@aotter/mantle-cloudflare 0.0.11-alpha.47 → 0.0.11-alpha.49

package/dist/mount/bootRuntimeOnce.js

@@ -17,6 +17,8 @@ export function createCmsRef(config) {
     return {
         manifests: config.manifests,
         auth: config.auth,
+        credentialResolver: config.credentialResolver,
+        oauthBearer: config.oauthBearer,
         get() {
             if (booted)
                 return booted;

package/dist/mount/bootRuntimeOnce.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootRuntimeOnce.js","sourceRoot":"","sources":["../../src/mount/bootRuntimeOnce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAiBhC,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC1C,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;KAC/D,CAAC,CAAC;IAEH,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG;YACD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,GAAG,OAAO;iBACb,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;iBACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootRuntimeOnce.js","sourceRoot":"","sources":["../../src/mount/bootRuntimeOnce.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,GAEjB,MAAM,wBAAwB,CAAC;AAoBhC,MAAM,UAAU,YAAY,CAAC,MAAiB;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;QAC1C,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,sBAAsB;KAC/D,CAAC,CAAC;IAEH,IAAI,MAAM,GAA+B,IAAI,CAAC;IAC9C,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG;YACD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,GAAG,OAAO;iBACb,QAAQ,EAAE;iBACV,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;iBACnB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;YACL,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mount/cmsConfig.d.ts

@@ -1,6 +1,7 @@
 import type { AnyHandler, CreateCmsRuntimeArgs, PublicPathResolver, TemplateRegistry } from "@aotter/mantle-runtime";
 import type { Manifest, SiteDefaults } from "@aotter/mantle-spec";
 import type { Auth } from "../auth/createAuth.js";
+import type { ConsumerCredentialResolver } from "./resolveCaller.js";
 /**
  * Consumer-supplied config for the Cloudflare adapter mounts. `auth`
  * (Better Auth) gates `/admin/api/*` + MCP bearers. `bindings` carries
@@ -27,5 +28,14 @@ export interface CmsConfig {
     /** Pass-through to runtime: SVG opt-in flag (default false). */
     readonly mediaAllowSvg?: boolean;
     readonly auth: Auth;
+    /** Site-owned API key / personal-token verifier. Core supplies only
+     *  normalization and orchestration; storage and issuance stay in
+     *  consumer code. */
+    readonly credentialResolver?: ConsumerCredentialResolver;
+    /** Enable OAuth JWT bearer authentication on manifest REST routes. */
+    readonly oauthBearer?: {
+        readonly audience: string;
+        readonly scopes?: readonly string[];
+    };
 }
 //# sourceMappingURL=cmsConfig.d.ts.map

package/dist/mount/cmsConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cmsConfig.d.ts","sourceRoot":"","sources":["../../src/mount/cmsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,GAAG;QACtE;;yCAEiC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC7D;;;;oBAIY;QACZ,QAAQ,CAAC,sBAAsB,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;KAClF,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB"}
+{"version":3,"file":"cmsConfig.d.ts","sourceRoot":"","sources":["../../src/mount/cmsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,GAAG,IAAI,GAAG,QAAQ,CAAC,GAAG;QACtE;;yCAEiC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC7D;;;;oBAIY;QACZ,QAAQ,CAAC,sBAAsB,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;KAClF,CAAC;IACF,gEAAgE;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;yBAEqB;IACrB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;CACH"}

package/dist/mount/index.d.ts

@@ -1,4 +1,5 @@
 export { mountServerEndpoints } from "./mountServerEndpoints.js";
+export { resolveCaller, type CallerResolution, type ConsumerCredentialResolution, type ConsumerCredentialResolver, type ResolveCallerOptions, } from "./resolveCaller.js";
 export { type CmsRuntimeRef, createCmsRef } from "./bootRuntimeOnce.js";
 export { createMcpApiHandler, type CreateMcpApiHandlerOptions, } from "./mountMcp.js";
 export { mountPublicRoutes, type CollectionRouteConfig, type MountPublicRoutesOptions, type PublicRouteContext, type SlugOverride, } from "./mountPublicRoutes.js";

package/dist/mount/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,aAAa,EACb,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/mount/index.js

