@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/modules/tool-auth/connection-keys-admin.routes.d.ts

@@ -0,0 +1,14 @@
+import express from 'express';
+import type { IAdminAccessService } from '../admin/admin.interface.js';
+import type { IExternalApiKeyService } from './external-api-key.interface.js';
+import '../auth/auth.middleware.js';
+/**
+ * Admin overview of connection keys across the deployment (the core
+ * "Connection keys" admin page): every key on every account — owner, label,
+ * created, last used, whether it is still live — and a revoke that is not
+ * scoped to the caller. The per-user surface stays in mcp.routes.ts; this
+ * router exists so an admin can cut off a leaked or forgotten key without
+ * signing in as its owner. Gated per request by {@link IAdminAccessService}.
+ */
+export declare function createConnectionKeysAdminRoutes(externalApiKeyService: Pick<IExternalApiKeyService, 'listForDeployment' | 'revokeAny'>, adminAccess: IAdminAccessService): express.Router;
+//# sourceMappingURL=connection-keys-admin.routes.d.ts.map

package/dist/modules/tool-auth/connection-keys-admin.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-keys-admin.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/connection-keys-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAI9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,4BAA4B,CAAC;AAKpC;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,qBAAqB,EAAE,IAAI,CAAC,sBAAsB,EAAE,mBAAmB,GAAG,WAAW,CAAC,EACtF,WAAW,EAAE,mBAAmB,GAC/B,OAAO,CAAC,MAAM,CAoDhB"}

package/dist/modules/tool-auth/connection-keys-admin.routes.js

@@ -0,0 +1,67 @@
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+const log = logger('connection-keys');
+import { TokenNotFoundError } from './external-api-key.errors.js';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+/** Shape of the `api_tokens.id` column (any uuid version; case-insensitive). */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Admin overview of connection keys across the deployment (the core
+ * "Connection keys" admin page): every key on every account — owner, label,
+ * created, last used, whether it is still live — and a revoke that is not
+ * scoped to the caller. The per-user surface stays in mcp.routes.ts; this
+ * router exists so an admin can cut off a leaked or forgotten key without
+ * signing in as its owner. Gated per request by {@link IAdminAccessService}.
+ */
+export function createConnectionKeysAdminRoutes(externalApiKeyService, adminAccess) {
+    const router = express.Router();
+    const requireAdmin = async (req, res, next) => {
+        if (!(await adminAccess.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Admins only' });
+            return;
+        }
+        next();
+    };
+    // GET /api/admin/connection-keys — every key with its owner, ordered by
+    // owner email then newest-first. Never carries a plaintext or a hash.
+    router.get('/admin/connection-keys', requireAdmin, async (_req, res) => {
+        try {
+            res.json({ keys: await externalApiKeyService.listForDeployment() });
+        }
+        catch (err) {
+            log.error('admin list failed:', { err });
+            res.status(500).json({ error: 'Failed to load connection keys' });
+        }
+    });
+    // DELETE /api/admin/connection-keys/:id — revoke (disconnect) a key
+    // belonging to ANY account. Idempotent on an already-revoked key; 404 when
+    // no such key exists. Revoked rows are kept so `last_used_at` stays
+    // auditable after a leak — there is deliberately no admin hard-delete.
+    router.delete('/admin/connection-keys/:id', requireAdmin, async (req, res) => {
+        const id = String(req.params.id);
+        // The id column is a uuid: anything else makes Postgres raise a cast
+        // error before the WHERE is even evaluated, which would surface as a 500.
+        // A malformed id names no key, so it is a not-found, same as an unknown one.
+        if (!UUID_RE.test(id)) {
+            res.status(404).json({ error: 'Token not found' });
+            return;
+        }
+        try {
+            await externalApiKeyService.revokeAny(id);
+            // Accountability record: WHO revoked WHICH key. Ids only — the key's
+            // label is the owner's free text and does not belong in logs.
+            log.info('revoke audit:', { action: 'admin-revoke-key', actorUserId: req.userId, tokenId: id });
+            res.json({ status: 'revoked' });
+        }
+        catch (err) {
+            if (err instanceof TokenNotFoundError) {
+                res.status(404).json({ error: err.message });
+                return;
+            }
+            log.error('admin revoke failed:', { err });
+            res.status(500).json({ error: 'Failed to revoke this key' });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=connection-keys-admin.routes.js.map

