@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/mcp/manual-failure-memo.js

@@ -3,16 +3,18 @@
  *
  * Registering a `.tool` manual with a present-but-broken credential (an
  * expired OAuth session, a revoked key) fails with a live network round-trip —
- * and sessions are rebuilt constantly (every external MCP connection runs a
- * full discovery), so one stale credential otherwise re-dials its provider on
- * every build, forever. Besides the log noise, each failed attempt on the
- * MCP transport layer's long-lived shared session leaks an abort listener
- * upstream — the memo starves that loop.
+ * and the tool surface is rebuilt on every MCP request, so one stale credential
+ * otherwise re-dials its provider on every request, forever.
+ *
+ * The "manual" key is whatever the caller passes; the MCP service passes the
+ * manual's name plus a fingerprint of its definition, so editing a manual that
+ * just failed (a corrected URL in `mcp.json`) is retried on the next request
+ * instead of waiting out the TTL.
  *
  * Failures are remembered for a few minutes only: a repaired credential is
  * picked up at the next build after expiry (or immediately after a restart).
  * Successes are never cached here — this is a circuit breaker, not a catalog
- * cache. Expired entries are pruned opportunistically so the map stays
+ * cache. Expired failures are pruned opportunistically so the map stays
  * bounded by the number of DISTINCT recently-failing (user, manual) pairs.
  */
 export class ManualFailureMemo {
@@ -20,20 +22,49 @@ export class ManualFailureMemo {
     now;
     failures = new Map();
     /**
-     * Advanced by every clear operation. A registration attempt captures the
-     * generation BEFORE its (slow, awaited) network call and hands it back to
-     * {@link recordFailure} — if a clear happened in between (the user just
-     * repaired the credential), the stale in-flight failure is discarded instead
-     * of resurrecting a memo entry the clear was meant to remove.
+     * Out-of-order protection. Every clear takes the next value of a monotonic
+     * counter and remembers it for the scope it cleared: one pair, one user, or
+     * everyone. A registration attempt starts with {@link beginAttempt}, which
+     * captures the counter BEFORE its (slow, awaited) network call; its failure is
+     * discarded only when a clear covering THAT pair ran in between. A success of
+     * an unrelated manual, or a clear for another user, never discards it — no
+     * matter how long the attempt takes.
+     */
+    counter = 0;
+    allClearedAt = 0;
+    userClears = new Map();
+    pairClears = new Map();
+    /**
+     * Generations captured by attempts still in flight (generation → count). A
+     * clear record matters only to an attempt that started before it, so a record
+     * is kept exactly while such an attempt is running — which bounds the clear
+     * maps by what concurrent attempts can still observe.
      */
-    generation = 0;
+    inFlight = new Map();
     constructor(ttlMs = 5 * 60_000, now = Date.now) {
         this.ttlMs = ttlMs;
         this.now = now;
     }
-    /** Capture before an awaited registration attempt; pass to {@link recordFailure}. */
-    get currentGeneration() {
-        return this.generation;
+    /**
+     * Start a registration attempt. Pass the returned generation to
+     * {@link recordFailure}, and ALWAYS to {@link endAttempt} when the attempt is
+     * over (try/finally) — an attempt never ended keeps later clear records alive.
+     */
+    beginAttempt() {
+        const generation = this.counter;
+        this.inFlight.set(generation, (this.inFlight.get(generation) ?? 0) + 1);
+        return generation;
+    }
+    /** The attempt started at `generation` is over (after any `recordFailure`/`clear` it made). */
+    endAttempt(generation) {
+        const count = this.inFlight.get(generation);
+        if (count === undefined)
+            return;
+        if (count <= 1)
+            this.inFlight.delete(generation);
+        else
+            this.inFlight.set(generation, count - 1);
+        this.pruneClears();
     }
     key(userId, manualName) {
         return `${userId} ${manualName}`;
@@ -48,12 +79,13 @@ export class ManualFailureMemo {
         return this.failures.get(this.key(userId, manualName))?.message;
     }
     /**
-     * Record a failure — unless `generation` (captured before the attempt) is
-     * stale, meaning a clear ran while the attempt was in flight. Dropping the
-     * record is the conservative direction: the worst case is one extra retry.
+     * Record a failure — unless `generation` (from {@link beginAttempt}) is stale
+     * for this pair, meaning a clear covering it ran while the attempt was in
+     * flight. Dropping the record is the conservative direction: the worst case
+     * is one extra retry.
      */
     recordFailure(userId, manualName, message, generation) {
-        if (generation !== undefined && generation !== this.generation)
+        if (generation !== undefined && this.clearedSince(userId, manualName, generation))
             return;
         this.failures.set(this.key(userId, manualName), {
             message,
@@ -62,8 +94,10 @@ export class ManualFailureMemo {
     }
     /** Forget a pair (e.g. after a successful registration proves the credential works again). */
     clear(userId, manualName) {
-        this.generation += 1;
-        this.failures.delete(this.key(userId, manualName));
+        const key = this.key(userId, manualName);
+        this.pairClears.set(key, this.nextGeneration());
+        this.failures.delete(key);
+        this.pruneClears();
     }
     /**
      * Forget every failure for one user — called when their secrets change, so a
@@ -71,17 +105,39 @@ export class ManualFailureMemo {
      * waiting out the TTL.
      */
     clearUser(userId) {
-        this.generation += 1;
+        this.userClears.set(userId, this.nextGeneration());
         const prefix = `${userId} `;
         for (const k of this.failures.keys()) {
             if (k.startsWith(prefix))
                 this.failures.delete(k);
         }
+        this.pruneClears();
     }
     /** Forget everything — a SHARED secret changed, which can affect any user. */
     clearAll() {
-        this.generation += 1;
+        this.allClearedAt = this.nextGeneration();
         this.failures.clear();
     }
+    nextGeneration() {
+        this.counter += 1;
+        return this.counter;
+    }
+    clearedSince(userId, manualName, generation) {
+        return (this.allClearedAt > generation ||
+            (this.userClears.get(userId) ?? 0) > generation ||
+            (this.pairClears.get(this.key(userId, manualName)) ?? 0) > generation);
+    }
+    /** Drop clear records no in-flight attempt predates: none of them can ever be consulted again. */
+    pruneClears() {
+        let oldest = Infinity;
+        for (const generation of this.inFlight.keys())
+            oldest = Math.min(oldest, generation);
+        for (const clears of [this.userClears, this.pairClears]) {
+            for (const [k, generation] of clears) {
+                if (generation <= oldest)
+                    clears.delete(k);
+            }
+        }
+    }
 }
 //# sourceMappingURL=manual-failure-memo.js.map

