@adonis-agora/agent 0.76.3 → 0.77.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +16 -0
- package/dist/providers/agent_provider.d.ts.map +1 -1
- package/dist/providers/agent_provider.js +9 -0
- package/dist/providers/agent_provider.js.map +1 -1
- package/dist/providers/mcp_provider.d.ts.map +1 -1
- package/dist/providers/mcp_provider.js +46 -10
- package/dist/providers/mcp_provider.js.map +1 -1
- package/dist/providers/poppy_connections_provider.d.ts +17 -0
- package/dist/providers/poppy_connections_provider.d.ts.map +1 -0
- package/dist/providers/poppy_connections_provider.js +186 -0
- package/dist/providers/poppy_connections_provider.js.map +1 -0
- package/dist/providers/poppy_provider.d.ts +12 -0
- package/dist/providers/poppy_provider.d.ts.map +1 -0
- package/dist/providers/poppy_provider.js +159 -0
- package/dist/providers/poppy_provider.js.map +1 -0
- package/dist/src/a2a/handler.d.ts.map +1 -1
- package/dist/src/a2a/handler.js +4 -2
- package/dist/src/a2a/handler.js.map +1 -1
- package/dist/src/a2a/turn.d.ts +27 -4
- package/dist/src/a2a/turn.d.ts.map +1 -1
- package/dist/src/a2a/turn.js +66 -12
- package/dist/src/a2a/turn.js.map +1 -1
- package/dist/src/action-proposal-approval.d.ts.map +1 -1
- package/dist/src/action-proposal-approval.js +3 -3
- package/dist/src/action-proposal-approval.js.map +1 -1
- package/dist/src/action-proposal-listeners.d.ts +12 -0
- package/dist/src/action-proposal-listeners.d.ts.map +1 -0
- package/dist/src/action-proposal-listeners.js +27 -0
- package/dist/src/action-proposal-listeners.js.map +1 -0
- package/dist/src/action-proposal-receipt.d.ts +4 -0
- package/dist/src/action-proposal-receipt.d.ts.map +1 -1
- package/dist/src/action-proposal-receipt.js +3 -1
- package/dist/src/action-proposal-receipt.js.map +1 -1
- package/dist/src/action-proposal-worker.d.ts +6 -1
- package/dist/src/action-proposal-worker.d.ts.map +1 -1
- package/dist/src/action-proposal-worker.js +10 -1
- package/dist/src/action-proposal-worker.js.map +1 -1
- package/dist/src/agent-loop.d.ts.map +1 -1
- package/dist/src/agent-loop.js +8 -5
- package/dist/src/agent-loop.js.map +1 -1
- package/dist/src/channels/handler.d.ts +10 -0
- package/dist/src/channels/handler.d.ts.map +1 -1
- package/dist/src/channels/handler.js +44 -1
- package/dist/src/channels/handler.js.map +1 -1
- package/dist/src/channels/texts.d.ts +9 -0
- package/dist/src/channels/texts.d.ts.map +1 -1
- package/dist/src/channels/texts.js +4 -0
- package/dist/src/channels/texts.js.map +1 -1
- package/dist/src/client/sse.d.ts.map +1 -1
- package/dist/src/client/sse.js +3 -0
- package/dist/src/client/sse.js.map +1 -1
- package/dist/src/define_config.d.ts +3 -0
- package/dist/src/define_config.d.ts.map +1 -1
- package/dist/src/define_config.js.map +1 -1
- package/dist/src/index.d.ts +2 -1
- package/dist/src/index.d.ts.map +1 -1
- package/dist/src/index.js +2 -1
- package/dist/src/index.js.map +1 -1
- package/dist/src/mcp/auth.d.ts +17 -0
- package/dist/src/mcp/auth.d.ts.map +1 -1
- package/dist/src/mcp/auth.js +56 -1
- package/dist/src/mcp/auth.js.map +1 -1
- package/dist/src/mcp/discovery.d.ts +13 -2
- package/dist/src/mcp/discovery.d.ts.map +1 -1
- package/dist/src/mcp/discovery.js +17 -2
- package/dist/src/mcp/discovery.js.map +1 -1
- package/dist/src/mcp/index.d.ts +1 -1
- package/dist/src/mcp/index.d.ts.map +1 -1
- package/dist/src/mcp/index.js.map +1 -1
- package/dist/src/mcp/scope.d.ts +13 -0
- package/dist/src/mcp/scope.d.ts.map +1 -0
- package/dist/src/mcp/scope.js +24 -0
- package/dist/src/mcp/scope.js.map +1 -0
- package/dist/src/mcp/server.d.ts +6 -1
- package/dist/src/mcp/server.d.ts.map +1 -1
- package/dist/src/mcp/server.js +1 -1
- package/dist/src/mcp/server.js.map +1 -1
- package/dist/src/poppy/auth.d.ts +77 -0
- package/dist/src/poppy/auth.d.ts.map +1 -0
- package/dist/src/poppy/auth.js +16 -0
- package/dist/src/poppy/auth.js.map +1 -0
- package/dist/src/poppy/conversations.d.ts +249 -0
- package/dist/src/poppy/conversations.d.ts.map +1 -0
- package/dist/src/poppy/conversations.js +1017 -0
- package/dist/src/poppy/conversations.js.map +1 -0
- package/dist/src/poppy/define_config.d.ts +98 -0
- package/dist/src/poppy/define_config.d.ts.map +1 -0
- package/dist/src/poppy/define_config.js +11 -0
- package/dist/src/poppy/define_config.js.map +1 -0
- package/dist/src/poppy/endpoints.d.ts +25 -0
- package/dist/src/poppy/endpoints.d.ts.map +1 -0
- package/dist/src/poppy/endpoints.js +31 -0
- package/dist/src/poppy/endpoints.js.map +1 -0
- package/dist/src/poppy/handler.d.ts +80 -0
- package/dist/src/poppy/handler.d.ts.map +1 -0
- package/dist/src/poppy/handler.js +362 -0
- package/dist/src/poppy/handler.js.map +1 -0
- package/dist/src/poppy/index.d.ts +17 -0
- package/dist/src/poppy/index.d.ts.map +1 -0
- package/dist/src/poppy/index.js +9 -0
- package/dist/src/poppy/index.js.map +1 -0
- package/dist/src/poppy/protocol.d.ts +132 -0
- package/dist/src/poppy/protocol.d.ts.map +1 -0
- package/dist/src/poppy/protocol.js +178 -0
- package/dist/src/poppy/protocol.js.map +1 -0
- package/dist/src/poppy/redis-store.d.ts +27 -0
- package/dist/src/poppy/redis-store.d.ts.map +1 -0
- package/dist/src/poppy/redis-store.js +148 -0
- package/dist/src/poppy/redis-store.js.map +1 -0
- package/dist/src/poppy/runtime.d.ts +6 -0
- package/dist/src/poppy/runtime.d.ts.map +1 -0
- package/dist/src/poppy/runtime.js +12 -0
- package/dist/src/poppy/runtime.js.map +1 -0
- package/dist/src/poppy/server_middleware.d.ts +11 -0
- package/dist/src/poppy/server_middleware.d.ts.map +1 -0
- package/dist/src/poppy/server_middleware.js +16 -0
- package/dist/src/poppy/server_middleware.js.map +1 -0
- package/dist/src/poppy/store.d.ts +207 -0
- package/dist/src/poppy/store.d.ts.map +1 -0
- package/dist/src/poppy/store.js +444 -0
- package/dist/src/poppy/store.js.map +1 -0
- package/dist/src/poppy-client/api.d.ts +36 -0
- package/dist/src/poppy-client/api.d.ts.map +1 -0
- package/dist/src/poppy-client/api.js +77 -0
- package/dist/src/poppy-client/api.js.map +1 -0
- package/dist/src/poppy-client/bin/poppy-agent.d.ts +3 -0
- package/dist/src/poppy-client/bin/poppy-agent.d.ts.map +1 -0
- package/dist/src/poppy-client/bin/poppy-agent.js +9 -0
- package/dist/src/poppy-client/bin/poppy-agent.js.map +1 -0
- package/dist/src/poppy-client/browser.d.ts +24 -0
- package/dist/src/poppy-client/browser.d.ts.map +1 -0
- package/dist/src/poppy-client/browser.js +83 -0
- package/dist/src/poppy-client/browser.js.map +1 -0
- package/dist/src/poppy-client/cli/main.d.ts +2 -0
- package/dist/src/poppy-client/cli/main.d.ts.map +1 -0
