@adonis-agora/agent 0.76.2 → 0.77.0

package/dist/src/mcp/auth.js

@@ -1,3 +1,6 @@
+import { scopeRole } from '../a2a/gate.js';
+import { PERSONAL_AGENT_ROLE } from '../a2a/permission-tool.js';
+import { globalPoppyAuthenticate } from '../poppy/auth.js';
 /**
  * A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
  * client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
@@ -22,10 +25,17 @@
 export class McpAuthError extends Error {
     /** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
     status;
+    /**
+     * The `WWW-Authenticate` error code, when not the status' default (`invalid_token` for 401,
+     * `insufficient_scope` for 403) — e.g. Poppy's `sign_in_required` (§4.3).
+     */
+    error;
     constructor(message, options = {}) {
         super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
         this.name = 'McpAuthError';
         this.status = options.status ?? 401;
+        if (options.error !== undefined)
+            this.error = options.error;
     }
 }
 /**
@@ -37,6 +47,8 @@ export async function resolveMcpAuth(auth, ctx) {
     }
     return auth;
 }
+/** The `gty` authkit-server gives the access tokens it mints for a Poppy session (§6, MCP). */
+export const POPPY_GRANT_TYPE = 'poppy';
 /**
  * Authenticate MCP clients with `@adonis-agora/authkit-server`: verifies the bearer token against the
  * authkit OIDC provider's stored access tokens (`provider.AccessToken.find`) and advertises OAuth
@@ -73,6 +85,15 @@ export function authKitAuth(options = {}) {
                 const service = await getService();
                 const at = await service.provider.AccessToken.find(token);
                 if (!at) {
+                    // A signed-out Poppy Session's MCP token lives only in authkit's Poppy store: it is valid,
+                    // but this server needs an account — Poppy's `sign_in_required` (§4.3), not `invalid_token`
+                    // (which would only make the agent mint the same kind of token again).
+                    if (context !== undefined && (await isSignedOutPoppyToken(token, context.resource))) {
+                        throw new McpAuthError('sign in to use this server', {
+                            status: 403,
+                            error: 'sign_in_required',
+                        });
+                    }
                     // Not an access token this issuer knows — plain `Error`, so `anyOf` tries the next strategy.
                     throw new Error('invalid or expired access token');
                 }
@@ -93,7 +114,8 @@ export function authKitAuth(options = {}) {
                     }
                 }
                 const tokenScopes = (at.scope ?? '').split(' ').filter(Boolean);
-                const actor = await toActor({
+                const personalAgent = at.gty === POPPY_GRANT_TYPE;
+                const resolved = await toActor({
                     accountId: at.accountId,
                     scopes: tokenScopes,
                     clientId: at.clientId,
@@ -101,7 +123,23 @@ export function authKitAuth(options = {}) {
                     grant,
                     activeOrg: readActiveOrg(grant?.activeOrg),
                     extra: at.extra,
+                    personalAgent,
                 });
+                // A personal agent's token carries the user's account but only the scopes they granted: the
+                // roles below put it behind `personalAgentGate` (the MCP provider wraps its authorizer in it),
+                // as a Poppy conversation or a PACT delegation does.
+                const actor = personalAgent
+                    ? {
+                        ...resolved,
+                        roles: [
+                            ...new Set([
+                                ...(resolved.roles ?? []),
+                                PERSONAL_AGENT_ROLE,
+                                ...tokenScopes.map(scopeRole),
+                            ]),
+                        ],
+                    }
+                    : resolved;
                 return {
                     token,
                     clientId: at.clientId ?? '',
@@ -113,6 +151,23 @@ export function authKitAuth(options = {}) {
         };
     };
 }
+/** A Bearer token authkit issued for `resource` to a Poppy Session that is not signed in. */
+async function isSignedOutPoppyToken(token, resource) {
+    const authenticate = globalPoppyAuthenticate();
+    if (authenticate === undefined)
+        return false;
+    try {
+        const result = await authenticate({
+            method: 'POST',
+            url: resource,
+            headers: { authorization: `Bearer ${token}` },
+        });
+        return result.ok && !result.principal.signedIn;
+    }
+    catch {
+        return false;
+    }
+}
 /** Whether a token's `aud` names `resource` (a trailing slash on either side is tolerated). */
 function audienceNames(aud, resource) {
     const trim = (value) => value.replace(/\/+$/, '');