package/dist/modules/mcp/manual-failure-memo.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-failure-memo.js","sourceRoot":"","sources":["../../../src/modules/mcp/manual-failure-memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,iBAAiB;IAYT;IACA;IAZF,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAC;IACtF;;;;;;OAMG;IACK,UAAU,GAAG,CAAC,CAAC;IAEvB,YACmB,QAAgB,CAAC,GAAG,MAAM,EAC1B,MAAoB,IAAI,CAAC,GAAG;QAD5B,UAAK,GAAL,KAAK,CAAqB;QAC1B,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,qFAAqF;IACrF,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,UAAkB;QAC5C,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC;IACnC,CAAC;IAED,+FAA+F;IAC/F,aAAa,CAAC,MAAc,EAAE,UAAkB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,UAAmB;QACpF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,OAAO;QACvE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAC;IACL,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,MAAc,EAAE,UAAkB;QACtC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACrD,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACN,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"manual-failure-memo.js","sourceRoot":"","sources":["../../../src/modules/mcp/manual-failure-memo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,iBAAiB;IAyBT;IACA;IAzBF,QAAQ,GAAG,IAAI,GAAG,EAAkD,CAAC;IAEtF;;;;;;;;OAQG;IACK,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,GAAG,CAAC,CAAC;IACR,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxD;;;;;OAKG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,YACmB,QAAgB,CAAC,GAAG,MAAM,EAC1B,MAAoB,IAAI,CAAC,GAAG;QAD5B,UAAK,GAAL,KAAK,CAAqB;QAC1B,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,YAAY;QACV,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,+FAA+F;IAC/F,UAAU,CAAC,UAAkB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;YAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,UAAkB;QAC5C,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC;IACnC,CAAC;IAED,+FAA+F;IAC/F,aAAa,CAAC,MAAc,EAAE,UAAkB;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,UAAmB;QACpF,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;YAAE,OAAO;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE;YAC9C,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK;SACnC,CAAC,CAAC;IACL,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,MAAc,EAAE,UAAkB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACN,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,YAAY,CAAC,MAAc,EAAE,UAAkB,EAAE,UAAkB;QACzE,OAAO,CACL,IAAI,CAAC,YAAY,GAAG,UAAU;YAC9B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,UAAU;YAC/C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,UAAU,CACtE,CAAC;IACJ,CAAC;IAED,kGAAkG;IAC1F,WAAW;QACjB,IAAI,MAAM,GAAG,QAAQ,CAAC;QACtB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrF,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,MAAM,EAAE,CAAC;gBACrC,IAAI,UAAU,IAAI,MAAM;oBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/modules/mcp/mcp-auth.middleware.d.ts

