@canonry/canonry 7.72.1 → 7.73.0

package/dist/{chunk-NZZWJCKS.js → chunk-HJHFW455.js}

@@ -3,7 +3,7 @@ import {
   resolveCliAccess,
   resolveCliAccessForInvocation,
   windowOptions
-} from "./chunk-QDN3FL2A.js";
+} from "./chunk-3YIKSZHN.js";
 import {
   emitJsonl
 } from "./chunk-Z7IUAJOF.js";
@@ -14,7 +14,7 @@ import {
 } from "./chunk-HGMYEDAQ.js";
 import {
   OperationAccesses
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/cli-catalog.ts
 import { createRequire } from "module";
@@ -111,7 +111,7 @@ async function dispatchRegisteredCommand(args, fallbackFormat, specs) {
     const accessValue = accessFilterFromArgs(argsWithoutHelp);
     validateAccessFilter(accessValue);
     if (fallbackFormat !== "text") {
-      const { printCliCatalog: printCliCatalog2 } = await import("./cli-catalog-NEZE5QU5.js");
+      const { printCliCatalog: printCliCatalog2 } = await import("./cli-catalog-BXHG544D.js");
       const group2 = argsWithoutHelp.find((arg) => !arg.startsWith("--"));
       printCliCatalog2(specs, fallbackFormat, group2, accessValue);
       return true;

package/dist/{chunk-JE5QURTR.js → chunk-HKV4UWG5.js}

@@ -20,7 +20,7 @@ import {
   resolveProviderModel,
   schedulableRunKindSchema,
   sentimentEvaluatorProviderSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../config/src/index.ts
 import { z as z4 } from "zod";

package/dist/{chunk-DRGCVTYH.js → chunk-JPM3VC6A.js}

@@ -1,6 +1,6 @@
 import {
   hostMatchesDomain
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/citation-utils.ts
 function pickProjectCitedDomain(citedDomains, projectDomains) {

package/dist/{chunk-TOX6HAQJ.js → chunk-JQNVNB63.js}

@@ -2,18 +2,18 @@ import {
   configExists,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-HKV4UWG5.js";
 import {
   BUNDLED_SKILL_NAMES,
   installSkills
-} from "./chunk-PPM6Z7CM.js";
+} from "./chunk-HEL6DKDN.js";
 import {
   PACKAGE_VERSION
 } from "./chunk-AOJU5LKX.js";
 import {
   SKILL_MANIFEST_FILENAME,
   SkillsClients
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/skills-autosync.ts
 import fs from "fs";

package/dist/{chunk-3AG3LPZX.js → chunk-MRSNLKSM.js}

@@ -23,7 +23,7 @@ import {
   measurementDraftUpsertGroupRequestSchema,
   measurementDraftUpsertMarketRequestSchema,
   measurementDraftUpsertTargetRequestSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/measurement-draft-actions.ts
 import { z } from "zod";

