --git a/package-lock.json b/package-lock.json
index 7860a6d..4a9b217 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,6 +21,7 @@
         "cron-schedule": "^6.0.0",
         "hono": "^4.12.9",
         "jose": "^6.1.3",
+        "oauth4webapi": "^3.8.6",
         "typescript": "^5.8.3",
         "zod": "^4.1.11"
       },
@@ -5140,6 +5141,15 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/oauth4webapi": {
+      "version": "3.8.6",
+      "resolved": "https://registry.npmjs.org/oauth4webapi/-/oauth4webapi-3.8.6.tgz",
+      "integrity": "sha512-iwemM91xz8nryHti2yTmg5fhyEMVOkOXwHNqbvcATjyajb5oQxCQzrNOA6uElRHuMhQQTKUyFKV9y/CNyg25BQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
+    },
     "node_modules/object-assign": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
diff --git a/package.json b/package.json
index 0c6df31..8abf597 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "cron-schedule": "^6.0.0",
     "hono": "^4.12.9",
     "jose": "^6.1.3",
+    "oauth4webapi": "^3.8.6",
     "typescript": "^5.8.3",
     "zod": "^4.1.11"
   },