- package/dist/src/poppy-client/cli/main.js +776 -0
- package/dist/src/poppy-client/cli/main.js.map +1 -0
- package/dist/src/poppy-client/cli/prompt.d.ts +13 -0
- package/dist/src/poppy-client/cli/prompt.d.ts.map +1 -0
- package/dist/src/poppy-client/cli/prompt.js +50 -0
- package/dist/src/poppy-client/cli/prompt.js.map +1 -0
- package/dist/src/poppy-client/company.d.ts +87 -0
- package/dist/src/poppy-client/company.d.ts.map +1 -0
- package/dist/src/poppy-client/company.js +336 -0
- package/dist/src/poppy-client/company.js.map +1 -0
- package/dist/src/poppy-client/conversations.d.ts +89 -0
- package/dist/src/poppy-client/conversations.d.ts.map +1 -0
- package/dist/src/poppy-client/conversations.js +332 -0
- package/dist/src/poppy-client/conversations.js.map +1 -0
- package/dist/src/poppy-client/discovery.d.ts +41 -0
- package/dist/src/poppy-client/discovery.d.ts.map +1 -0
- package/dist/src/poppy-client/discovery.js +217 -0
- package/dist/src/poppy-client/discovery.js.map +1 -0
- package/dist/src/poppy-client/dpop.d.ts +19 -0
- package/dist/src/poppy-client/dpop.d.ts.map +1 -0
- package/dist/src/poppy-client/dpop.js +43 -0
- package/dist/src/poppy-client/dpop.js.map +1 -0
- package/dist/src/poppy-client/errors.d.ts +50 -0
- package/dist/src/poppy-client/errors.d.ts.map +1 -0
- package/dist/src/poppy-client/errors.js +55 -0
- package/dist/src/poppy-client/errors.js.map +1 -0
- package/dist/src/poppy-client/http.d.ts +40 -0
- package/dist/src/poppy-client/http.d.ts.map +1 -0
- package/dist/src/poppy-client/http.js +95 -0
- package/dist/src/poppy-client/http.js.map +1 -0
- package/dist/src/poppy-client/identity.d.ts +61 -0
- package/dist/src/poppy-client/identity.d.ts.map +1 -0
- package/dist/src/poppy-client/identity.js +111 -0
- package/dist/src/poppy-client/identity.js.map +1 -0
- package/dist/src/poppy-client/identity_server.d.ts +29 -0
- package/dist/src/poppy-client/identity_server.d.ts.map +1 -0
- package/dist/src/poppy-client/identity_server.js +84 -0
- package/dist/src/poppy-client/identity_server.js.map +1 -0
- package/dist/src/poppy-client/index.d.ts +19 -0
- package/dist/src/poppy-client/index.d.ts.map +1 -0
- package/dist/src/poppy-client/index.js +18 -0
- package/dist/src/poppy-client/index.js.map +1 -0
- package/dist/src/poppy-client/keys.d.ts +13 -0
- package/dist/src/poppy-client/keys.d.ts.map +1 -0
- package/dist/src/poppy-client/keys.js +31 -0
- package/dist/src/poppy-client/keys.js.map +1 -0
- package/dist/src/poppy-client/llm.d.ts +31 -0
- package/dist/src/poppy-client/llm.d.ts.map +1 -0
- package/dist/src/poppy-client/llm.js +230 -0
- package/dist/src/poppy-client/llm.js.map +1 -0
- package/dist/src/poppy-client/mcp.d.ts +16 -0
- package/dist/src/poppy-client/mcp.d.ts.map +1 -0
- package/dist/src/poppy-client/mcp.js +57 -0
- package/dist/src/poppy-client/mcp.js.map +1 -0
- package/dist/src/poppy-client/open_url.d.ts +3 -0
- package/dist/src/poppy-client/open_url.d.ts.map +1 -0
- package/dist/src/poppy-client/open_url.js +13 -0
- package/dist/src/poppy-client/open_url.js.map +1 -0
- package/dist/src/poppy-client/signin.d.ts +59 -0
- package/dist/src/poppy-client/signin.d.ts.map +1 -0
- package/dist/src/poppy-client/signin.js +210 -0
- package/dist/src/poppy-client/signin.js.map +1 -0
- package/dist/src/poppy-client/sse.d.ts +15 -0
- package/dist/src/poppy-client/sse.d.ts.map +1 -0
- package/dist/src/poppy-client/sse.js +74 -0
- package/dist/src/poppy-client/sse.js.map +1 -0
- package/dist/src/poppy-client/store.d.ts +89 -0
- package/dist/src/poppy-client/store.d.ts.map +1 -0
- package/dist/src/poppy-client/store.js +79 -0
- package/dist/src/poppy-client/store.js.map +1 -0
- package/dist/src/poppy-client/token_client.d.ts +69 -0
- package/dist/src/poppy-client/token_client.d.ts.map +1 -0
- package/dist/src/poppy-client/token_client.js +154 -0
- package/dist/src/poppy-client/token_client.js.map +1 -0
- package/dist/src/poppy-client/types.d.ts +184 -0
- package/dist/src/poppy-client/types.d.ts.map +1 -0
- package/dist/src/poppy-client/types.js +8 -0
- package/dist/src/poppy-client/types.js.map +1 -0
- package/dist/src/poppy-client/util.d.ts +42 -0
- package/dist/src/poppy-client/util.d.ts.map +1 -0
- package/dist/src/poppy-client/util.js +122 -0
- package/dist/src/poppy-client/util.js.map +1 -0
- package/dist/src/poppy-connections/config.d.ts +134 -0
- package/dist/src/poppy-connections/config.d.ts.map +1 -0
- package/dist/src/poppy-connections/config.js +44 -0
- package/dist/src/poppy-connections/config.js.map +1 -0
- package/dist/src/poppy-connections/crypto.d.ts +12 -0
- package/dist/src/poppy-connections/crypto.d.ts.map +1 -0
- package/dist/src/poppy-connections/crypto.js +36 -0
- package/dist/src/poppy-connections/crypto.js.map +1 -0
- package/dist/src/poppy-connections/http.d.ts +63 -0
- package/dist/src/poppy-connections/http.d.ts.map +1 -0
- package/dist/src/poppy-connections/http.js +217 -0
- package/dist/src/poppy-connections/http.js.map +1 -0
- package/dist/src/poppy-connections/index.d.ts +14 -0
- package/dist/src/poppy-connections/index.d.ts.map +1 -0
- package/dist/src/poppy-connections/index.js +17 -0
- package/dist/src/poppy-connections/index.js.map +1 -0
- package/dist/src/poppy-connections/resume.d.ts +46 -0
- package/dist/src/poppy-connections/resume.d.ts.map +1 -0
- package/dist/src/poppy-connections/resume.js +109 -0
- package/dist/src/poppy-connections/resume.js.map +1 -0
- package/dist/src/poppy-connections/runtime.d.ts +4 -0
- package/dist/src/poppy-connections/runtime.d.ts.map +1 -0
- package/dist/src/poppy-connections/runtime.js +9 -0
- package/dist/src/poppy-connections/runtime.js.map +1 -0
- package/dist/src/poppy-connections/server_middleware.d.ts +10 -0
- package/dist/src/poppy-connections/server_middleware.d.ts.map +1 -0
- package/dist/src/poppy-connections/server_middleware.js +14 -0
- package/dist/src/poppy-connections/server_middleware.js.map +1 -0
- package/dist/src/poppy-connections/service.d.ts +179 -0
- package/dist/src/poppy-connections/service.d.ts.map +1 -0
- package/dist/src/poppy-connections/service.js +648 -0
- package/dist/src/poppy-connections/service.js.map +1 -0
- package/dist/src/poppy-connections/store.d.ts +139 -0
- package/dist/src/poppy-connections/store.d.ts.map +1 -0
- package/dist/src/poppy-connections/store.js +260 -0
- package/dist/src/poppy-connections/store.js.map +1 -0
- package/dist/src/poppy-connections/tools.d.ts +65 -0
- package/dist/src/poppy-connections/tools.d.ts.map +1 -0
- package/dist/src/poppy-connections/tools.js +574 -0
- package/dist/src/poppy-connections/tools.js.map +1 -0