package/dist/modules/tool-auth/connection-keys-admin.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-keys-admin.routes.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/connection-keys-admin.routes.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAEtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,4BAA4B,CAAC,CAAC,+BAA+B;AAEpE,gFAAgF;AAChF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,qBAAsF,EACtF,WAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QACrE,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,2EAA2E;IAC3E,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,qEAAqE;QACrE,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC1C,qEAAqE;YACrE,8DAA8D;YAC9D,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAChG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/tool-auth/external-api-key.interface.d.ts

@@ -28,7 +28,15 @@ export interface ExternalApiKeySummary {
     createdAt: number;
     lastUsedAt: number | null;
     revokedAt: number | null;
+    /**
+     * Who ended it, once `revokedAt` is set: the owner themselves, or an admin
+     * from the deployment overview. Null while live (and on rows revoked
+     * before this was recorded, which read as the owner's doing).
+     */
+    revokedBy: RevokedBy | null;
 }
+/** Who revoked a key: its owner, or an admin acting across the deployment. */
+export type RevokedBy = 'owner' | 'admin';
 /**
  * Result of minting a new connection key. `plaintext` is shown to the user
  * once (with a "you won't see this again" warning); the stored DB row only
@@ -38,13 +46,39 @@ export interface MintedExternalApiKey {
     plaintext: string;
     summary: ExternalApiKeySummary;
 }
+/**
+ * One row of the admin "Connection keys" overview: a key summary plus the
+ * account it belongs to. Deployment-wide, so unlike {@link ExternalApiKeySummary}
+ * the owner is not implied by the caller.
+ */
+export interface AdminExternalApiKeySummary extends ExternalApiKeySummary {
+    user: {
+        id: string;
+        email: string;
+        name: string;
+    };
+}
 /** The kind of a key a person creates by hand. */
 export declare const DEFAULT_KEY_KIND = "key";
+/**
+ * How the plaintext of one kind of key is spelled: the prefix the outside
+ * world sees (and that routes the bearer back here), and the shape of the
+ * random part after it. `base64url` is the platform's own — 43 characters
+ * from a 32-byte draw. `github-token` is what a GitHub OAuth token looks
+ * like after its `gho_`: letters and digits only, 40 of them, so a consumer
+ * that validates the shape of a GitHub token (they are documented as
+ * alphanumeric) keeps it. Both hash the same way; the shape is only what a
+ * client is shown.
+ */
+export interface KeyKindSpec {
+    prefix: string;
+    shape?: 'base64url' | 'github-token';
+}
 /**
  * How a key is minted. `kind` names one of the kinds the service was built
- * with, each of which carries its own plaintext prefix (the tenant's for the
- * default kind, `gho_` for a Claude link); an unknown kind is refused, since
- * nothing would route its bearer back.
+ * with, each of which carries its own spelling (the tenant's prefix for the
+ * default kind, a GitHub-shaped token for a Claude link); an unknown kind is
+ * refused, since nothing would route its bearer back.
  */
 export interface MintOptions {
     kind?: string;
@@ -95,6 +129,20 @@ export interface IExternalApiKeyService {
      * TokenNotFoundError if the token doesn't belong to the user.
      */
     revoke(id: string, userId: string): Promise<void>;
+    /**
+     * Every token on the deployment, active and revoked, with its owner —
+     * the admin overview. Ordered by owner email, then newest-first, so the
+     * caller can group per account without re-sorting.
+     */
+    listForDeployment(): Promise<AdminExternalApiKeySummary[]>;
+    /**
+     * Admin revoke: mark a token revoked WITHOUT scoping by owner, recording
+     * `revokedBy: 'admin'` so the owner's page can say it was taken rather than
+     * disconnected. Same idempotency as {@link revoke}; throws
+     * TokenNotFoundError when no such token exists. Only reachable through an
+     * admin-gated route — the per-user route must keep using {@link revoke}.
+     */
+    revokeAny(id: string): Promise<void>;
     /**
      * Permanently delete a token row, dropping its audit trail. Only permitted
      * on an already-revoked token — an active key must be disconnected first,