package/dist/{chunk-O7WOCTBD.js → chunk-PAIYFNNY.js}

@@ -20,7 +20,7 @@ import {
   templateLinkRatio,
   templateLinkUbiquityAvailable,
   validationError
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 import {
   __export
 } from "./chunk-MLKGABMK.js";
@@ -125,6 +125,7 @@ __export(schema_exports, {
   notifications: () => notifications,
   oauthAuthorizationCodes: () => oauthAuthorizationCodes,
   oauthClients: () => oauthClients,
+  oauthGrants: () => oauthGrants,
   oauthTokens: () => oauthTokens,
   projects: () => projects,
   providerBatchRequests: () => providerBatchRequests,
@@ -858,12 +859,15 @@ var apiKeys = sqliteTable2("api_keys", {
   projectId: text2("project_id").references(() => projects.id, { onDelete: "cascade" }),
   /** Internal delegated session identity, never accepted by the key-create API. */
   delegatedUserId: text2("delegated_user_id").references(() => users.id, { onDelete: "cascade" }),
+  /** Authorization that minted this internal MCP credential. */
+  delegatedOAuthGrantId: text2("delegated_oauth_grant_id").references(() => oauthGrants.id, { onDelete: "cascade" }),
   createdAt: text2("created_at").notNull(),
   lastUsedAt: text2("last_used_at"),
   revokedAt: text2("revoked_at")
 }, (table) => [
   index2("idx_api_keys_prefix").on(table.keyPrefix),
-  index2("idx_api_keys_project").on(table.projectId)
+  index2("idx_api_keys_project").on(table.projectId),
+  index2("idx_api_keys_oauth_grant").on(table.delegatedOAuthGrantId)
 ]);
 var users = sqliteTable2("users", {
   id: text2("id").primaryKey(),
@@ -901,7 +905,7 @@ var oauthClients = sqliteTable2("oauth_clients", {
   id: text2("id").primaryKey(),
   name: text2("name").notNull(),
   /**
-   * scrypt digest, or NULL for a public client that authenticates by PKCE
+   * SHA-256 digest, or NULL for a public client that authenticates by PKCE
    * alone. Never the secret: a client secret is a bearer credential, and a
    * copied database file must not be a working client.
    */
@@ -920,6 +924,18 @@ var oauthClients = sqliteTable2("oauth_clients", {
   createdAt: text2("created_at").notNull(),
   revokedAt: text2("revoked_at")
 });
+var oauthGrants = sqliteTable2("oauth_grants", {
+  id: text2("id").primaryKey(),
+  clientId: text2("client_id").notNull().references(() => oauthClients.id, { onDelete: "cascade" }),
+  userId: text2("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  resource: text2("resource"),
+  scope: text2("scope"),
+  createdAt: text2("created_at").notNull(),
+  revokedAt: text2("revoked_at")
+}, (table) => [
+  index2("idx_oauth_grants_client").on(table.clientId),
+  index2("idx_oauth_grants_user").on(table.userId)
+]);
 var oauthAuthorizationCodes = sqliteTable2("oauth_authorization_codes", {
   /** SHA-256 of the code. The code itself is 256 bits of randomness. */
   codeHash: text2("code_hash").primaryKey(),
@@ -943,6 +959,8 @@ var oauthAuthorizationCodes = sqliteTable2("oauth_authorization_codes", {
 var oauthTokens = sqliteTable2("oauth_tokens", {
   tokenHash: text2("token_hash").primaryKey(),
   kind: text2("kind").$type().notNull(),
+  /** Nullable only for an older binary writing after this migration. */
+  grantId: text2("grant_id").references(() => oauthGrants.id, { onDelete: "cascade" }),
   clientId: text2("client_id").notNull().references(() => oauthClients.id, { onDelete: "cascade" }),
   userId: text2("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
   /** Audience. Enforced on every resource request. */
@@ -952,6 +970,7 @@ var oauthTokens = sqliteTable2("oauth_tokens", {
   revokedAt: text2("revoked_at"),
   createdAt: text2("created_at").notNull()
 }, (table) => [
+  index2("idx_oauth_tokens_grant").on(table.grantId),
   index2("idx_oauth_tokens_user").on(table.userId),
   index2("idx_oauth_tokens_expires").on(table.expiresAt)
 ]);
@@ -8284,6 +8303,54 @@ var MIGRATION_VERSIONS = [
     statements: [
       `ALTER TABLE site_crawl_attempts ADD COLUMN url_versions_skipped INTEGER NOT NULL DEFAULT 0`
     ]
+  },
+  {
+    version: 199,
+    name: "oauth-authorization-grants",
+    statements: [
+      `CREATE TABLE IF NOT EXISTS oauth_grants (
+        id TEXT PRIMARY KEY,
+        client_id TEXT NOT NULL REFERENCES oauth_clients(id) ON DELETE CASCADE,
+        user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+        resource TEXT,
+        scope TEXT,
+        created_at TEXT NOT NULL,
+        revoked_at TEXT
+      )`,
+      `CREATE INDEX IF NOT EXISTS idx_oauth_grants_client ON oauth_grants(client_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_oauth_grants_user ON oauth_grants(user_id)`,
+      `ALTER TABLE oauth_tokens ADD COLUMN grant_id TEXT REFERENCES oauth_grants(id) ON DELETE CASCADE`,
+      `ALTER TABLE api_keys ADD COLUMN delegated_oauth_grant_id TEXT REFERENCES oauth_grants(id) ON DELETE CASCADE`,
+      `CREATE INDEX IF NOT EXISTS idx_oauth_tokens_grant ON oauth_tokens(grant_id)`,
+      `CREATE INDEX IF NOT EXISTS idx_api_keys_oauth_grant ON api_keys(delegated_oauth_grant_id)`,
+      // Credentials whose account or client was removed with foreign keys off
+      // are already unusable. Drop them before enforcing the new grant FKs.
+      `DELETE FROM oauth_tokens WHERE NOT EXISTS (SELECT 1 FROM oauth_clients WHERE id = oauth_tokens.client_id)
+         OR NOT EXISTS (SELECT 1 FROM users WHERE id = oauth_tokens.user_id)`,
+      // Historical rotations carry no lineage. Preserve access while grouping
+      // only the same client, person, audience and consented scope for revocation.
+      `INSERT OR IGNORE INTO oauth_grants (id, client_id, user_id, resource, scope, created_at)
+       SELECT 'legacy:' || MIN(token_hash), client_id, user_id, resource, scope, MIN(created_at)
+       FROM oauth_tokens WHERE grant_id IS NULL
+         AND EXISTS (SELECT 1 FROM oauth_clients WHERE id = oauth_tokens.client_id)
+         AND EXISTS (SELECT 1 FROM users WHERE id = oauth_tokens.user_id)
+       GROUP BY client_id, user_id, resource, scope`,
+      `UPDATE oauth_tokens SET grant_id = (
+         SELECT id FROM oauth_grants g
+         WHERE g.id LIKE 'legacy:%' AND g.client_id = oauth_tokens.client_id
+           AND g.user_id = oauth_tokens.user_id AND g.resource IS oauth_tokens.resource AND g.scope IS oauth_tokens.scope
+       ) WHERE grant_id IS NULL`,
+      // Old MCP keys lack a grant link and cannot be assigned safely. Match
+      // the bound constructor and the older reserved namespace without user
+      // linkage. A manually named key in that namespace also requires reissue.
+      `DELETE FROM dashboard_sessions WHERE api_key_id IN (
+         SELECT id FROM api_keys WHERE (delegated_user_id IS NOT NULL AND name = 'mcp-session:' || delegated_user_id)
+           OR (delegated_user_id IS NULL AND name GLOB 'mcp-session:*')
+       )`,
+      `UPDATE api_keys SET revoked_at = COALESCE(revoked_at, strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+       WHERE (delegated_user_id IS NOT NULL AND name = 'mcp-session:' || delegated_user_id)
+         OR (delegated_user_id IS NULL AND name GLOB 'mcp-session:*')`
+    ]
   }
 ];
 var AERO_LEDGER_REBUILDS = [
@@ -9727,6 +9794,7 @@ export {
   userSessions,
   dashboardSessions,
   oauthClients,
+  oauthGrants,
   oauthAuthorizationCodes,
   oauthTokens,
   schedules,