@@ -1,4 +1,5 @@
 export { mountServerEndpoints } from "./mountServerEndpoints.js";
+export { resolveCaller, } from "./resolveCaller.js";
 export { createCmsRef } from "./bootRuntimeOnce.js";
 export { createMcpApiHandler, } from "./mountMcp.js";
 export { mountPublicRoutes, } from "./mountPublicRoutes.js";

package/dist/mount/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mount/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,aAAa,GAKd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAsB,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,GAKlB,MAAM,wBAAwB,CAAC"}

package/dist/mount/mountMcp.d.ts

@@ -2,6 +2,10 @@ import type { CmsRuntimeRef } from "./bootRuntimeOnce.js";
 export interface CreateMcpApiHandlerOptions {
     readonly ref: CmsRuntimeRef;
     readonly surface: "staff" | "public";
+    /** OAuth scopes required to enter this MCP resource. Defaults to
+     *  the existing compatibility scope `mcp`. Target-specific scopes
+     *  remain manifest predicates enforced on tools/call. */
+    readonly requiredScopes?: readonly string[];
 }
 /**
  * Build a Cloudflare Worker `ExportedHandler` that serves one MCP
@@ -10,8 +14,8 @@ export interface CreateMcpApiHandlerOptions {
  *
  * The OAuthProvider lib verifies the bearer token, decrypts grant
  * props, and sets `ctx.props` BEFORE calling this handler. We read
- * `ctx.props.{userId, role}` (stashed at consent time by
- * `mountAuthorize`) and gate staff surfaces on the D1 staff role.
+ * immutable grant props and re-read the caller's mutable staff role
+ * from D1 on every invocation.
  *
  * Note: OAuth scope distinction (`mcp:read` vs `mcp:staff`) used to
  * differentiate surfaces here. Removed because claude.ai's MCP client

package/dist/mount/mountMcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mountMcp.d.ts","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;CACtC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmF1C"}
+{"version":3,"file":"mountMcp.d.ts","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC;;6DAEyD;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,0BAA0B,GAClC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2F1C"}

package/dist/mount/mountMcp.js

@@ -7,8 +7,8 @@ import { STAFF_ROLE_SET } from "../auth/createAuth.js";
  *
  * The OAuthProvider lib verifies the bearer token, decrypts grant
  * props, and sets `ctx.props` BEFORE calling this handler. We read
- * `ctx.props.{userId, role}` (stashed at consent time by
- * `mountAuthorize`) and gate staff surfaces on the D1 staff role.
+ * immutable grant props and re-read the caller's mutable staff role
+ * from D1 on every invocation.
  *
  * Note: OAuth scope distinction (`mcp:read` vs `mcp:staff`) used to
  * differentiate surfaces here. Removed because claude.ai's MCP client
@@ -18,6 +18,7 @@ import { STAFF_ROLE_SET } from "../auth/createAuth.js";
  */
 export function createMcpApiHandler(options) {
     const { ref, surface } = options;
+    const requiredScopes = options.requiredScopes ?? ["mcp"];
     // Key the cached dispatcher to the runtime identity. Without this,
     // if `ref.get()` rejects + resets and the next call returns a new
     // runtime instance, the cached dispatcher would silently keep
@@ -28,10 +29,14 @@ export function createMcpApiHandler(options) {
         async fetch(request, _env, ctx) {
             const props = ctx.props;
             if (!props?.userId)
-                return forbidden();
-            const role = props.role;
+                return forbidden(requiredScopes);
+            const grantedScopes = props.scopes?.length ? props.scopes : ["mcp"];
+            if (requiredScopes.some((scope) => !grantedScopes.includes(scope))) {
+                return forbidden(requiredScopes);
+            }
+            const role = await ref.auth.getUserRole(props.userId);
             if (surface === "staff" && (!role || !STAFF_ROLE_SET.has(role))) {
-                return forbidden();
+                return forbidden(requiredScopes);
             }
             const runtime = await ref.get();
             // Media tools require BOTH a storage adapter AND a declared
@@ -86,15 +91,19 @@ export function createMcpApiHandler(options) {
                 staff: role && STAFF_ROLE_SET.has(role)
                     ? { userId: props.userId, role: role }
                     : null,
+                clientId: props.clientId ?? null,
+                credentialId: null,
+                scopes: grantedScopes,
             });
         },
     };
 }
-function forbidden() {
+function forbidden(requiredScopes) {
+    const scope = requiredScopes.join(" ");
     return new Response("forbidden", {
         status: 403,
         headers: {
-            "www-authenticate": `Bearer realm="mcp", error="insufficient_scope"`,
+            "www-authenticate": `Bearer realm="mcp", error="insufficient_scope", scope="${scope}"`,
             "access-control-expose-headers": "WWW-Authenticate",
         },
     });