package/dist/modules/tool-auth/external-api-key.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf;;;;;eAKG;YACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B;KACF;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAEhD;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1F;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE/D;;;;OAIG;IACH,kBAAkB,CAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEvD,0DAA0D;IAC1D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAE9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}
+{"version":3,"file":"external-api-key.interface.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf;;;;;eAKG;YACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B;KACF;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,WAAW,GAAG,cAAc,CAAC;CACtC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAEhD;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1F;;;;;OAKG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE/D;;;;OAIG;IACH,kBAAkB,CAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAEvD,0DAA0D;IAC1D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAE9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAE3D;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD"}

package/dist/modules/tool-auth/external-api-key.interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.interface.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.interface.ts"],"names":[],"mappings":"AA6CA,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}
+{"version":3,"file":"external-api-key.interface.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.interface.ts"],"names":[],"mappings":"AAmEA,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC"}

package/dist/modules/tool-auth/external-api-key.service.d.ts

@@ -1,6 +1,6 @@
 import type { AuthUser } from '@bevel-software/platform-shared';
 import type { Database } from '../database/connection.js';
-import { type ExternalApiKeySummary, type IExternalApiKeyService, type MintOptions, type MintedExternalApiKey } from './external-api-key.interface.js';
+import { type AdminExternalApiKeySummary, type ExternalApiKeySummary, type IExternalApiKeyService, type KeyKindSpec, type MintOptions, type MintedExternalApiKey } from './external-api-key.interface.js';
 export declare class ExternalApiKeyService implements IExternalApiKeyService {
     private readonly db;
     private readonly keyPrefix;
@@ -10,14 +10,14 @@ export declare class ExternalApiKeyService implements IExternalApiKeyService {
      * @param keyPrefix Tenant-derived plaintext prefix (e.g. `bevel_`) — injected
      *   from {@link AppConfig.externalApiKeyPrefix} so a deploy can brand its keys.
      *   Every key of the default kind is minted with it.
-     * @param kinds Other kinds a key may be minted as, each with the plaintext
-     *   prefix that kind is spelled with — a Claude link's `gho_`, the shape
-     *   claude.ai expects from a GitHub host. Same key, same table, same
+     * @param kinds Other kinds a key may be minted as, each with the spelling
+     *   that kind has — a Claude link's `gho_` and GitHub's alphabet, the
+     *   shape claude.ai expects from a GitHub host. Same key, same table, same
      *   revocation; the KIND is stored on the row and is what tells such keys
-     *   apart (a label is the person's to edit), the prefix is only what the
+     *   apart (a label is the person's to edit), the spelling is only what the
      *   outside world sees and what routes the bearer back here.
      */
-    constructor(db: Database, keyPrefix: string, kinds?: Readonly<Record<string, string>>);
+    constructor(db: Database, keyPrefix: string, kinds?: Readonly<Record<string, KeyKindSpec>>);
     /** True if a bearer string carries one of this service's key prefixes. */
     looksLikeExternalApiKey(token: string): boolean;
     mint(userId: string, label: string, options?: MintOptions): Promise<MintedExternalApiKey>;
@@ -27,7 +27,17 @@ export declare class ExternalApiKeyService implements IExternalApiKeyService {
         user: AuthUser;
     } | null>;
     listForUser(userId: string): Promise<ExternalApiKeySummary[]>;
+    listForDeployment(): Promise<AdminExternalApiKeySummary[]>;
     revoke(id: string, userId: string): Promise<void>;
+    revokeAny(id: string): Promise<void>;
+    /**
+     * Set `revokedAt` (and who did it) on the rows matching `scope`. Idempotent
+     * on already-revoked rows because we only write when `revokedAt` is
+     * currently null — re-revoking returns 0 rows changed but no error, and
+     * never rewrites who ended it first. Throws TokenNotFoundError when `scope`
+     * matches nothing at all.
+     */
+    private markRevoked;
     remove(id: string, userId: string): Promise<void>;
     private touchLastUsed;
 }