- package/dist/src/react/core/approvals/use-action-proposals.d.ts +6 -1
- package/dist/src/react/core/approvals/use-action-proposals.d.ts.map +1 -1
- package/dist/src/react/core/approvals/use-action-proposals.js +18 -3
- package/dist/src/react/core/approvals/use-action-proposals.js.map +1 -1
- package/dist/src/react/core/use-agent-chat.d.ts +6 -0
- package/dist/src/react/core/use-agent-chat.d.ts.map +1 -1
- package/dist/src/react/core/use-agent-chat.js +47 -1
- package/dist/src/react/core/use-agent-chat.js.map +1 -1
- package/dist/src/tool-presentation.d.ts +6 -0
- package/dist/src/tool-presentation.d.ts.map +1 -1
- package/dist/src/tool-presentation.js +1 -0
- package/dist/src/tool-presentation.js.map +1 -1
- package/dist/src/types.d.ts +6 -0
- package/dist/src/types.d.ts.map +1 -1
- package/package.json +41 -2
- package/skills/agent-governance/SKILL.md +13 -2
- package/skills/agent-personas-agents/SKILL.md +1 -1
- package/skills/agent-tools/SKILL.md +20 -3
package/dist/src/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,uFAAuF;AACvF,qFAAqF;AACrF,sDAAsD;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,cAAc,kCAAkC,CAAC;AACjD,cAAc,mBAAmB,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EAEZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,YAAY,EAEZ,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EAKd,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,cAAc,EACd,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAEhB,YAAY,GAKb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EAEvB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAWlC,gFAAgF;AAChF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA6BjE,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,oBAAoB,EACpB,aAAa,EAEb,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EAQvB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EAGvB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAIL,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,GAIX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EAepB,mBAAmB,EACnB,kBAAkB,EAGlB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAGlB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EAInB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAInD,OAAO,EAAoB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EAGrB,QAAQ,EAIR,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAY/B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EAGZ,SAAS,EACT,WAAW,EACX,mBAAmB,EAGnB,sBAAsB,EACtB,eAAe,EAaf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAOL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAGlB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,gBAAgB,EAMhB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,eAAe,EAEf,iBAAiB,EAOjB,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAEL,mBAAmB,GAGpB,MAAM,mCAAmC,CAAC;AAU3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EACL,qCAAqC,EACrC,WAAW,EACX,iBAAiB,EAEjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AASlC,OAAO,EACL,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAKlB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EAExB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,qCAAqC,EACrC,uCAAuC,EACvC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAEjB,OAAO,EAEP,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,iBAAiB,EAEjB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,uFAAuF;AACvF,qFAAqF;AACrF,sDAAsD;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,cAAc,kCAAkC,CAAC;AACjD,cAAc,mBAAmB,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAIL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EAEZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,YAAY,EAEZ,wBAAwB,EACxB,sBAAsB,EACtB,cAAc,EAKd,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,uBAAuB,EACvB,cAAc,EACd,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EACL,gBAAgB,EAEhB,YAAY,GAKb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EAEvB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAWlC,gFAAgF;AAChF,OAAO,EACL,QAAQ,EACR,sBAAsB,EACtB,WAAW,EACX,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AA6BjE,gFAAgF;AAChF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,OAAO,EAEL,oBAAoB,EACpB,aAAa,EAEb,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EAQvB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EAGvB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAIL,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,GAIX,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,cAAc,qBAAqB,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEL,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EAepB,mBAAmB,EACnB,kBAAkB,EAGlB,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAGlB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EAInB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAInD,OAAO,EAAoB,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EAGrB,QAAQ,EAIR,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAY/B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AAErC,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EAGZ,SAAS,EACT,WAAW,EACX,mBAAmB,EAGnB,sBAAsB,EACtB,eAAe,EAaf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAOL,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAGlB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,OAAO,EACL,gBAAgB,EAMhB,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,eAAe,EAEf,iBAAiB,EAOjB,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AAEnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAEL,mBAAmB,GAGpB,MAAM,mCAAmC,CAAC;AAU3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EACL,qCAAqC,EACrC,WAAW,EACX,iBAAiB,EAEjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AASlC,OAAO,EACL,UAAU,EACV,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAKlB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EAExB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACL,qCAAqC,EACrC,uCAAuC,EACvC,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EAEjB,OAAO,EAEP,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,iBAAiB,EAEjB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC"}
|
package/dist/src/mcp/auth.d.ts
CHANGED
|
@@ -85,11 +85,19 @@ export interface McpVerifyContext {
|
|
|
85
85
|
export declare class McpAuthError extends Error {
|
|
86
86
|
/** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
|
|
87
87
|
readonly status: 401 | 403;
|
|
88
|
+
/**
|
|
89
|
+
* The `WWW-Authenticate` error code, when not the status' default (`invalid_token` for 401,
|
|
90
|
+
* `insufficient_scope` for 403) — e.g. Poppy's `sign_in_required` (§4.3).