package/dist/mount/mountMcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"mountMcp.js","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AASvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACjC,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,eAAe,GAAG,IAAI,OAAO,EAG/B,CAAC;IAEL,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAI,GAA4C,CAAC,KAAK,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,SAAS,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YACxB,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,SAAS,EAAE,CAAC;YACrB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,4DAA4D;YAC5D,qDAAqD;YACrD,iEAAiE;YACjE,kEAAkE;YAClE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK;gBACjC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;gBAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxE,MAAM,UAAU,GAAG,IAAI,oBAAoB,CACzC;oBACE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,KAAK;wBAClC,CAAC,CAAC;4BACE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,QAAQ,EAAE,aAAa;yBACxB;wBACH,CAAC,CAAC,SAAS;iBACd,EACD,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EACnC;oBACE,OAAO;oBACP,uDAAuD;oBACvD,0DAA0D;oBAC1D,8DAA8D;oBAC9D,kDAAkD;oBAClD,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CACzB,CAAC,CAAC,EAAqB,EAAE,CACvB,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,OAAO,CAChE;oBACD,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC;iBACtF,CACF,CAAC;gBACF,MAAM,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE;gBACzC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;oBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAiB,EAAE;oBACnD,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAC/B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,kBAAkB,EAAE,gDAAgD;YACpE,+BAA+B,EAAE,kBAAkB;SACpD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,QAAoC,EACpC,gBAAwD,EACxD,OAA2B;IAE3B,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"mountMcp.js","sourceRoot":"","sources":["../../src/mount/mountMcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAO9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAavD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,eAAe,GAAG,IAAI,OAAO,EAG/B,CAAC;IAEL,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAI,GAA4C,CAAC,KAAK,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,MAAM;gBAAE,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnE,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,SAAS,CAAC,cAAc,CAAC,CAAC;YACnC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;YAChC,4DAA4D;YAC5D,qDAAqD;YACrD,iEAAiE;YACjE,kEAAkE;YAClE,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK;gBACjC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;gBAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;gBACxE,MAAM,UAAU,GAAG,IAAI,oBAAoB,CACzC;oBACE,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,eAAe,EAAE,OAAO,CAAC,eAAe;oBACxC,KAAK,EAAE,YAAY,IAAI,OAAO,CAAC,KAAK;wBAClC,CAAC,CAAC;4BACE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;4BACxC,QAAQ,EAAE,aAAa;yBACxB;wBACH,CAAC,CAAC,SAAS;iBACd,EACD,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,EACnC;oBACE,OAAO;oBACP,uDAAuD;oBACvD,0DAA0D;oBAC1D,8DAA8D;oBAC9D,kDAAkD;oBAClD,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CACzB,CAAC,CAAC,EAAqB,EAAE,CACvB,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,OAAO,CAChE;oBACD,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC;iBACtF,CACF,CAAC;gBACF,MAAM,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,CAAC;gBAC1C,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE;gBACzC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;oBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,IAAiB,EAAE;oBACnD,CAAC,CAAC,IAAI;gBACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,cAAiC;IAClD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;QAC/B,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACP,kBAAkB,EAAE,0DAA0D,KAAK,GAAG;YACtF,+BAA+B,EAAE,kBAAkB;SACpD;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,QAAoC,EACpC,gBAAwD,EACxD,OAA2B;IAE3B,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mount/mountServerEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mountServerEndpoints.d.ts","sourceRoot":"","sources":["../../src/mount/mountServerEndpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAM1D;;;;iBAIiB;AACjB,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,aAAa,GACjB,IAAI,CA6BN;AA0yDD,YAAY,EAAE,aAAa,EAAE,CAAC"}
+{"version":3,"file":"mountServerEndpoints.d.ts","sourceRoot":"","sources":["../../src/mount/mountServerEndpoints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAO1D;;;;iBAIiB;AACjB,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,EACT,GAAG,EAAE,aAAa,GACjB,IAAI,CA6BN;AAkwDD,YAAY,EAAE,aAAa,EAAE,CAAC"}