package/dist/modules/tool-auth/external-api-key.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAUzC,qBAAa,qBAAsB,YAAW,sBAAsB;IAehE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;gBAEgB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAK/D,0EAA0E;IAC1E,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA4B7F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAK9D,kBAAkB,CACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IA4ChD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAS7D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAgCzC,aAAa;CAM5B"}
+{"version":3,"file":"external-api-key.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAO1D,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAEhB,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AAazC,qBAAa,qBAAsB,YAAW,sBAAsB;IAehE,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAhBxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;gBAEgB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAM;IAKpE,0EAA0E;IAC1E,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIzC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgC7F,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAK9D,kBAAkB,CACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,IAAI,CAAC;IA4ChD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAS7D,iBAAiB,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAoB1D,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1C;;;;;;OAMG;YACW,WAAW;IAsBnB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAgCzC,aAAa;CAM5B"}

package/dist/modules/tool-auth/external-api-key.service.js

@@ -1,5 +1,7 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm';
+import { logger } from '../../shared/logging.js';
+const log = logger('external-api-key');
+import { and, asc, desc, eq, isNotNull, isNull } from 'drizzle-orm';
 import { externalApiKeys, users } from '../database/schema.js';
 import { InvalidTokenLabelError, TokenNotFoundError, TokenStillActiveError, } from './external-api-key.errors.js';
 import { DEFAULT_KEY_KIND, } from './external-api-key.interface.js';
@@ -8,6 +10,9 @@ import { DEFAULT_KEY_KIND, } from './external-api-key.interface.js';
 // brute force, cheap to copy. The prefix lets the auth middleware route
 // key-vs-JWT requests without parsing both shapes.
 const TOKEN_BYTES = 32;
+// A GitHub-shaped token: 20 random bytes as 40 hex digits — alphanumeric,
+// as GitHub's own are, and 160 bits, which a hash lookup never exhausts.
+const GITHUB_TOKEN_BYTES = 20;
 const MAX_LABEL_LEN = 200;
 export class ExternalApiKeyService {
     db;
@@ -18,18 +23,18 @@ export class ExternalApiKeyService {
      * @param keyPrefix Tenant-derived plaintext prefix (e.g. `bevel_`) — injected
      *   from {@link AppConfig.externalApiKeyPrefix} so a deploy can brand its keys.
      *   Every key of the default kind is minted with it.
-     * @param kinds Other kinds a key may be minted as, each with the plaintext
-     *   prefix that kind is spelled with — a Claude link's `gho_`, the shape
-     *   claude.ai expects from a GitHub host. Same key, same table, same
+     * @param kinds Other kinds a key may be minted as, each with the spelling
+     *   that kind has — a Claude link's `gho_` and GitHub's alphabet, the
+     *   shape claude.ai expects from a GitHub host. Same key, same table, same
      *   revocation; the KIND is stored on the row and is what tells such keys
-     *   apart (a label is the person's to edit), the prefix is only what the
+     *   apart (a label is the person's to edit), the spelling is only what the
      *   outside world sees and what routes the bearer back here.
      */
     constructor(db, keyPrefix, kinds = {}) {
         this.db = db;
         this.keyPrefix = keyPrefix;
         this.kinds = kinds;
-        this.prefixes = [keyPrefix, ...Object.values(kinds)];
+        this.prefixes = [keyPrefix, ...Object.values(kinds).map((k) => k.prefix)];
     }
     /** True if a bearer string carries one of this service's key prefixes. */
     looksLikeExternalApiKey(token) {
@@ -37,8 +42,8 @@ export class ExternalApiKeyService {
     }
     async mint(userId, label, options = {}) {
         const kind = options.kind ?? DEFAULT_KEY_KIND;
-        const prefix = kind === DEFAULT_KEY_KIND ? this.keyPrefix : this.kinds[kind];
-        if (!prefix)
+        const spec = kind === DEFAULT_KEY_KIND ? { prefix: this.keyPrefix } : this.kinds[kind];
+        if (!spec)
             throw new Error(`Unknown key kind "${kind}"`);
         const trimmed = (label ?? '').trim();
         if (trimmed.length === 0) {
@@ -47,7 +52,10 @@ export class ExternalApiKeyService {
         if (trimmed.length > MAX_LABEL_LEN) {