@@ -13,7 +13,8 @@ import '../tool-auth/external-api-key.interface.js';
  *      authorization server after the /connect consent flow, resolved via
  *      BevelOAuthProvider.
  *   3. An internal token (Bearer `<tenant>-int_…`) — minted server-side only
- *      (createSession's loopback bearer, the /mcp/local-token exchange). The
+ *      (the per-request loopback bearer `createRequestServer` mints, the
+ *      /mcp/local-token exchange). The
  *      local MCP server (hexis-mcp) exchanges its OAuth grant for one and
  *      then uses it EVERYWHERE a connection key goes — the agent REST surface
  *      already accepts it, and refusing it here made OAuth-mode hexis-mcp
@@ -26,13 +27,16 @@ import '../tool-auth/external-api-key.interface.js';
  *      hit the MCP endpoint from their browser if we ever need it
  *      (e.g. an in-app debugger). Keeps the surface from forking.
  *
- * The middleware **must** run before the MCP transport handler — the
- * transport pulls `req.userId` to populate the session row at `initialize`.
+ * The middleware **must** run before the MCP transport handler — every
+ * request's server is built from `req.userId` (there is no session row to
+ * carry it; the endpoint is stateless per request).
  *
  * Failures return 401 with a `WWW-Authenticate` challenge carrying
  * `resource_metadata` (RFC 9728) so an OAuth-capable MCP client discovers our
- * authorization server and starts the flow, while clients configured with a
- * key simply prompt for it.
+ * authorization server and starts the flow — EXCEPT a bearer shaped like a
+ * connection key that does not verify: that caller configured a key, so it
+ * gets a plain `invalid_token` answer and no sign-in invitation (see
+ * `connection-key-rejection.ts`).
  */
 export declare function createMcpAuthMiddleware(authService: AuthService, externalApiKeyService: IExternalApiKeyService, oauthProvider: BevelOAuthProvider, resourceMetadataUrl: string, internalTokens: InternalTokenService): (req: Request, res: Response, next: NextFunction) => Promise<void>;
 //# sourceMappingURL=mcp-auth.middleware.d.ts.map

package/dist/modules/mcp/mcp-auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,sBAAsB,EAC7C,aAAa,EAAE,kBAAkB,EACjC,mBAAmB,EAAE,MAAM,EAC3B,cAAc,EAAE,oBAAoB,IAQtB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAsI9D"}
+{"version":3,"file":"mcp-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,WAAW,EACxB,qBAAqB,EAAE,sBAAsB,EAC7C,aAAa,EAAE,kBAAkB,EACjC,mBAAmB,EAAE,MAAM,EAC3B,cAAc,EAAE,oBAAoB,IAQtB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,mBAuI9D"}