package/dist/src/mcp/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAmEA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IAC1G,MAAM,CAAY;IAE3B,YAAY,OAAe,EAAE,OAAO,GAA4C,EAAE;QAChF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACtC,CAAC;CACF;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA+FD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,6FAA6F;oBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IACE,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,UAAU;oBAC/C,OAAO,KAAK,SAAS;oBACrB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EACxC,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,0CAA0C,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,KAA+B,CAAC;gBACpC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACrE,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,qEAAqE;wBACrE,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC;oBAC1B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,KAAK;oBACL,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,KAAK;iBAChB,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,GAAkC,EAAE,QAAgB;IACzE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,UAA2C;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC;QAC/E,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,IAAI,SAAkB,CAAC;gBACvB,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/C,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,KAAK,CAAC;wBAC/C,SAAS,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAkE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IAC1G,MAAM,CAAY;IAC3B;;;OAGG;IACM,KAAK,CAAqB;IAEnC,YACE,OAAe,EACf,OAAO,GAAuE,EAAE;QAEhF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9D,CAAC;CACF;AAWD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiCD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAyExC;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,2FAA2F;oBAC3F,4FAA4F;oBAC5F,uEAAuE;oBACvE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBACpF,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE;4BACnD,MAAM,EAAE,GAAG;4BACX,KAAK,EAAE,kBAAkB;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBACD,6FAA6F;oBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IACE,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,UAAU;oBAC/C,OAAO,KAAK,SAAS;oBACrB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EACxC,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,0CAA0C,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,KAA+B,CAAC;gBACpC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACrE,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,qEAAqE;wBACrE,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,aAAa,GAAG,EAAE,CAAC,GAAG,KAAK,gBAAgB,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;oBAC7B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,KAAK;oBACL,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,aAAa;iBACd,CAAC,CAAC;gBACH,4FAA4F;gBAC5F,+FAA+F;gBAC/F,qDAAqD;gBACrD,MAAM,KAAK,GAAU,aAAa;oBAChC,CAAC,CAAC;wBACE,GAAG,QAAQ;wBACX,KAAK,EAAE;4BACL,GAAG,IAAI,GAAG,CAAC;gCACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gCACzB,mBAAmB;gCACnB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;6BAC9B,CAAC;yBACH;qBACF;oBACH,CAAC,CAAC,QAAQ,CAAC;gBACb,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;IAC/C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,GAAkC,EAAE,QAAgB;IACzE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,UAA2C;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC;QAC/E,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,IAAI,SAAkB,CAAC;gBACvB,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/C,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,KAAK,CAAC;wBAC/C,SAAS,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/mcp/discovery.d.ts

@@ -27,7 +27,16 @@ export interface ProtectedResourceMetadata {
     bearer_methods_supported: string[];
     resource_name: string;
 }
-/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+/**
+ * The Poppy issuer `@adonis-agora/authkit-server` announces in `Symbol.for('@adonis-agora/poppy:issuer')`
+ * when Personal Agent Protocol is on — Poppy §6 requires a listed MCP server's `authorization_servers`
+ * to include it, so a Poppy Session Token's issuer is one this server names.
+ */
+export declare function announcedPoppyIssuer(): string | undefined;
+/**
+ * Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. Its `authorization_servers`
+ * is the configured issuer, plus the Poppy issuer when one is announced (and different).
+ */
 export declare function protectedResourceMetadata(meta: McpOAuthMetadata, origin: string, path: string): ProtectedResourceMetadata;
 /** Options for {@link wwwAuthenticateChallenge}. */
 export interface WwwAuthenticateOptions {
@@ -35,9 +44,11 @@ export interface WwwAuthenticateOptions {
      * The RFC 6750 error code. `invalid_token` when the request carried a token that was refused,
      * `insufficient_scope` for a `403`, omitted when no token was sent at all (RFC 6750 §3.1).
      */
-    error?: 'invalid_token' | 'insufficient_scope';
+    error?: 'invalid_token' | 'insufficient_scope' | 'sign_in_required';
     /** The metadata URL (RFC 9728 §5.1). Set only when the auth strategy exposes OAuth metadata. */
     resourceMetadataUrl?: string;
+    /** With `insufficient_scope`: the scopes the request needs (RFC 6750 §3), space-separated. */
+    scope?: string;
 }
 /**
  * The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.