             throw new InvalidTokenLabelError(`Label cannot exceed ${MAX_LABEL_LEN} characters`);
         }
-        const plaintext = prefix + randomBytes(TOKEN_BYTES).toString('base64url');
+        const random = spec.shape === 'github-token'
+            ? randomBytes(GITHUB_TOKEN_BYTES).toString('hex')
+            : randomBytes(TOKEN_BYTES).toString('base64url');
+        const plaintext = spec.prefix + random;
         const tokenHash = hashToken(plaintext);
         const [row] = await this.db
             .insert(externalApiKeys)
@@ -90,7 +98,7 @@ export class ExternalApiKeyService {
         // the worst case is a slightly stale `last_used_at`, which is fine for
         // a "when was this key last used" audit view.
         this.touchLastUsed(row.tokenId).catch((err) => {
-            console.warn('[external-api-key] touchLastUsed failed:', err);
+            log.warn('touchLastUsed failed:', { err });
         });
         return {
             tokenId: row.tokenId,
@@ -110,24 +118,58 @@ export class ExternalApiKeyService {
             .orderBy(desc(externalApiKeys.createdAt));
         return rows.map(toSummary);
     }
+    async listForDeployment() {
+        // Owner joined in so the admin overview is one round-trip; ordered by
+        // owner email so per-account grouping is a linear pass, newest key
+        // first within an account (same order the owner sees on their own page).
+        const rows = await this.db
+            .select({
+            key: externalApiKeys,
+            userId: users.id,
+            email: users.email,
+            name: users.name,
+        })
+            .from(externalApiKeys)
+            .innerJoin(users, eq(externalApiKeys.userId, users.id))
+            .orderBy(asc(users.email), desc(externalApiKeys.createdAt));
+        return rows.map((row) => ({
+            ...toSummary(row.key),
+            user: { id: row.userId, email: row.email, name: row.name },
+        }));
+    }
     async revoke(id, userId) {
-        // Scope the WHERE by userId so a user can never revoke another user's
-        // token even if they learn the id. Idempotent on already-revoked rows
-        // because we only set `revokedAt` when it's currently null — re-revoking
-        // returns 0 rows changed but no error.
+        // Scope by userId so a user can never revoke another user's token even
+        // if they learn the id.
+        await this.markRevoked(and(eq(externalApiKeys.id, id), eq(externalApiKeys.userId, userId)), 'owner');
+    }
+    async revokeAny(id) {
+        // No owner scope: the caller is an admin acting across the deployment.
+        // The route that exposes this is admin-gated; nothing user-facing may
+        // reach it. Recorded as such so the owner is told it was taken, not
+        // that they disconnected it.
+        await this.markRevoked(eq(externalApiKeys.id, id), 'admin');
+    }
+    /**
+     * Set `revokedAt` (and who did it) on the rows matching `scope`. Idempotent
+     * on already-revoked rows because we only write when `revokedAt` is
+     * currently null — re-revoking returns 0 rows changed but no error, and
+     * never rewrites who ended it first. Throws TokenNotFoundError when `scope`
+     * matches nothing at all.
+     */
+    async markRevoked(scope, by) {
         const result = await this.db
             .update(externalApiKeys)
-            .set({ revokedAt: new Date() })
-            .where(and(eq(externalApiKeys.id, id), eq(externalApiKeys.userId, userId), isNull(externalApiKeys.revokedAt)))
+            .set({ revokedAt: new Date(), revokedBy: by })
+            .where(and(scope, isNull(externalApiKeys.revokedAt)))
             .returning({ id: externalApiKeys.id });
         if (result.length === 0) {
-            // Distinguish "doesn't exist / not yours" from "already revoked".
+            // Distinguish "doesn't exist / out of scope" from "already revoked".
             // The latter must stay idempotent (return success); only the former
             // throws.
             const [existing] = await this.db
                 .select({ id: externalApiKeys.id })
                 .from(externalApiKeys)
-                .where(and(eq(externalApiKeys.id, id), eq(externalApiKeys.userId, userId)))
+                .where(scope)
                 .limit(1);
             if (!existing) {
                 throw new TokenNotFoundError();
@@ -176,6 +218,7 @@ function toSummary(row) {
         createdAt: row.createdAt.getTime(),
         lastUsedAt: row.lastUsedAt ? row.lastUsedAt.getTime() : null,
         revokedAt: row.revokedAt ? row.revokedAt.getTime() : null,
+        revokedBy: row.revokedBy ?? null,
     };
 }
 //# sourceMappingURL=external-api-key.service.js.map

