@agent-native/core 0.98.17 → 0.99.0

package/dist/server/core-routes-plugin.d.ts

@@ -143,9 +143,10 @@ export interface CoreRoutesPluginOptions {
     /** Disable the /_agent-native/embed/start iframe session launcher. */
     disableEmbedRoute?: boolean;
     /**
-     * Disable the /_agent-native/mcp/connect routes (browser Connect page +
-     * CLI device-code flow that mints per-user, revocable MCP tokens) and the
-     * standard remote-MCP OAuth endpoints under /_agent-native/mcp/oauth.
+     * Disable the /mcp/connect routes (browser Connect page + CLI device-code
+     * flow that mints per-user, revocable MCP tokens) and the standard remote-MCP
+     * OAuth endpoints under /mcp/oauth. The legacy /_agent-native/mcp aliases
+     * are disabled at the same time.
      * Enabled by default — the routes are session-gated where they approve user
      * access; token endpoints are protected by single-use codes / refresh
      * tokens.

package/dist/server/core-routes-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAgDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,+BAA+B,CAC7C,KAAK,EACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1E,SAAS,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAoBD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAgCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,IAAI,CAOf;AAoCD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAoCzD;AAED,wBAAgB,qCAAqC,SAEpD;AAmBD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;EA8B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAiuFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}
+{"version":3,"file":"core-routes-plugin.d.ts","sourceRoot":"","sources":["../../src/server/core-routes-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAqClC,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,8BAA8B,CAAC;AAiDtC,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AA+BzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAoCvD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AACvD,eAAO,MAAM,sBAAsB,0BAAqC,CAAC;AACzE,eAAO,MAAM,6BAA6B,+BAA0C,CAAC;AAErF,wBAAgB,+BAA+B,CAC7C,KAAK,EACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC1E,SAAS,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED,wBAAgB,mBAAmB,IAAI,YAAY,EAAE,CA+BpD;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,EAAE,EAAE,OAAO,CAAC;IACZ,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IACX,0EAA0E;IAC1E,QAAQ,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,4BAA4B,EAAE,OAAO,CAAC;KACvC,CAAC;IACF,yDAAyD;IACzD,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,GAAE,MAAM;IAAE,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAc,EACtE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAiC9B;AAoBD,UAAU,yBAAyB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAQrE;AAgCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,SAAS,EAAE,OAAO,GACjB,MAAM,GAAG,IAAI,CAOf;AAoCD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,GAAG,SAAa,GACf;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAoCzD;AAED,wBAAgB,qCAAqC,SAEpD;AAmBD,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,yBAAyB,GAAG,IAAI,CAsBlC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;EA8B1B;AAgDD,eAAO,MAAM,kBAAkB,QAAwC,CAAC;AAExE,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,MAAM,CAoBR;AAwHD,KAAK,6BAA6B,GAAG,CACnC,KAAK,EAAE,OAAO,KACX,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAE5C,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAsB,oCAAoC,CACxD,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IACP,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACjE,EACN,IAAI,CAAC,EAAE,SAAS,GAAG,UAAU,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAsD9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,GAAG,IAAI,CASf;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAc/D;AAUD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,oEAAoE;IACpE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,eAAe,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;IAChF;2DACuD;IACvD,wBAAwB,CAAC,EAAE,OAAO,iBAAiB,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IAClG,qEAAqE;IACrE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB;;;;OAIG;IACH,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,uBAA4B,GACpC,cAAc,CAquFhB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,cAAyC,CAAC"}