package/dist/src/mcp/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,yBAAyB,CAQ3B;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,CAAC;IAC/C,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAOrF"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAGzD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,yBAAyB,CAS3B;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IACpE,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAQrF"}

package/dist/src/mcp/discovery.js

@@ -39,11 +39,24 @@ export function mcpResourceUrl(origin, path) {
 export function protectedResourceMetadataUrl(origin, path) {
     return `${origin}/.well-known/oauth-protected-resource/${normalizeMcpPath(path)}`;
 }
-/** Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. */
+/**
+ * The Poppy issuer `@adonis-agora/authkit-server` announces in `Symbol.for('@adonis-agora/poppy:issuer')`
+ * when Personal Agent Protocol is on — Poppy §6 requires a listed MCP server's `authorization_servers`
+ * to include it, so a Poppy Session Token's issuer is one this server names.
+ */
+export function announcedPoppyIssuer() {
+    const value = globalThis[Symbol.for('@adonis-agora/poppy:issuer')];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+/**
+ * Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. Its `authorization_servers`
+ * is the configured issuer, plus the Poppy issuer when one is announced (and different).
+ */
 export function protectedResourceMetadata(meta, origin, path) {
+    const poppyIssuer = announcedPoppyIssuer();
     return {
         resource: mcpResourceUrl(origin, path),
-        authorization_servers: [meta.issuer],
+        authorization_servers: [...new Set([meta.issuer, ...(poppyIssuer ? [poppyIssuer] : [])])],
         scopes_supported: meta.scopesSupported,
         bearer_methods_supported: ['header'],
         resource_name: meta.resourceName,
@@ -58,6 +71,8 @@ export function wwwAuthenticateChallenge(options = {}) {
     const params = [];
     if (options.error !== undefined)
         params.push(`error="${options.error}"`);
+    if (options.scope !== undefined)
+        params.push(`scope="${quote(options.scope)}"`);
     if (options.resourceMetadataUrl !== undefined) {
         params.push(`resource_metadata="${quote(options.resourceMetadataUrl)}"`);
     }

package/dist/src/mcp/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA2B,EAAE;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,oDAAoD;AACpD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAI,UAAsC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA2B,EAAE;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,oDAAoD;AACpD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/src/mcp/index.d.ts

@@ -1,5 +1,5 @@
 export { actorFromAuthInfo, isActor } from './actor.js';
-export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
+export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpChallengeError, McpOAuthMetadata, } from './auth.js';
 export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
 export type { McpConfig, McpEndpointConfig, McpToolDescriber, McpToolDescription, } from './define_config.js';
 export { defineMcpConfig } from './define_config.js';

package/dist/src/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAexD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOzF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAgBxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOzF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/mcp/scope.d.ts

@@ -0,0 +1,13 @@
+import type { RolesPolicy } from '../spi/roles-policy.js';
+import type { Actor, ToolSpec } from '../types.js';
+/**
+ * The scopes a personal agent lacks to RUN a tool it is offered (`personalAgentGate`: a tool behind a
+ * `scope:` role is offered to every personal agent, run only with that scope). `null` when the actor
+ * is not a personal agent, the tool is not offered to it, or it may run it.
+ *
+ * The MCP provider answers such a `tools/call` with `403` + `WWW-Authenticate: Bearer
+ * error="insufficient_scope", scope="…"` (RFC 6750 §3.1, MCP scope step-up), so the client can ask
+ * the user for the scope instead of reading a generic tool error.
+ */
+export declare function missingScopes(actor: Actor, spec: ToolSpec, policy: RolesPolicy): Promise<string[] | null>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/src/mcp/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/mcp/scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAS1B"}