package/dist/modules/tool-auth/external-api-key.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAKjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA0C,EAAE;QAF5C,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAuC;QAE7D,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAClC,CACF;aACA,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,kEAAkE;YAClE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CACrC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"external-api-key.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/external-api-key.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAY,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,gBAAgB,GAQjB,MAAM,iCAAiC,CAAC;AAEzC,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,mDAAmD;AACnD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,0EAA0E;AAC1E,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,qBAAqB;IAeb;IACA;IACA;IAhBF,QAAQ,CAAoB;IAE7C;;;;;;;;;;OAUG;IACH,YACmB,EAAY,EACZ,SAAiB,EACjB,QAA+C,EAAE;QAFjD,OAAE,GAAF,EAAE,CAAU;QACZ,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAA4C;QAElE,IAAI,CAAC,QAAQ,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,0EAA0E;IAC1E,uBAAuB,CAAC,KAAa;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,KAAa,EAAE,UAAuB,EAAE;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC;QAC9C,MAAM,IAAI,GAA4B,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,aAAa,aAAa,CAClD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,IAAI,CAAC,KAAK,KAAK,cAAc;YAC3B,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;aACnD,SAAS,EAAE,CAAC;QAEf,OAAO;YACL,SAAS;YACT,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB;QAEjB,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvC,uEAAuE;QACvE,sEAAsE;QACtE,uEAAuE;QACvE,+BAA+B;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aACxB,MAAM,CAAC;YACN,OAAO,EAAE,eAAe,CAAC,EAAE;YAC3B,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACvF,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE;gBACJ,EAAE,EAAE,GAAG,CAAC,MAAM;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;aACtC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACzC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,MAAM,CAAC;YACN,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,KAAK,CAAC,EAAE;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACtD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;SAC3D,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,WAAW,CACpB,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,6BAA6B;QAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CAAC,KAAU,EAAE,EAAa;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE;aACzB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACpD,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,qEAAqE;YACrE,oEAAoE;YACpE,UAAU;YACV,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;iBAC7B,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC;iBAClC,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,KAAK,CAAC;iBACZ,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,MAAc;QACrC,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;aAChD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC1E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAChC,uEAAuE;YACvE,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACpC,CAAC;QAED,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAC1B,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,CACrC,CACF,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAAe;QACzC,MAAM,IAAI,CAAC,EAAE;aACV,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,GAAwC;IACzD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI;QACzD,SAAS,EAAG,GAAG,CAAC,SAA8B,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/internal-token.service.d.ts