|
|
91
|
+
*/
|
|
92
|
+
readonly error?: McpChallengeError;
|
|
88
93
|
constructor(message: string, options?: {
|
|
89
94
|
status?: 401 | 403;
|
|
95
|
+
error?: McpChallengeError;
|
|
90
96
|
cause?: unknown;
|
|
91
97
|
});
|
|
92
98
|
}
|
|
99
|
+
/** Error codes the MCP endpoint can put in its `WWW-Authenticate` challenge. */
|
|
100
|
+
export type McpChallengeError = 'invalid_token' | 'insufficient_scope' | 'sign_in_required';
|
|
93
101
|
/**
|
|
94
102
|
* A configured MCP auth strategy, as a lazy thunk the provider calls at boot. Each factory lazily
|
|
95
103
|
* imports / resolves its peer inside the thunk, so nothing loads until the strategy is actually selected.
|
|
@@ -99,6 +107,8 @@ export type McpAuthFactory = (ctx: McpAuthContext) => McpAuth | Promise<McpAuth>
|
|
|
99
107
|
* Resolve a `McpAuth` config value (a ready instance or a lazy factory) at provider boot.
|
|
100
108
|
*/
|
|
101
109
|
export declare function resolveMcpAuth(auth: McpAuth | McpAuthFactory, ctx: McpAuthContext): Promise<McpAuth>;
|
|
110
|
+
/** The `gty` authkit-server gives the access tokens it mints for a Poppy session (§6, MCP). */
|
|
111
|
+
export declare const POPPY_GRANT_TYPE = "poppy";
|
|
102
112
|
/**
|
|
103
113
|
* The organization authkit bound to a grant at consent time (the active org of the session that
|
|
104
114
|
* approved it). Stored on the grant as `activeOrg`.
|
|
@@ -135,6 +145,13 @@ export interface AuthKitActorInfo {
|
|
|
135
145
|
activeOrg: AuthKitActiveOrg | undefined;
|
|
136
146
|
/** Extra claims stored on the access token (`extraTokenClaims`), if any. */
|
|
137
147
|
extra: Record<string, unknown> | undefined;
|
|
148
|
+
/**
|
|
149
|
+
* The token belongs to a **personal agent** — authkit minted it for a Personal Agent Protocol
|
|
150
|
+
* (Poppy) session (`gty: 'poppy'`), not for an MCP client the user logged into. Whatever `toActor`
|
|
151
|
+
* returns, the actor then also gets `personal_agent` and one `scope:<id>` role per granted scope,
|
|
152
|
+
* so the personal agent gate applies: only the tools of its scopes run.
|
|
153
|
+
*/
|
|
154
|
+
personalAgent: boolean;
|
|
138
155
|
}
|
|
139
156
|
/**
|
|
140
157
|
* How `authKitAuth()` maps an access token to the MCP actor. Defaults to the account id. Throw
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAI/E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,kBAAkB,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yGAAyG;IACzG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAY,SAAQ,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC1D,KAAK,EAAE;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACtB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChF;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACzE;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IACnH,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAEnC,YACE,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;QAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,EAMjF;CACF;AAED,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAE5F;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;GAEG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,GAAG,cAAc,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAiCD,+FAA+F;AAC/F,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,sHAAsH;IACtH,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,uEAAuE;IACvE,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,4FAA4F;IAC5F,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IAChC,+FAA+F;IAC/F,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACxC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAC3C;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,gBAAgB,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAEtF,uCAAuC;AACvC,MAAM,WAAW,qBAAqB;IACpC,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAiG/E;AAsDD,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;AAE7E,sCAAsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAcxE;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,KAAK,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,cAAc,CAuBpF"}
|
package/dist/src/mcp/auth.js
CHANGED
|
@@ -1,3 +1,6 @@
|
|
|
1
|
+
import { scopeRole } from '../a2a/gate.js';
|
|
2
|
+
import { PERSONAL_AGENT_ROLE } from '../a2a/permission-tool.js';
|
|
3
|
+
import { globalPoppyAuthenticate } from '../poppy/auth.js';
|
|
1
4
|
/**
|
|
2
5
|
* A typed refusal from an MCP auth strategy: the token was recognized and deliberately refused (a
|
|
3
6
|
* client that is not allowed on this endpoint, an account that left the tenant, a revoked grant).
|
|
@@ -22,10 +25,17 @@
|
|
|
22
25
|
export class McpAuthError extends Error {
|
|
23
26
|
/** HTTP status of the refusal: `401` (the token does not authenticate) or `403` (it does, but may not do this). */
|
|
24
27
|
status;
|
|
28
|
+
/**
|
|
29
|
+
* The `WWW-Authenticate` error code, when not the status' default (`invalid_token` for 401,
|
|
30
|
+
* `insufficient_scope` for 403) — e.g. Poppy's `sign_in_required` (§4.3).
|
|
31
|
+
*/
|
|
32
|
+
error;
|
|
25
33
|
constructor(message, options = {}) {
|
|
26
34
|
super(message, options.cause !== undefined ? { cause: options.cause } : undefined);
|
|
27
35
|
this.name = 'McpAuthError';
|
|
28
36
|
this.status = options.status ?? 401;
|
|
37
|
+
if (options.error !== undefined)
|
|
38
|
+
this.error = options.error;
|
|
29
39
|
}
|
|
30
40
|
}
|
|
31
41
|
/**
|
|
@@ -37,6 +47,8 @@ export async function resolveMcpAuth(auth, ctx) {
|
|
|
37
47
|
}
|
|
38
48
|
return auth;
|
|
39
49
|
}
|
|
50
|
+
/** The `gty` authkit-server gives the access tokens it mints for a Poppy session (§6, MCP). */
|
|
51
|
+
export const POPPY_GRANT_TYPE = 'poppy';
|
|
40
52
|
/**
|
|
41
53
|
* Authenticate MCP clients with `@adonis-agora/authkit-server`: verifies the bearer token against the
|
|
42
54
|
* authkit OIDC provider's stored access tokens (`provider.AccessToken.find`) and advertises OAuth
|
|
@@ -73,6 +85,15 @@ export function authKitAuth(options = {}) {
|
|
|
73
85
|
const service = await getService();
|
|
74
86
|
const at = await service.provider.AccessToken.find(token);
|
|
75
87
|
if (!at) {
|
|
88
|
+
// A signed-out Poppy Session's MCP token lives only in authkit's Poppy store: it is valid,
|
|
89
|
+
// but this server needs an account — Poppy's `sign_in_required` (§4.3), not `invalid_token`
|
|
90
|
+
// (which would only make the agent mint the same kind of token again).
|
|
91
|
+
if (context !== undefined && (await isSignedOutPoppyToken(token, context.resource))) {
|
|
92
|
+
throw new McpAuthError('sign in to use this server', {
|
|
93
|
+
status: 403,
|
|
94
|
+
error: 'sign_in_required',
|
|
95
|
+
});
|
|
96
|
+
}
|
|
76
97
|
// Not an access token this issuer knows — plain `Error`, so `anyOf` tries the next strategy.