package/dist/mount/mountServerEndpoints.js

@@ -1,6 +1,7 @@
 import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, redactForWire, runtimeDiagnostic, } from "@aotter/mantle-spec";
 import { ViewParamCoercionError, coerceViewParams, evaluateAuthAll, matchPath, } from "@aotter/mantle-runtime";
 import { indexHtml } from "@aotter/mantle-admin-ui";
+import { resolveCaller } from "./resolveCaller.js";
 import { STAFF_ROLE_SET } from "../auth/createAuth.js";
 import { AOTTER_FAVICON_SVG } from "../assets/aotterFavicon.js";
 const [PAGE_PARAM, SHOW_PARAM] = VIEW_PARAMS_RESERVED;
@@ -22,7 +23,7 @@ export function mountServerEndpoints(app, ref) {
         app.on(method, honoPath, async (c) => {
             const runtime = await ref.get();
             const waitUntil = readWaitUntil(c);
-            return handleHttpTrigger(c.req.raw, runtime, ref.auth, triggerName, path, waitUntil);
+            return handleHttpTrigger(c.req.raw, runtime, ref, triggerName, path, waitUntil);
         });
     }
     for (const v of ref.manifests) {
@@ -38,7 +39,7 @@ export function mountServerEndpoints(app, ref) {
         app.get(`/api/views/${viewName}`, async (c) => {
             const runtime = await ref.get();
             const waitUntil = readWaitUntil(c);
-            return handleViewRequest(c.req.raw, runtime, viewName, ref.auth, waitUntil, "/api/views");
+            return handleViewRequest(c.req.raw, runtime, viewName, ref, waitUntil, "/api/views");
         });
     }
     mountAdminBetterAuth(app, ref, ref.auth);
@@ -261,7 +262,7 @@ function mountAdminBetterAuth(app, ref, auth) {
         guarded("get", `/admin/api/views/${viewName}`, async (c) => {
             const runtime = await ref.get();
             const waitUntil = readWaitUntil(c);
-            return handleViewRequest(c.req.raw, runtime, viewName, ref.auth, waitUntil, "/admin/api/views");
+            return handleViewRequest(c.req.raw, runtime, viewName, ref, waitUntil, "/admin/api/views");
         });
     }
     guarded("get", "/admin/api/operations", () => Response.json({
@@ -1202,6 +1203,12 @@ function adminHandlerContext(c, gate) {
     return {
         user: { id: gate.userId },
         staff: { id: gate.userId, role: gate.role },
+        auth: {
+            credential: "session",
+            credentialId: gate.sessionId,
+            clientId: null,
+            scopes: [],
+        },
         env: {},
         ...(waitUntil ? { waitUntil } : {}),
     };
@@ -1210,7 +1217,7 @@ async function readStaffGate(c, auth) {
     const session = await auth.getSession(c.req.raw);
     if (!session)
         return { kind: "unauth" };
-    const role = session.user.role ?? null;
+    const role = await auth.getUserRole(session.user.id);
     const login = session.user.githubLogin ?? null;
     if (!role || !STAFF_ROLE_SET.has(role)) {
         return { kind: "forbidden", login };
@@ -1220,9 +1227,10 @@ async function readStaffGate(c, auth) {
         userId: session.user.id,
         login,
         role: role,
+        sessionId: session.session.id,
     };
 }
-async function handleHttpTrigger(req, runtime, auth, triggerName, triggerPath, waitUntil) {
+async function handleHttpTrigger(req, runtime, ref, triggerName, triggerPath, waitUntil) {
     const trigger = runtime.triggersByName.get(triggerName);
     if (!trigger) {
         return jsonError({ status: 500, code: "INTERNAL_ERROR", message: `Trigger '${triggerName}' missing post-boot.` });