package/dist/src/mcp/scope.js

@@ -0,0 +1,24 @@
+import { SCOPE_ROLE_PREFIX } from '../a2a/gate.js';
+import { PERSONAL_AGENT_ROLE } from '../a2a/permission-tool.js';
+/**
+ * The scopes a personal agent lacks to RUN a tool it is offered (`personalAgentGate`: a tool behind a
+ * `scope:` role is offered to every personal agent, run only with that scope). `null` when the actor
+ * is not a personal agent, the tool is not offered to it, or it may run it.
+ *
+ * The MCP provider answers such a `tools/call` with `403` + `WWW-Authenticate: Bearer
+ * error="insufficient_scope", scope="…"` (RFC 6750 §3.1, MCP scope step-up), so the client can ask
+ * the user for the scope instead of reading a generic tool error.
+ */
+export async function missingScopes(actor, spec, policy) {
+    const roles = actor.roles ?? [];
+    if (!roles.includes(PERSONAL_AGENT_ROLE))
+        return null;
+    const offered = policy.canOffer ? await policy.canOffer(actor, spec) : true;
+    if (!offered || (await policy.can(actor, spec)))
+        return null;
+    const missing = (spec.roles ?? [])
+        .filter((role) => role.startsWith(SCOPE_ROLE_PREFIX) && !roles.includes(role))
+        .map((role) => role.slice(SCOPE_ROLE_PREFIX.length));
+    return missing.length > 0 ? missing : null;
+}
+//# sourceMappingURL=scope.js.map

package/dist/src/mcp/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/mcp/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAY,EACZ,IAAc,EACd,MAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}

package/dist/src/mcp/server.d.ts

@@ -2,7 +2,7 @@ import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import type { RolesPolicy } from '../spi/roles-policy.js';
 import { ToolRegistry } from '../tool-registry.js';
-import type { Actor } from '../types.js';
+import type { Actor, ToolSpec } from '../types.js';
 import type { McpToolDescriber } from './define_config.js';
 /**
  * Runtime context a MCP handler synthesizes for {@link ToolRegistry.invoke}: the acting {@link Actor}
@@ -44,6 +44,11 @@ export interface CreateMcpServerOptions extends McpToolContextOptions {
      */
     actions?: 'refuse' | 'execute';
 }
+/** Whether this tool may be reached over MCP at all — the same answer for listing and for calling. */
+export declare function isExposable(spec: {
+    kind: string;
+    presentation?: ToolSpec['presentation'];
+} | undefined, actions: 'refuse' | 'execute'): boolean;
 /**
  * Build a low-level MCP `Server` that exposes the agent's {@link ToolRegistry} over the wire:
  *

package/dist/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,EAAY,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC;IACzD,yFAAyF;IACzF,cAAc,CAAC,EAAE,CACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,KACnC;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,yCAAyC;IACzC,QAAQ,EAAE,YAAY,CAAC;IACvB,kFAAkF;IAClF,MAAM,EAAE,WAAW,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAChC;AAmED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAgGvE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC;IACzD,yFAAyF;IACzF,cAAc,CAAC,EAAE,CACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,KACnC;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,yCAAyC;IACzC,QAAQ,EAAE,YAAY,CAAC;IACvB,kFAAkF;IAClF,MAAM,EAAE,WAAW,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAChC;AASD,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;CAAE,GAAG,SAAS,EAC3E,OAAO,EAAE,QAAQ,GAAG,SAAS,GAC5B,OAAO,CAUT;AA4CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAgGvE"}

package/dist/src/mcp/server.js

@@ -11,7 +11,7 @@ import { createNoopEmitUi } from '../tool-ui.js';
  */
 const LOOP_SERVED_KINDS = new Set(['agent', 'ask', 'skill', 'memory']);
 /** Whether this tool may be reached over MCP at all — the same answer for listing and for calling. */
-function isExposable(spec, actions) {
+export function isExposable(spec, actions) {
     if (spec === undefined || LOOP_SERVED_KINDS.has(spec.kind)) {
         return false;
     }