|
|
77
98
|
throw new Error('invalid or expired access token');
|
|
78
99
|
}
|
|
@@ -93,7 +114,8 @@ export function authKitAuth(options = {}) {
|
|
|
93
114
|
}
|
|
94
115
|
}
|
|
95
116
|
const tokenScopes = (at.scope ?? '').split(' ').filter(Boolean);
|
|
96
|
-
const
|
|
117
|
+
const personalAgent = at.gty === POPPY_GRANT_TYPE;
|
|
118
|
+
const resolved = await toActor({
|
|
97
119
|
accountId: at.accountId,
|
|
98
120
|
scopes: tokenScopes,
|
|
99
121
|
clientId: at.clientId,
|
|
@@ -101,7 +123,23 @@ export function authKitAuth(options = {}) {
|
|
|
101
123
|
grant,
|
|
102
124
|
activeOrg: readActiveOrg(grant?.activeOrg),
|
|
103
125
|
extra: at.extra,
|
|
126
|
+
personalAgent,
|
|
104
127
|
});
|
|
128
|
+
// A personal agent's token carries the user's account but only the scopes they granted: the
|
|
129
|
+
// roles below put it behind `personalAgentGate` (the MCP provider wraps its authorizer in it),
|
|
130
|
+
// as a Poppy conversation or a PACT delegation does.
|
|
131
|
+
const actor = personalAgent
|
|
132
|
+
? {
|
|
133
|
+
...resolved,
|
|
134
|
+
roles: [
|
|
135
|
+
...new Set([
|
|
136
|
+
...(resolved.roles ?? []),
|
|
137
|
+
PERSONAL_AGENT_ROLE,
|
|
138
|
+
...tokenScopes.map(scopeRole),
|
|
139
|
+
]),
|
|
140
|
+
],
|
|
141
|
+
}
|
|
142
|
+
: resolved;
|
|
105
143
|
return {
|
|
106
144
|
token,
|
|
107
145
|
clientId: at.clientId ?? '',
|
|
@@ -113,6 +151,23 @@ export function authKitAuth(options = {}) {
|
|
|
113
151
|
};
|
|
114
152
|
};
|
|
115
153
|
}
|
|
154
|
+
/** A Bearer token authkit issued for `resource` to a Poppy Session that is not signed in. */
|
|
155
|
+
async function isSignedOutPoppyToken(token, resource) {
|
|
156
|
+
const authenticate = globalPoppyAuthenticate();
|
|
157
|
+
if (authenticate === undefined)
|
|
158
|
+
return false;
|
|
159
|
+
try {
|
|
160
|
+
const result = await authenticate({
|
|
161
|
+
method: 'POST',
|
|
162
|
+
url: resource,
|
|
163
|
+
headers: { authorization: `Bearer ${token}` },
|
|
164
|
+
});
|
|
165
|
+
return result.ok && !result.principal.signedIn;
|
|
166
|
+
}
|
|
167
|
+
catch {
|
|
168
|
+
return false;
|
|
169
|
+
}
|
|
170
|
+
}
|
|
116
171
|
/** Whether a token's `aud` names `resource` (a trailing slash on either side is tolerated). */
|
|
117
172
|
function audienceNames(aud, resource) {
|
|
118
173
|
const trim = (value) => value.replace(/\/+$/, '');
|
package/dist/src/mcp/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/mcp/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAkE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,mHAAmH;IAC1G,MAAM,CAAY;IAC3B;;;OAGG;IACM,KAAK,CAAqB;IAEnC,YACE,OAAe,EACf,OAAO,GAAuE,EAAE;QAEhF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9D,CAAC;CACF;AAWD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA8B,EAC9B,GAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAiCD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAyExC;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAA0B,EAAE;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAyB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAElG,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QACvB,IAAI,cAAuD,CAAC;QAE5D,MAAM,UAAU,GAAG,GAAgC,EAAE;YACnD,cAAc,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,cAAc,CAAC;QACxB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,KAAK,IAA+B,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,OAAO;gBACL,MAAM;gBACN,qBAAqB,EAAE,GAAG,MAAM,OAAO;gBACvC,aAAa,EAAE,GAAG,MAAM,QAAQ;gBAChC,eAAe,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,kBAAkB;aACzD,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO;YACL,KAAK;YACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;gBACnC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,2FAA2F;oBAC3F,4FAA4F;oBAC5F,uEAAuE;oBACvE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBACpF,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE;4BACnD,MAAM,EAAE,GAAG;4BACX,KAAK,EAAE,kBAAkB;yBAC1B,CAAC,CAAC;oBACL,CAAC;oBACD,6FAA6F;oBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBACD,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;oBACjB,MAAM,IAAI,YAAY,CAAC,iCAAiC,CAAC,CAAC;gBAC5D,CAAC;gBACD,IACE,CAAC,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,KAAK,UAAU;oBAC/C,OAAO,KAAK,SAAS;oBACrB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EACxC,CAAC;oBACD,MAAM,IAAI,YAAY,CAAC,0CAA0C,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,KAA+B,CAAC;gBACpC,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBACrE,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,qEAAqE;wBACrE,MAAM,IAAI,YAAY,CAAC,uBAAuB,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAChE,MAAM,aAAa,GAAG,EAAE,CAAC,GAAG,KAAK,gBAAgB,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;oBAC7B,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,MAAM,EAAE,WAAW;oBACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,KAAK;oBACL,SAAS,EAAE,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,aAAa;iBACd,CAAC,CAAC;gBACH,4FAA4F;gBAC5F,+FAA+F;gBAC/F,qDAAqD;gBACrD,MAAM,KAAK,GAAU,aAAa;oBAChC,CAAC,CAAC;wBACE,GAAG,QAAQ;wBACX,KAAK,EAAE;4BACL,GAAG,IAAI,GAAG,CAAC;gCACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;gCACzB,mBAAmB;gCACnB,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;6BAC9B,CAAC;yBACH;qBACF;oBACH,CAAC,CAAC,QAAQ,CAAC;gBACb,OAAO;oBACL,KAAK;oBACL,QAAQ,EAAE,EAAE,CAAC,QAAQ,IAAI,EAAE;oBAC3B,MAAM,EAAE,WAAW;oBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,uBAAuB,EAAE,CAAC;IAC/C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,GAAkC,EAAE,QAAgB;IACzE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,uHAAuH;AACvH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,GAAuB;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,iFAAiF,OAAO,8FAA8F,CACvL,CAAC;IACJ,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAwB,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,OAAO,KAAK,IAAI,EAAE;QAChB,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,KAAK;gBAChB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACrC,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAClE,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,KAAK,CAAC,GAAG,UAA2C;IAClE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,KAAK,CAAC;QAC/E,OAAO;YACL,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO;gBACzB,IAAI,SAAkB,CAAC;gBACvB,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;oBAC/C,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,YAAY;4BAAE,MAAM,KAAK,CAAC;wBAC/C,SAAS,GAAG,KAAK,CAAC;oBACpB,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -27,7 +27,16 @@ export interface ProtectedResourceMetadata {
|
|
|
27
27
|
bearer_methods_supported: string[];
|
|
28
28
|
resource_name: string;
|
|
29
29
|
}
|
|
30
|
-
/**
|
|
30
|
+
/**
|
|
31
|
+
* The Poppy issuer `@adonis-agora/authkit-server` announces in `Symbol.for('@adonis-agora/poppy:issuer')`
|
|
32
|
+
* when Personal Agent Protocol is on — Poppy §6 requires a listed MCP server's `authorization_servers`
|
|
33
|
+
* to include it, so a Poppy Session Token's issuer is one this server names.