@@ -1232,6 +1240,16 @@ async function handleHttpTrigger(req, runtime, auth, triggerName, triggerPath, w
     if (!procedure) {
         return jsonError({ status: 500, code: "INTERNAL_ERROR", message: `Procedure '${procName}' missing post-boot.` });
     }
+    const triggerPathPrefix = `${req.method} ${triggerPath}`;
+    const caller = await resolveCaller(req, {
+        auth: ref.auth,
+        credentialResolver: ref.credentialResolver,
+        oauthBearer: ref.oauthBearer,
+        waitUntil,
+    });
+    if (caller.kind === "invalid") {
+        return Response.json({ ok: false, diagnostic: caller.diagnostic }, { status: caller.status });
+    }
     const url = new URL(req.url);
     const params = matchPath(triggerPath, url.pathname) ?? {};
     const body = await readBody(req);
@@ -1239,32 +1257,10 @@ async function handleHttpTrigger(req, runtime, auth, triggerName, triggerPath, w
     // resource identifier (a `DELETE /entries/{id}` body MUST NOT spoof
     // `id`). Body fields fill in non-path inputs only.
     const input = { ...body, ...params };
-    const triggerPathPrefix = `${req.method} ${triggerPath}`;
-    const ctx = await buildCallerContext(req, auth, waitUntil);
-    // Mirror the View handler's 401-vs-403 discipline (see
-    // `handleViewRequest`). An auth-gated Procedure called with no
-    // session is UNAUTHENTICATED (401); a session whose role fails the
-    // predicate is AUTH_DENIED (403). InvokeProcedureUseCase collapses
-    // both into AUTH_DENIED if we pass `{ user: null, staff: null }`
-    // as ctx, so we pre-check here.
-    if (procedure.spec.requires?.auth && !ctx) {
-        return Response.json({
-            ok: false,
-            diagnostic: runtimeDiagnostic({
-                code: "UNAUTHENTICATED",
-                severity: "error",
-                path: triggerPathPrefix,
-                expected: "authenticated session",
-                message: `Procedure '${procName}' requires authentication.`,
-            }),
-        }, { status: 401 });
-    }
-    const wu = waitUntil ? { waitUntil } : {};
-    const invokeCtx = ctx ?? { user: null, staff: null, env: {}, ...wu };
     const result = await runtime.invokeProcedure.execute({
         procedure,
         input,
-        ctx: invokeCtx,
+        ctx: caller.context,
         pathPrefix: triggerPathPrefix,
     });
     if (result.ok) {
@@ -1273,7 +1269,7 @@ async function handleHttpTrigger(req, runtime, auth, triggerName, triggerPath, w
     const status = HTTP_STATUS_BY_CODE[result.diagnostic.code] ?? 500;
     return Response.json({ ok: false, diagnostic: result.diagnostic }, { status });
 }
-async function handleViewRequest(req, runtime, viewName, auth, waitUntil, 
+async function handleViewRequest(req, runtime, viewName, ref, waitUntil, 
 // Mount prefix for this View's route. Passed by the caller because
 // the same handler serves BOTH the public mount (`/api/views`) and
 // the staff mount (`/admin/api/views`); hardcoding the public prefix
@@ -1284,29 +1280,22 @@ mountPath) {
         return jsonError({ status: 500, code: "INTERNAL_ERROR", message: `View '${viewName}' missing post-boot.` });
     }
     const viewPath = `GET ${mountPath}/${viewName}`;
-    // Resolve caller identity FIRST and evaluate `requires.auth.all`
-    // BEFORE param coercion. Two reasons:
-    //   (1) a param-coercion 400 against an auth-gated View would leak