package/dist/{chunk-MJYO6UK2.js → chunk-PRSQ4R47.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   loadConfigRaw,
   saveConfigPatch
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-HKV4UWG5.js";
 import {
   CANONRY_NPM_PACKAGE_URL,
   compareSemver,
@@ -18,7 +18,7 @@ import {
   updateCheckEnvOptOut,
   upgradeCaveatFor,
   upgradeCommandFor
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/runtime-context.ts
 function cliRuntimeContext(env = process.env, stdio = process) {

package/dist/{chunk-JEBY6MS6.js → chunk-QS6RIP37.js}

@@ -8,7 +8,7 @@ import {
   classifyJourneyEntry,
   hostMatchesDomain,
   hostOf
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // ../integration-traffic/src/ip-ranges/amazonbot.json
 var amazonbot_default = {

package/dist/{chunk-4LTL5RNY.js → chunk-S77W2XSI.js}

@@ -2,13 +2,13 @@ import {
   bucketCliCommandDuration,
   isTelemetryEnabled,
   trackEvent
-} from "./chunk-MJYO6UK2.js";
+} from "./chunk-PRSQ4R47.js";
 import {
   getConfigDir
-} from "./chunk-JE5QURTR.js";
+} from "./chunk-HKV4UWG5.js";
 import {
   currentOutcomeAttribution
-} from "./chunk-BADJCT6U.js";
+} from "./chunk-GWDMWKM6.js";
 import {
   AGENT_NONE,
   OutcomeSurfaces,
@@ -19,7 +19,7 @@ import {
   integrationConnectionPropertiesSchema,
   normalizeAgentSlug,
   usageSurfaceSchema
-} from "./chunk-YXAKL5HM.js";
+} from "./chunk-SF5JLMLG.js";
 
 // src/outcome-telemetry.ts
 import fs from "fs";