|
|
34
|
+
*/
|
|
35
|
+
export declare function announcedPoppyIssuer(): string | undefined;
|
|
36
|
+
/**
|
|
37
|
+
* Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. Its `authorization_servers`
|
|
38
|
+
* is the configured issuer, plus the Poppy issuer when one is announced (and different).
|
|
39
|
+
*/
|
|
31
40
|
export declare function protectedResourceMetadata(meta: McpOAuthMetadata, origin: string, path: string): ProtectedResourceMetadata;
|
|
32
41
|
/** Options for {@link wwwAuthenticateChallenge}. */
|
|
33
42
|
export interface WwwAuthenticateOptions {
|
|
@@ -35,9 +44,11 @@ export interface WwwAuthenticateOptions {
|
|
|
35
44
|
* The RFC 6750 error code. `invalid_token` when the request carried a token that was refused,
|
|
36
45
|
* `insufficient_scope` for a `403`, omitted when no token was sent at all (RFC 6750 §3.1).
|
|
37
46
|
*/
|
|
38
|
-
error?: 'invalid_token' | 'insufficient_scope';
|
|
47
|
+
error?: 'invalid_token' | 'insufficient_scope' | 'sign_in_required';
|
|
39
48
|
/** The metadata URL (RFC 9728 §5.1). Set only when the auth strategy exposes OAuth metadata. */
|
|
40
49
|
resourceMetadataUrl?: string;
|
|
50
|
+
/** With `insufficient_scope`: the scopes the request needs (RFC 6750 §3), space-separated. */
|
|
51
|
+
scope?: string;
|
|
41
52
|
}
|
|
42
53
|
/**
|
|
43
54
|
* The `WWW-Authenticate` value for a `401`/`403` from the MCP endpoint — e.g.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,
|
|
1
|
+
{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAED,yHAAyH;AACzH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,sHAAsH;AACtH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAGzD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,yBAAyB,CAS3B;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,eAAe,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;IACpE,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAQrF"}
|
|
@@ -39,11 +39,24 @@ export function mcpResourceUrl(origin, path) {
|
|
|
39
39
|
export function protectedResourceMetadataUrl(origin, path) {
|
|
40
40
|
return `${origin}/.well-known/oauth-protected-resource/${normalizeMcpPath(path)}`;
|
|
41
41
|
}
|
|
42
|
-
/**
|
|
42
|
+
/**
|
|
43
|
+
* The Poppy issuer `@adonis-agora/authkit-server` announces in `Symbol.for('@adonis-agora/poppy:issuer')`
|
|
44
|
+
* when Personal Agent Protocol is on — Poppy §6 requires a listed MCP server's `authorization_servers`
|
|
45
|
+
* to include it, so a Poppy Session Token's issuer is one this server names.
|
|
46
|
+
*/
|
|
47
|
+
export function announcedPoppyIssuer() {
|
|
48
|
+
const value = globalThis[Symbol.for('@adonis-agora/poppy:issuer')];
|
|
49
|
+
return typeof value === 'string' && value !== '' ? value : undefined;
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* Build the RFC 9728 document for the MCP endpoint at `origin` + `path`. Its `authorization_servers`
|
|
53
|
+
* is the configured issuer, plus the Poppy issuer when one is announced (and different).
|
|
54
|
+
*/
|
|
43
55
|
export function protectedResourceMetadata(meta, origin, path) {
|
|
56
|
+
const poppyIssuer = announcedPoppyIssuer();
|
|
44
57
|
return {
|
|
45
58
|
resource: mcpResourceUrl(origin, path),
|
|
46
|
-
authorization_servers: [meta.issuer],
|
|
59
|
+
authorization_servers: [...new Set([meta.issuer, ...(poppyIssuer ? [poppyIssuer] : [])])],
|
|
47
60
|
scopes_supported: meta.scopesSupported,
|
|
48
61
|
bearer_methods_supported: ['header'],
|
|
49
62
|
resource_name: meta.resourceName,
|
|
@@ -58,6 +71,8 @@ export function wwwAuthenticateChallenge(options = {}) {
|
|
|
58
71
|
const params = [];
|
|
59
72
|
if (options.error !== undefined)
|
|
60
73
|
params.push(`error="${options.error}"`);
|
|
74
|
+
if (options.scope !== undefined)
|
|
75
|
+
params.push(`scope="${quote(options.scope)}"`);
|
|
61
76
|
if (options.resourceMetadataUrl !== undefined) {
|
|
62
77
|
params.push(`resource_metadata="${quote(options.resourceMetadataUrl)}"`);
|
|
63
78
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD,
|
|
1
|
+
{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/mcp/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,gFAAgF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qHAAqH,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACjJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,IAAY;IACzD,OAAO,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,4BAA4B,CAAC,MAAc,EAAE,IAAY;IACvE,OAAO,GAAG,MAAM,yCAAyC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;AACpF,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAI,UAAsC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAsB,EACtB,MAAc,EACd,IAAY;IAEZ,MAAM,WAAW,GAAG,oBAAoB,EAAE,CAAC;IAC3C,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzF,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;QACpC,aAAa,EAAE,IAAI,CAAC,YAAY;KACjC,CAAC;AACJ,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAO,GAA2B,EAAE;IAC3E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,oDAAoD;AACpD,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC"}
|
package/dist/src/mcp/index.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
export { actorFromAuthInfo, isActor } from './actor.js';
|
|
2
|
-
export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpOAuthMetadata, } from './auth.js';
|
|
2
|
+
export type { ApiKeyActorResolver, ApiKeyMcpAuthOptions, AuthKitActiveOrg, AuthKitActorInfo, AuthKitActorResolver, AuthKitGrant, AuthKitMcpAuthOptions, McpAuth, McpAuthContext, McpAuthFactory, McpAuthInfo, McpChallengeError, McpOAuthMetadata, } from './auth.js';
|
|
3
3
|
export { anyOf, apiKeyAuth, authKitAuth, McpAuthError, resolveMcpAuth } from './auth.js';
|
|
4
4
|
export type { McpConfig, McpEndpointConfig, McpToolDescriber, McpToolDescription, } from './define_config.js';
|
|
5
5
|
export { defineMcpConfig } from './define_config.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACxD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,OAAO,EACP,cAAc,EACd,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzF,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,YAAY,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAgBxD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAOzF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
import type { RolesPolicy } from '../spi/roles-policy.js';
|
|
2
|
+
import type { Actor, ToolSpec } from '../types.js';
|
|
3
|
+
/**
|
|
4
|
+
* The scopes a personal agent lacks to RUN a tool it is offered (`personalAgentGate`: a tool behind a
|
|
5
|
+
* `scope:` role is offered to every personal agent, run only with that scope). `null` when the actor
|
|
6
|
+
* is not a personal agent, the tool is not offered to it, or it may run it.
|
|
7
|
+
*
|
|
8
|
+
* The MCP provider answers such a `tools/call` with `403` + `WWW-Authenticate: Bearer
|
|
9
|
+
* error="insufficient_scope", scope="…"` (RFC 6750 §3.1, MCP scope step-up), so the client can ask
|
|
10
|
+
* the user for the scope instead of reading a generic tool error.