package/dist/src/mcp/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAInG,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiDjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvE,sGAAsG;AACtG,SAAS,WAAW,CAClB,IAA2E,EAC3E,OAA6B;IAE7B,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAAC,MAAwB;IAGrD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,SAAS;QACpB,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAwB;IAC5C,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,EAA6B,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAChD;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,CACf,QAA8B,EAC9B,SAA6B,EAC7B,SAAsC,EAC3B,EAAE;QACb,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC;YACtC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE;gBACxC,KAAK,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;gBAClC,SAAS,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;aACvC,CAAC;QACN,uFAAuF;QACvF,0DAA0D;QAC1D,MAAM,UAAU,GAAG,YAAY,UAAU,EAAE,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK;YACL,GAAG,GAAG;YACN,UAAU;YACV,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,UAAU,EAAE;YAC5C,4EAA4E;YAC5E,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC/B,2FAA2F;YAC3F,0CAA0C;YAC1C,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAC9F,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CACrD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;oBACjD,6EAA6E;oBAC7E,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI;wBACrC,YAAY,EAAE,UAAU,CAAC,IAAI,KAAK,MAAM;qBACzC;iBACF,CAAC;YACJ,CAAC,CAAC,CACH;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,IAAI,CAAC;YACH,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,eAAe;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;iBACrF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAInG,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiDjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvE,sGAAsG;AACtG,MAAM,UAAU,WAAW,CACzB,IAA2E,EAC3E,OAA6B;IAE7B,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAAC,MAAwB;IAGrD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,SAAS;QACpB,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAwB;IAC5C,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,EAA6B,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAChD;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,CACf,QAA8B,EAC9B,SAA6B,EAC7B,SAAsC,EAC3B,EAAE;QACb,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC;YACtC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE;gBACxC,KAAK,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;gBAClC,SAAS,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;aACvC,CAAC;QACN,uFAAuF;QACvF,0DAA0D;QAC1D,MAAM,UAAU,GAAG,YAAY,UAAU,EAAE,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK;YACL,GAAG,GAAG;YACN,UAAU;YACV,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,UAAU,EAAE;YAC5C,4EAA4E;YAC5E,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC/B,2FAA2F;YAC3F,0CAA0C;YAC1C,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAC9F,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CACrD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;oBACjD,6EAA6E;oBAC7E,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI;wBACrC,YAAY,EAAE,UAAU,CAAC,IAAI,KAAK,MAAM;qBACzC;iBACF,CAAC;YACJ,CAAC,CAAC,CACH;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,IAAI,CAAC;YACH,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,eAAe;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;iBACrF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/poppy/auth.d.ts