package/dist/modules/mcp/mcp-auth.middleware.js

@@ -1,4 +1,7 @@
+import { logger } from '../../shared/logging.js';
+const log = logger('mcp-auth');
 import { InvalidTokenError } from '@modelcontextprotocol/sdk/server/auth/errors.js';
+import { rejectConnectionKey } from '../tool-auth/connection-key-rejection.js';
 import '../tool-auth/external-api-key.interface.js'; // Express Request augmentation (req.externalApiKeyId)
 /**
  * Auth middleware for the MCP endpoint. Accepts any of:
@@ -9,7 +12,8 @@ import '../tool-auth/external-api-key.interface.js'; // Express Request augmenta
  *      authorization server after the /connect consent flow, resolved via
  *      BevelOAuthProvider.
  *   3. An internal token (Bearer `<tenant>-int_…`) — minted server-side only
- *      (createSession's loopback bearer, the /mcp/local-token exchange). The
+ *      (the per-request loopback bearer `createRequestServer` mints, the
+ *      /mcp/local-token exchange). The
  *      local MCP server (hexis-mcp) exchanges its OAuth grant for one and
  *      then uses it EVERYWHERE a connection key goes — the agent REST surface
  *      already accepts it, and refusing it here made OAuth-mode hexis-mcp
@@ -22,13 +26,16 @@ import '../tool-auth/external-api-key.interface.js'; // Express Request augmenta
  *      hit the MCP endpoint from their browser if we ever need it
  *      (e.g. an in-app debugger). Keeps the surface from forking.
  *
- * The middleware **must** run before the MCP transport handler — the
- * transport pulls `req.userId` to populate the session row at `initialize`.
+ * The middleware **must** run before the MCP transport handler — every
+ * request's server is built from `req.userId` (there is no session row to
+ * carry it; the endpoint is stateless per request).
  *
  * Failures return 401 with a `WWW-Authenticate` challenge carrying
  * `resource_metadata` (RFC 9728) so an OAuth-capable MCP client discovers our
- * authorization server and starts the flow, while clients configured with a
- * key simply prompt for it.
+ * authorization server and starts the flow — EXCEPT a bearer shaped like a
+ * connection key that does not verify: that caller configured a key, so it
+ * gets a plain `invalid_token` answer and no sign-in invitation (see
+ * `connection-key-rejection.ts`).
  */
 export function createMcpAuthMiddleware(authService, externalApiKeyService, oauthProvider, resourceMetadataUrl, internalTokens) {
     const wwwAuthenticate = `Bearer realm="bevel-mcp", resource_metadata="${resourceMetadataUrl}"`;
@@ -62,7 +69,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                 // `externalApiKeyId` unset and are not metered.
                 const resolved = await externalApiKeyService.verifyAndLoadToken(token);
                 if (!resolved) {
-                    unauthorized(res, 'Invalid or revoked connection key');
+                    rejectConnectionKey(res);
                     return;
                 }
                 req.userId = resolved.user.id;
@@ -74,7 +81,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
             catch (err) {
                 // A DB error during verification is a 500, not a 401 — the caller's
                 // credentials may be valid; we just can't check them right now.
-                console.error('[mcp-auth] connection-key verification failed:', err);
+                log.error('connection-key verification failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
                 return;
             }
@@ -98,7 +105,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                     unauthorized(res, 'Invalid, expired, or revoked access token');
                 }
                 else {
-                    console.error('[mcp-auth] OAuth token verification failed:', err);
+                    log.error('OAuth token verification failed:', { err });
                     res.status(500).json({ error: 'Authentication backend unavailable' });
                 }
                 return;
@@ -116,13 +123,14 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
         // downstream resolve access against it.
         //
         // ONLY the `externalProxy` shape is admitted: that claim marks the
-        // loopback identity of an external caller (createSession's session
-        // bearer, the /mcp/local-token exchange), which is the one internal-token
-        // kind that has any business arriving here as an MCP client. A plain
-        // in-process internal token — the per-run credential the agent factory
-        // mints for its own code-mode client — is a loopback-surface credential,
-        // and accepting it would let it open an MCP session (createSession would
-        // even mint it a fresh externalProxy bearer, upgrading it).
+        // loopback identity of an external caller (the per-request bearer
+        // `createRequestServer` mints, the /mcp/local-token exchange), which is
+        // the one internal-token kind that has any business arriving here as an
+        // MCP client. A plain in-process internal token — the per-run credential
+        // the agent factory mints for its own code-mode client — is a
+        // loopback-surface credential, and accepting it would let it drive the
+        // MCP endpoint (createRequestServer would even mint it a fresh
+        // externalProxy bearer, upgrading it).
         if (internalTokens.looksLikeInternalToken(token)) {
             // `verify` answers null for the invalid/expired cases it can see coming,
             // but a malformed token of plausible shape can still THROW from inside
@@ -145,7 +153,7 @@ export function createMcpAuthMiddleware(authService, externalApiKeyService, oaut
                 user = await authService.getUserById(claim.userId);
             }
             catch (err) {
-                console.error('[mcp-auth] internal-token user lookup failed:', err);
+                log.error('internal-token user lookup failed:', { err });
                 res.status(500).json({ error: 'Authentication backend unavailable' });
                 return;
             }