-    //       the View's parameter contract to an unauthorized caller —
-    //       this matters for both anonymous probes AND authenticated
-    //       users without the required role.
-    //   (2) the UNAUTHENTICATED branch in ExecuteViewUseCase only fires
-    //       when ctx is undefined, so passing a guest ctx for no-session
-    //       would collapse 401 and 403 into the same AUTH_DENIED.
-    const ctx = await buildCallerContext(req, auth, waitUntil);
+    // Resolve caller and evaluate static auth BEFORE query coercion so a
+    // protected View does not leak its parameter contract. The runtime
+    // evaluates the same predicates again before guard/query execution;
+    // this adapter preflight exists only to preserve the no-leak order at
+    // the HTTP parsing boundary.
+    const caller = await resolveCaller(req, {
+        auth: ref.auth,
+        credentialResolver: ref.credentialResolver,
+        oauthBearer: ref.oauthBearer,
+        waitUntil,
+    });
+    if (caller.kind === "invalid") {
+        return Response.json({ ok: false, diagnostic: caller.diagnostic }, { status: caller.status });
+    }
+    const ctx = caller.context;
     if (view.spec.requires?.auth) {
-        if (!ctx) {
-            return Response.json({
-                ok: false,
-                diagnostic: runtimeDiagnostic({
-                    code: "UNAUTHENTICATED",
-                    severity: "error",
-                    path: viewPath,
-                    expected: "authenticated session",
-                    message: `View '${viewName}' requires authentication.`,
-                }),
-            }, { status: 401 });
-        }
         const denial = evaluateAuthAll(view.spec.requires, ctx, viewPath, "runtime");
         if (denial) {
             return Response.json({
@@ -1349,35 +1338,6 @@ mountPath) {
     const status = HTTP_STATUS_BY_CODE[result.diagnostic.code] ?? 500;
     return Response.json({ ok: false, diagnostic: result.diagnostic }, { status });
 }
-/**
- * Resolve caller identity for a View or HTTP-Trigger request from the
- * Better Auth cookie session. Returns `undefined` when there is no
- * session so callers can distinguish 401 (no session) from 403
- * (session but wrong role) — `ExecuteViewUseCase` and the
- * `handleHttpTrigger` pre-check both rely on this signal.
- *
- * Used by both `handleViewRequest` and `handleHttpTrigger` so the
- * two HTTP surfaces resolve identity identically.
- *
- * Note: this resolves cookie sessions only. OAuth bearer tokens
- * (issued by `createOAuthProvider` for MCP callers) are NOT verified
- * here — bearer-authenticated identity belongs on the MCP surface,
- * not the HTTP Trigger surface, so a bearer-only caller hitting an
- * auth-gated Trigger will land at the 401 branch in
- * `handleHttpTrigger`. Procedures that need to be agent-callable
- * should be reached via `/mcp` or `/mcp/staff` (see #281).
- */
-async function buildCallerContext(req, auth, waitUntil) {
-    const session = await auth.getSession(req);
-    if (!session)
-        return undefined;
-    const wu = waitUntil ? { waitUntil } : {};
-    const role = await auth.getUserRole(session.user.id);
-    const staff = role && STAFF_ROLE_SET.has(role)
-        ? { id: session.user.id, role: role }
-        : null;
-    return { user: { id: session.user.id }, staff, env: {}, ...wu };
-}
 function parsePositiveInt(raw) {
     if (raw == null || raw === "")
         return undefined;