@@ -70,8 +70,11 @@ export declare class InternalTokenService {
     });
     /** Token lifetime in ms — so callers caching a minted token can refresh it before expiry. */
     get tokenTtlMs(): number;
-    /** @param ttlMs Override the default lifetime — e.g. the MCP proxy mints
-     *   session-loopback tokens that must outlive its 4h session idle TTL. */
+    /** @param ttlMs Override the default lifetime — for a caller whose token
+     *   must live a different span than the default: the MCP proxy's loopback
+     *   bearer (`MCP_LOOPBACK_TOKEN_TTL_MS`, longer, so a long tool call is not
+     *   cut off mid-way) and the external-proxy token minted for a grant, whose
+     *   life is bounded by the grant's remaining time (`mcp.routes.ts`). */
     mint(claim: InternalTokenClaim, ttlMs?: number): string;
     /** Returns the claim for a valid, unexpired token; null otherwise. */
     verify(token: string): InternalTokenClaim | null;

package/dist/modules/tool-auth/internal-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA4BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;4EAIwE;IACxE,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA4BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}

package/dist/modules/tool-auth/internal-token.service.js

@@ -46,8 +46,11 @@ export class InternalTokenService {
     get tokenTtlMs() {
         return this.ttlMs;
     }
-    /** @param ttlMs Override the default lifetime — e.g. the MCP proxy mints
-     *   session-loopback tokens that must outlive its 4h session idle TTL. */
+    /** @param ttlMs Override the default lifetime — for a caller whose token
+     *   must live a different span than the default: the MCP proxy's loopback
+     *   bearer (`MCP_LOOPBACK_TOKEN_TTL_MS`, longer, so a long tool call is not
+     *   cut off mid-way) and the external-proxy token minted for a grant, whose
+     *   life is bounded by the grant's remaining time (`mcp.routes.ts`). */
     mint(claim, ttlMs) {
         const payload = { ...claim, exp: this.now() + (ttlMs ?? this.ttlMs) };
         const body = b64url(Buffer.from(JSON.stringify(payload), 'utf8'));

package/dist/modules/tool-auth/internal-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8CvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8CvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;4EAIwE;IACxE,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}

package/dist/modules/tool-auth/key-or-session.middleware.d.ts

@@ -0,0 +1,23 @@
+import type { RequestHandler } from 'express';
+/**
+ * One gate for an endpoint that serves the app AND agents: a bearer that
+ * looks like a tool credential (a `bevel_…` connection key, an internal
+ * token) goes through the tool-auth middleware; anything else — the
+ * browser's session JWT, its cookie — goes through the session middleware.
+ * Whichever admitted the caller, `req.userId` names them afterwards, so a
+ * handler written for sessions (`resolveUser` → `req.userId`) serves both.
+ *
+ * Composition, not a third verifier: each credential is still checked by
+ * the code that owns it. Deliberately NOT the read-only-manuals gate
+ * (`createManualAuthMiddleware`), which is documented as the one place a
+ * session may stand in for a tool credential; here it is the other way
+ * round — a tool credential is admitted to an app endpoint — and only for
+ * endpoints a tool definition describes.
+ */
+export declare function keyOrSessionAuth(deps: {
+    sessionAuth: RequestHandler;
+    toolAuth: RequestHandler;
+    /** Whether a bearer value is a tool credential rather than a session token. */
+    isToolCredential(token: string): boolean;
+}): RequestHandler;
+//# sourceMappingURL=key-or-session.middleware.d.ts.map

package/dist/modules/tool-auth/key-or-session.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-or-session.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/key-or-session.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAE/E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,WAAW,EAAE,cAAc,CAAC;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C,GAAG,cAAc,CAsBjB"}