|
|
11
|
+
*/
|
|
12
|
+
export declare function missingScopes(actor: Actor, spec: ToolSpec, policy: RolesPolicy): Promise<string[] | null>;
|
|
13
|
+
//# sourceMappingURL=scope.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/mcp/scope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAS1B"}
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
import { SCOPE_ROLE_PREFIX } from '../a2a/gate.js';
|
|
2
|
+
import { PERSONAL_AGENT_ROLE } from '../a2a/permission-tool.js';
|
|
3
|
+
/**
|
|
4
|
+
* The scopes a personal agent lacks to RUN a tool it is offered (`personalAgentGate`: a tool behind a
|
|
5
|
+
* `scope:` role is offered to every personal agent, run only with that scope). `null` when the actor
|
|
6
|
+
* is not a personal agent, the tool is not offered to it, or it may run it.
|
|
7
|
+
*
|
|
8
|
+
* The MCP provider answers such a `tools/call` with `403` + `WWW-Authenticate: Bearer
|
|
9
|
+
* error="insufficient_scope", scope="…"` (RFC 6750 §3.1, MCP scope step-up), so the client can ask
|
|
10
|
+
* the user for the scope instead of reading a generic tool error.
|
|
11
|
+
*/
|
|
12
|
+
export async function missingScopes(actor, spec, policy) {
|
|
13
|
+
const roles = actor.roles ?? [];
|
|
14
|
+
if (!roles.includes(PERSONAL_AGENT_ROLE))
|
|
15
|
+
return null;
|
|
16
|
+
const offered = policy.canOffer ? await policy.canOffer(actor, spec) : true;
|
|
17
|
+
if (!offered || (await policy.can(actor, spec)))
|
|
18
|
+
return null;
|
|
19
|
+
const missing = (spec.roles ?? [])
|
|
20
|
+
.filter((role) => role.startsWith(SCOPE_ROLE_PREFIX) && !roles.includes(role))
|
|
21
|
+
.map((role) => role.slice(SCOPE_ROLE_PREFIX.length));
|
|
22
|
+
return missing.length > 0 ? missing : null;
|
|
23
|
+
}
|
|
24
|
+
//# sourceMappingURL=scope.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/mcp/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAIhE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAY,EACZ,IAAc,EACd,MAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC"}
|
package/dist/src/mcp/server.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
|
|
|
2
2
|
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
|
|
3
3
|
import type { RolesPolicy } from '../spi/roles-policy.js';
|
|
4
4
|
import { ToolRegistry } from '../tool-registry.js';
|
|
5
|
-
import type { Actor } from '../types.js';
|
|
5
|
+
import type { Actor, ToolSpec } from '../types.js';
|
|
6
6
|
import type { McpToolDescriber } from './define_config.js';
|
|
7
7
|
/**
|
|
8
8
|
* Runtime context a MCP handler synthesizes for {@link ToolRegistry.invoke}: the acting {@link Actor}
|
|
@@ -44,6 +44,11 @@ export interface CreateMcpServerOptions extends McpToolContextOptions {
|
|
|
44
44
|
*/
|
|
45
45
|
actions?: 'refuse' | 'execute';
|
|
46
46
|
}
|
|
47
|
+
/** Whether this tool may be reached over MCP at all — the same answer for listing and for calling. */
|
|
48
|
+
export declare function isExposable(spec: {
|
|
49
|
+
kind: string;
|
|
50
|
+
presentation?: ToolSpec['presentation'];
|
|
51
|
+
} | undefined, actions: 'refuse' | 'execute'): boolean;
|
|
47
52
|
/**
|
|
48
53
|
* Build a low-level MCP `Server` that exposes the agent's {@link ToolRegistry} over the wire:
|
|
49
54
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAC/E,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAqB,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtE,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,aAAa,EAAE,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC;IACzD,yFAAyF;IACzF,cAAc,CAAC,EAAE,CACf,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,KACnC;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,yCAAyC;IACzC,QAAQ,EAAE,YAAY,CAAC;IACvB,kFAAkF;IAClF,MAAM,EAAE,WAAW,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;CAChC;AASD,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;CAAE,GAAG,SAAS,EAC3E,OAAO,EAAE,QAAQ,GAAG,SAAS,GAC5B,OAAO,CAUT;AA4CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAgGvE"}
|
package/dist/src/mcp/server.js
CHANGED
|
@@ -11,7 +11,7 @@ import { createNoopEmitUi } from '../tool-ui.js';
|
|
|
11
11
|
*/
|
|
12
12
|
const LOOP_SERVED_KINDS = new Set(['agent', 'ask', 'skill', 'memory']);
|
|
13
13
|
/** Whether this tool may be reached over MCP at all — the same answer for listing and for calling. */
|
|
14
|
-
function isExposable(spec, actions) {
|
|
14
|
+
export function isExposable(spec, actions) {
|
|
15
15
|
if (spec === undefined || LOOP_SERVED_KINDS.has(spec.kind)) {
|
|
16
16
|
return false;
|
|
17
17
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAInG,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiDjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvE,sGAAsG;AACtG,
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAInG,OAAO,EAAE,iBAAiB,EAAgB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAiDjD;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvE,sGAAsG;AACtG,MAAM,UAAU,WAAW,CACzB,IAA2E,EAC3E,OAA6B;IAE7B,IAAI,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,4FAA4F;IAC5F,yFAAyF;IACzF,IAAI,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAAC,MAAwB;IAGrD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,SAAS;QACpB,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAwB;IAC5C,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,KAAK,EAA6B,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAChD;QACE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,CACf,QAA8B,EAC9B,SAA6B,EAC7B,SAAsC,EAC3B,EAAE;QACb,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,cAAc;YACxB,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC;YACtC,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,SAAS,IAAI,KAAK,CAAC,EAAE,EAAE;gBACxC,KAAK,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;gBAClC,SAAS,EAAE,OAAO,SAAS,IAAI,KAAK,EAAE;aACvC,CAAC;QACN,uFAAuF;QACvF,0DAA0D;QAC1D,MAAM,UAAU,GAAG,YAAY,UAAU,EAAE,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK;YACL,GAAG,GAAG;YACN,UAAU;YACV,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,UAAU,EAAE;YAC5C,4EAA4E;YAC5E,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YAC/B,2FAA2F;YAC3F,0CAA0C;YAC1C,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAC9F,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CACrD,CAAC;QACF,OAAO;YACL,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CACtB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC,CAAC,CAAC;gBACH,OAAO;oBACL,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,WAAW,EAAE,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;oBACjD,6EAA6E;oBAC7E,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI;wBACrC,YAAY,EAAE,UAAU,CAAC,IAAI,KAAK,MAAM;qBACzC;iBACF,CAAC;YACJ,CAAC,CAAC,CACH;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,IAAI,CAAC;YACH,4FAA4F;YAC5F,4FAA4F;YAC5F,6FAA6F;YAC7F,eAAe;YACf,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;iBACrF;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
import type { Actor } from '../types.js';
|
|
2
|
+
/**
|
|
3
|
+
* Who a Poppy request comes from: a Personal Agent (`clientId`) acting for one of its Users
|
|
4
|
+
* (`userId`, the pairwise User ID — not an account) in one Session. `signedIn`, with the app
|
|
5
|
+
* account (`accountId`) and `scopes`, once the User signed in here (§4.4); a signed-out token has
|
|
6
|
+
* neither. The shape `@adonis-agora/authkit-server` answers.