package/dist/server/core-routes-plugin.js

@@ -13,6 +13,7 @@ import { getDatabaseRuntimeFingerprint, getRuntimeDebugFingerprint, runDatabaseS
 import { uploadFile, getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "../file-upload/index.js";
 import { handleMcpConnect } from "../mcp/connect-route.js";
 import { handleMcpOAuth, handleMcpOAuthAuthorizationServerMetadata, handleMcpOAuthProtectedResourceMetadata, } from "../mcp/oauth-route.js";
+import { MCP_ROUTE_PREFIXES } from "../mcp/route-paths.js";
 import { registerBuiltinNotificationChannels } from "../notifications/channels.js";
 import { createNotificationsHandler } from "../notifications/routes.js";
 import { getOrgContext } from "../org/context.js";
@@ -573,7 +574,7 @@ export function createCoreRoutesPlugin(options = {}) {
             rejectInit = reject;
         });
         trackPluginInit(nitroApp, initPromise, {
-            paths: [FRAMEWORK_ROUTE_PREFIX, "/.well-known"],
+            paths: [FRAMEWORK_ROUTE_PREFIX, "/mcp", "/.well-known"],
         });
         try {
             await awaitBootstrap(nitroApp);
@@ -2534,13 +2535,15 @@ export function createCoreRoutesPlugin(options = {}) {
                 getH3App(nitroApp).use("/.well-known/oauth-protected-resource", defineEventHandler((event) => handleMcpOAuthProtectedResourceMetadata(event)));
                 getH3App(nitroApp).use("/.well-known/oauth-authorization-server", defineEventHandler((event) => handleMcpOAuthAuthorizationServerMetadata(event)));
                 getH3App(nitroApp).use("/.well-known/openid-configuration", defineEventHandler((event) => handleMcpOAuthAuthorizationServerMetadata(event)));
-                getH3App(nitroApp).use(`${P}/mcp/oauth`, defineEventHandler(async (event) => {
-                    const subpath = event.url?.pathname || "";
-                    return handleMcpOAuth(event, subpath, {
-                        appId: options.mcpConnectAppId,
-                        appName: options.mcpConnectAppName ?? getAppName(),
-                    });
-                }));
+                for (const mcpRoutePrefix of MCP_ROUTE_PREFIXES) {
+                    getH3App(nitroApp).use(`${mcpRoutePrefix}/oauth`, defineEventHandler(async (event) => {
+                        const subpath = event.url?.pathname || "";
+                        return handleMcpOAuth(event, subpath, {
+                            appId: options.mcpConnectAppId,
+                            appName: options.mcpConnectAppName ?? getAppName(),
+                        });
+                    }));
+                }
                 // Frictionless external-agent connection. A logged-in user mints a
                 // per-user, scoped, revocable MCP bearer token here — via the browser
                 // Connect page or the OAuth-style device-code flow a CLI drives — so
@@ -2555,13 +2558,15 @@ export function createCoreRoutesPlugin(options = {}) {
                     appName: options.mcpConnectAppName ?? getAppName(),
                     serverName: options.mcpConnectServerName,
                 };
-                getH3App(nitroApp).use(`${P}/mcp/connect`, defineEventHandler(async (event) => {
-                    // The framework strips the mount prefix from event.url.pathname,
-                    // so what remains is the subpath after `/connect` (e.g. `/token`,
-                    // `/device/start`, or `` for the page itself).
-                    const subpath = event.url?.pathname || "";
-                    return handleMcpConnect(event, subpath, mcpConnectOpts);
-                }));
+                for (const mcpRoutePrefix of MCP_ROUTE_PREFIXES) {
+                    getH3App(nitroApp).use(`${mcpRoutePrefix}/connect`, defineEventHandler(async (event) => {
+                        // The framework strips the mount prefix from event.url.pathname,
+                        // so what remains is the subpath after `/connect` (e.g. `/token`,
+                        // `/device/start`, or `` for the page itself).
+                        const subpath = event.url?.pathname || "";
+                        return handleMcpConnect(event, subpath, mcpConnectOpts);
+                    }));
+                }
             }
             // Cross-app SSO ("Sign in with Agent-Native") — CLIENT side. Mounted
             // ONLY when `AGENT_NATIVE_IDENTITY_HUB_URL` is set, so an unset env var