package/dist/modules/tool-auth/key-or-session.middleware.js

@@ -0,0 +1,39 @@
+/**
+ * One gate for an endpoint that serves the app AND agents: a bearer that
+ * looks like a tool credential (a `bevel_…` connection key, an internal
+ * token) goes through the tool-auth middleware; anything else — the
+ * browser's session JWT, its cookie — goes through the session middleware.
+ * Whichever admitted the caller, `req.userId` names them afterwards, so a
+ * handler written for sessions (`resolveUser` → `req.userId`) serves both.
+ *
+ * Composition, not a third verifier: each credential is still checked by
+ * the code that owns it. Deliberately NOT the read-only-manuals gate
+ * (`createManualAuthMiddleware`), which is documented as the one place a
+ * session may stand in for a tool credential; here it is the other way
+ * round — a tool credential is admitted to an app endpoint — and only for
+ * endpoints a tool definition describes.
+ */
+export function keyOrSessionAuth(deps) {
+    return (req, res, next) => {
+        const header = req.headers.authorization;
+        const token = header && header.toLowerCase().startsWith('bearer ') ? header.slice(header.indexOf(' ') + 1).trim() : '';
+        if (!token || !deps.isToolCredential(token)) {
+            deps.sessionAuth(req, res, next);
+            return;
+        }
+        deps.toolAuth(req, res, (err) => {
+            if (err) {
+                next(err);
+                return;
+            }
+            // The tool gate names the caller on `req.toolAuth`; the endpoint reads
+            // `req.userId`, as it does for a session. Assigned unconditionally: the
+            // credential this gate accepted is who the caller is, whatever an
+            // earlier middleware may have written there.
+            if (req.toolAuth)
+                req.userId = req.toolAuth.userId;
+            next();
+        });
+    };
+}
+//# sourceMappingURL=key-or-session.middleware.js.map

package/dist/modules/tool-auth/key-or-session.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-or-session.middleware.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/key-or-session.middleware.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,MAAM,KAAK,GACT,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YACxC,IAAI,GAAG,EAAE,CAAC;gBACR,IAAI,CAAC,GAAG,CAAC,CAAC;gBACV,OAAO;YACT,CAAC;YACD,uEAAuE;YACvE,wEAAwE;YACxE,kEAAkE;YAClE,6CAA6C;YAC7C,IAAI,GAAG,CAAC,QAAQ;gBAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YACnD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/modules/tool-auth/tool-auth.middleware.d.ts

@@ -68,7 +68,12 @@ export declare const requireInternalSource: RequestHandler;
  * Mount AFTER `toolAuth`. 403 (authenticated, but not authorized).
  */
 export declare const requireExternalSource: RequestHandler;
-/** Outcome of verifying a bearer token — either a normalized identity or a status+message to surface. */
+/**
+ * Outcome of verifying a bearer token — either a normalized identity or a
+ * status+message to surface. `challenge` overrides the default
+ * `WWW-Authenticate` value on a 401 (a rejected connection key answers with
+ * its own plain `invalid_token` challenge).
+ */
 export type VerifyResult = {
     ok: true;
     auth: ToolAuth;
@@ -76,6 +81,7 @@ export type VerifyResult = {
     ok: false;
     status: number;
     message: string;
+    challenge?: string;
 };
 /**
  * The framework-agnostic verify core: bearer token (the value AFTER `Bearer `) →

package/dist/modules/tool-auth/tool-auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF,yGAAyG;AACzG,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CA6BtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,GACvB,cAAc,CAuChB"}
+{"version":3,"file":"tool-auth.middleware.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/tool-auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAI/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iLAAiL;IACjL,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;SACrB;KACF;CACF;AAID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAMnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,YAAY,CAAC,CA6BtD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,GACzC,cAAc,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,qBAAqB,EAAE,sBAAsB,EAC7C,oBAAoB,EAAE,oBAAoB,EAC1C,WAAW,EAAE,WAAW,GACvB,cAAc,CAuChB"}