|
|
7
|
+
*/
|
|
8
|
+
export interface PoppyPrincipal {
|
|
9
|
+
/** The opaque, stable id the Personal Agent gave this User here. */
|
|
10
|
+
userId: string;
|
|
11
|
+
/** The app account, when the Session is signed in; `null` signed out. */
|
|
12
|
+
accountId: string | null;
|
|
13
|
+
/** The Personal Agent's `client_id` (its metadata document URL). */
|
|
14
|
+
clientId: string;
|
|
15
|
+
/** The token's account scopes (`poppy:read`, `poppy:write`, custom). Empty signed out. */
|
|
16
|
+
scopes: string[];
|
|
17
|
+
sessionId: string;
|
|
18
|
+
signedIn: boolean;
|
|
19
|
+
/** The `resource` the token was issued for (RFC 8707), or `null`. */
|
|
20
|
+
resource?: string | null;
|
|
21
|
+
tokenType?: 'DPoP' | 'Bearer';
|
|
22
|
+
/** What the app's `personalAgents.poppy.toActor` answered, when it has one. */
|
|
23
|
+
actor?: Actor;
|
|
24
|
+
}
|
|
25
|
+
/** The request a resolver verifies — the Session Token and its DPoP proof are in `headers`. */
|
|
26
|
+
export interface PoppyAuthRequest {
|
|
27
|
+
method: string;
|
|
28
|
+
/** The full PUBLIC request URL (the DPoP `htu` is checked against it; the query is ignored). */
|
|
29
|
+
url: string;
|
|
30
|
+
/** The request's headers as received (lower-cased names) — `authorization` and `dpop` included. */
|
|
31
|
+
headers: Record<string, string | string[] | undefined>;
|
|
32
|
+
}
|
|
33
|
+
/**
|
|
34
|
+
* What a resolver may be asked to require besides a valid token. The conversation endpoint asks for
|
|
35
|
+
* none: which scopes a turn needs is decided per tool, and the `resource` a token must carry is
|
|
36
|
+
* derived by the resolver from the URL (the `resource` of the `poppy` protocol entry, if any).
|
|
37
|
+
*/
|
|
38
|
+
export interface PoppyAuthOptions {
|
|
39
|
+
scopes?: string[];
|
|
40
|
+
signedIn?: boolean;
|
|
41
|
+
resource?: string | null;
|
|
42
|
+
}
|
|
43
|
+
export type PoppyAuthFailure = {
|
|
44
|
+
ok: false;
|
|
45
|
+
status: 400 | 401 | 403;
|
|
46
|
+
error: 'invalid_token' | 'sign_in_required' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce' | (string & {});
|
|
47
|
+
scope?: string;
|
|
48
|
+
/** The challenge to answer with, verbatim. */
|
|
49
|
+
wwwAuthenticate: string;
|
|
50
|
+
/** For logs and the body's `error_description` — never the token. */
|
|
51
|
+
description?: string;
|
|
52
|
+
/** Extra headers to answer with (`DPoP-Nonce`). */
|
|
53
|
+
headers?: Record<string, string>;
|
|
54
|
+
};
|
|
55
|
+
export type PoppyAuthResult = {
|
|
56
|
+
ok: true;
|
|
57
|
+
principal: PoppyPrincipal;
|
|
58
|
+
} | PoppyAuthFailure;
|
|
59
|
+
/**
|
|
60
|
+
* Verifies a request's Session Token. `@adonis-agora/authkit-server` installs one in the global
|
|
61
|
+
* slot {@link POPPY_AUTHENTICATE_SLOT}; an app can pass its own (`definePoppyConfig({ authenticate })`).
|
|
62
|
+
*
|
|
63
|
+
* @experimental Tracks Personal Agent Protocol Draft 0.1 (https://personalagentprotocol.org/docs/spec),
|
|
64
|
+
* a spec still in development: this API WILL change as the spec evolves — possibly in breaking
|
|
65
|
+
* ways, outside semver majors while it is a draft.
|
|
66
|
+
*/
|
|
67
|
+
export type PoppyAuthenticate = (request: PoppyAuthRequest, options?: PoppyAuthOptions) => Promise<PoppyAuthResult>;
|
|
68
|
+
/**
|
|
69
|
+
* The contract with the authorization server is this global symbol, not a module: neither package
|
|
70
|
+
* imports the other (like `Symbol.for('@adonis-agora/oauth:resources')` for MCP).
|
|
71
|
+
*/
|
|
72
|
+
export declare const POPPY_AUTHENTICATE_SLOT: unique symbol;
|
|
73
|
+
/** The resolver installed in the global slot, if any — read per request, so install order is free. */
|
|
74
|
+
export declare function globalPoppyAuthenticate(): PoppyAuthenticate | undefined;
|
|
75
|
+
/** The Poppy issuer authkit announces (`Symbol.for('@adonis-agora/poppy:issuer')`), if any. */
|
|
76
|
+
export declare function globalPoppyIssuer(): string | undefined;
|
|
77
|
+
//# sourceMappingURL=auth.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/poppy/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC;IACZ,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACxB,KAAK,EACD,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,cAAc,CAAA;CAAE,GAAG,gBAAgB,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,gBAAgB,EACzB,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B;;;GAGG;AACH,eAAO,MAAM,uBAAuB,eAAiD,CAAC;AAEtF,sGAAsG;AACtG,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAGvE;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAGtD"}
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The contract with the authorization server is this global symbol, not a module: neither package
|
|
3
|
+
* imports the other (like `Symbol.for('@adonis-agora/oauth:resources')` for MCP).
|
|
4
|
+
*/
|
|
5
|
+
export const POPPY_AUTHENTICATE_SLOT = Symbol.for('@adonis-agora/poppy:authenticate');
|
|
6
|
+
/** The resolver installed in the global slot, if any — read per request, so install order is free. */
|
|
7
|
+
export function globalPoppyAuthenticate() {
|
|
8
|
+
const value = globalThis[POPPY_AUTHENTICATE_SLOT];
|
|
9
|
+
return typeof value === 'function' ? value : undefined;
|
|
10
|
+
}
|
|
11
|
+
/** The Poppy issuer authkit announces (`Symbol.for('@adonis-agora/poppy:issuer')`), if any. */
|
|
12
|
+
export function globalPoppyIssuer() {
|
|
13
|
+
const value = globalThis[Symbol.for('@adonis-agora/poppy:issuer')];
|
|
14
|
+
return typeof value === 'string' && value !== '' ? value : undefined;
|
|
15
|
+
}
|
|
16
|
+
//# sourceMappingURL=auth.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/poppy/auth.ts"],"names":[],"mappings":"AAgFA;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAEtF,sGAAsG;AACtG,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAI,UAAsC,CAAC,uBAAuB,CAAC,CAAC;IAC/E,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAE,KAA2B,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAI,UAAsC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}
|