@@ -0,0 +1,77 @@
+import type { Actor } from '../types.js';
+/**
+ * Who a Poppy request comes from: a Personal Agent (`clientId`) acting for one of its Users
+ * (`userId`, the pairwise User ID — not an account) in one Session. `signedIn`, with the app
+ * account (`accountId`) and `scopes`, once the User signed in here (§4.4); a signed-out token has
+ * neither. The shape `@adonis-agora/authkit-server` answers.
+ */
+export interface PoppyPrincipal {
+    /** The opaque, stable id the Personal Agent gave this User here. */
+    userId: string;
+    /** The app account, when the Session is signed in; `null` signed out. */
+    accountId: string | null;
+    /** The Personal Agent's `client_id` (its metadata document URL). */
+    clientId: string;
+    /** The token's account scopes (`poppy:read`, `poppy:write`, custom). Empty signed out. */
+    scopes: string[];
+    sessionId: string;
+    signedIn: boolean;
+    /** The `resource` the token was issued for (RFC 8707), or `null`. */
+    resource?: string | null;
+    tokenType?: 'DPoP' | 'Bearer';
+    /** What the app's `personalAgents.poppy.toActor` answered, when it has one. */
+    actor?: Actor;
+}
+/** The request a resolver verifies — the Session Token and its DPoP proof are in `headers`. */
+export interface PoppyAuthRequest {
+    method: string;
+    /** The full PUBLIC request URL (the DPoP `htu` is checked against it; the query is ignored). */
+    url: string;
+    /** The request's headers as received (lower-cased names) — `authorization` and `dpop` included. */
+    headers: Record<string, string | string[] | undefined>;
+}
+/**
+ * What a resolver may be asked to require besides a valid token. The conversation endpoint asks for
+ * none: which scopes a turn needs is decided per tool, and the `resource` a token must carry is
+ * derived by the resolver from the URL (the `resource` of the `poppy` protocol entry, if any).
+ */
+export interface PoppyAuthOptions {
+    scopes?: string[];
+    signedIn?: boolean;
+    resource?: string | null;
+}
+export type PoppyAuthFailure = {
+    ok: false;
+    status: 400 | 401 | 403;
+    error: 'invalid_token' | 'sign_in_required' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce' | (string & {});
+    scope?: string;
+    /** The challenge to answer with, verbatim. */
+    wwwAuthenticate: string;
+    /** For logs and the body's `error_description` — never the token. */
+    description?: string;
+    /** Extra headers to answer with (`DPoP-Nonce`). */
+    headers?: Record<string, string>;
+};
+export type PoppyAuthResult = {
+    ok: true;
+    principal: PoppyPrincipal;
+} | PoppyAuthFailure;
+/**
+ * Verifies a request's Session Token. `@adonis-agora/authkit-server` installs one in the global
+ * slot {@link POPPY_AUTHENTICATE_SLOT}; an app can pass its own (`definePoppyConfig({ authenticate })`).
+ *
+ * @experimental Tracks Personal Agent Protocol Draft 0.1 (https://personalagentprotocol.org/docs/spec),
+ * a spec still in development: this API WILL change as the spec evolves — possibly in breaking
+ * ways, outside semver majors while it is a draft.
+ */
+export type PoppyAuthenticate = (request: PoppyAuthRequest, options?: PoppyAuthOptions) => Promise<PoppyAuthResult>;
+/**
+ * The contract with the authorization server is this global symbol, not a module: neither package
+ * imports the other (like `Symbol.for('@adonis-agora/oauth:resources')` for MCP).
+ */
+export declare const POPPY_AUTHENTICATE_SLOT: unique symbol;
+/** The resolver installed in the global slot, if any — read per request, so install order is free. */
+export declare function globalPoppyAuthenticate(): PoppyAuthenticate | undefined;
+/** The Poppy issuer authkit announces (`Symbol.for('@adonis-agora/poppy:issuer')`), if any. */
+export declare function globalPoppyIssuer(): string | undefined;
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/poppy/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/poppy/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,KAAK,EACD,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,GAAG,gBAAgB,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B;;;GAGG;AACH,eAAO,MAAM,uBAAuB,eAAiD,CAAC;AAEtF,sGAAsG;AACtG,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAGvE;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAGtD"}

package/dist/src/poppy/auth.js

@@ -0,0 +1,16 @@
+/**
+ * The contract with the authorization server is this global symbol, not a module: neither package
+ * imports the other (like `Symbol.for('@adonis-agora/oauth:resources')` for MCP).
+ */
+export const POPPY_AUTHENTICATE_SLOT = Symbol.for('@adonis-agora/poppy:authenticate');
+/** The resolver installed in the global slot, if any — read per request, so install order is free. */
+export function globalPoppyAuthenticate() {
+    const value = globalThis[POPPY_AUTHENTICATE_SLOT];
+    return typeof value === 'function' ? value : undefined;
+}
+/** The Poppy issuer authkit announces (`Symbol.for('@adonis-agora/poppy:issuer')`), if any. */
+export function globalPoppyIssuer() {
+    const value = globalThis[Symbol.for('@adonis-agora/poppy:issuer')];
+    return typeof value === 'string' && value !== '' ? value : undefined;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/poppy/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/poppy/auth.ts"],"names":[],"mappings":"AAgFA;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAEtF,sGAAsG;AACtG,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAI,UAAsC,CAAC,uBAAuB,CAAC,CAAC;IAC/E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAI,UAAsC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}