package/dist/modules/mcp/mcp-auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAKpF,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAE3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,qBAA6C,EAC7C,aAAiC,EACjC,mBAA2B,EAC3B,cAAoC;IAEpC,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;IAC/F,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qDAAqD;gBACrD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,gEAAgE;gBAChE,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,YAAY,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,GAAG,CAAC,CAAC;oBAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,mEAAmE;QACnE,0EAA0E;QAC1E,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,4DAA4D;QAC5D,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,KAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3C,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-auth.middleware.js","sourceRoot":"","sources":["../../../src/modules/mcp/mcp-auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAIpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E,OAAO,4CAA4C,CAAC,CAAC,sDAAsD;AAE3G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwB,EACxB,qBAA6C,EAC7C,aAAiC,EACjC,mBAA2B,EAC3B,cAAoC;IAEpC,MAAM,eAAe,GAAG,gDAAgD,mBAAmB,GAAG,CAAC;IAC/F,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,KAAa,EAAE,EAAE;QACpD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,YAAY,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uCAAuC;QACvC,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,qDAAqD;gBACrD,gDAAgD;gBAChD,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,mBAAmB,CAAC,GAAG,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACxC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,gEAAgE;gBAChE,GAAG,CAAC,KAAK,CAAC,qCAAqC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1D,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;oBAChB,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,YAAY,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,sBAAsB;YACtB,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,wCAAwC;QACxC,EAAE;QACF,mEAAmE;QACnE,kEAAkE;QAClE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,8DAA8D;QAC9D,uEAAuE;QACvE,+DAA+D;QAC/D,uCAAuC;QACvC,IAAI,cAAc,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,wEAAwE;YACxE,4DAA4D;YAC5D,IAAI,KAAiD,CAAC;YACtD,IAAI,CAAC;gBACH,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,IAAI,CAAC;YACf,CAAC;YACD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;gBAC3C,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,YAAY,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;YAC3B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/mcp/mcp.routes.d.ts

@@ -9,9 +9,9 @@ import '../tool-auth/external-api-key.interface.js';
  * Routes for the remote MCP server + the connection-key management endpoints.
  *
  * Layout:
- *   POST   /mcp           — client→server MCP messages (initialize + tool calls)
- *   GET    /mcp           — server→client SSE channel (session-bound)
- *   DELETE /mcp           — terminate a session
+ *   POST   /mcp           — every client→server MCP message, each request on its own
+ *   GET    /mcp           — 405: no standalone server→client stream (stateless)
+ *   DELETE /mcp           — 405: there is no session to terminate (stateless)
  *
  *   GET    /mcp/external-api-keys         — list this user's connection keys
  *   POST   /mcp/external-api-keys         — mint a new key (returns plaintext ONCE)
@@ -20,7 +20,7 @@ import '../tool-auth/external-api-key.interface.js';
  *   POST   /mcp/local-token               — exchange an MCP OAuth access token
  *                                           for a loopback internal token
  *
- * The `/mcp` endpoints accept either a connection key or a JWT (see
+ * The `/mcp` POST accepts either a connection key or a JWT/OAuth token (see
  * McpAuthMiddleware). The `/mcp/external-api-keys/*` endpoints accept only the JWT —
  * minting/revoking via a connection key would let a leaked key roll itself
  * over and stay alive forever. `/mcp/local-token` accepts ONLY an MCP OAuth

package/dist/modules/mcp/mcp.routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAA+B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAUpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,4CAA4C,CAAC;AAoFpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,sBAAsB,EAC7C,iBAAiB,EAAE,cAAc,EACjC,iBAAiB,EAAE,cAAc,EACjC,eAAe,EAAE,cAAc,EAC/B,cAAc,EAAE,oBAAoB,EACpC,aAAa,EAAE,kBAAkB,EAGjC,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,MAAM,CA8VhB"}
+{"version":3,"file":"mcp.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/mcp/mcp.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAA+B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAYpF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,4CAA4C,CAAC;AA4BpD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,EACtB,qBAAqB,EAAE,sBAAsB,EAC7C,iBAAiB,EAAE,cAAc,EACjC,iBAAiB,EAAE,cAAc,EACjC,eAAe,EAAE,cAAc,EAC/B,cAAc,EAAE,oBAAoB,EACpC,aAAa,EAAE,kBAAkB,EAGjC,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,MAAM,CA0ShB"}